Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Blauer trojaner er unterstreicht mir blaue wörter manche mit links

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Log-Analyse und Auswertung: Blauer trojaner er unterstreicht mir blaue wörter manche mit links

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 25.07.2014, 14:33   #1
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Hey,

Bei mir werden immer wieder wörter blau markiert und mit links verlinkt wie bekomme ich das wieder weg

Alt 25.07.2014, 15:04   #2
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links




Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab.
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.



Los geht's:

Schritt 1


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 25.07.2014, 15:21   #3
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014 01
Ran by user (administrator) on USER-PC on 25-07-2014 16:18:06
Running from C:\Users\user\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(The Privoxy team - www.privoxy.org) C:\Program Files (x86)\MSR\Privoxy\privoxy.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-29] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Registry Helper] => "C:\Program Files (x86)\Registry Helper\RegistryHelper.Exe" /boot
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Akamai NetSession Interface] => C:\Users\user\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\Program Files (x86)\SupTab\SearchProtect64.dll [102512 2014-05-08] (Skytech Co., Ltd.)
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => C:\Program Files (x86)\SupTab\SearchProtect32.dll [91248 2014-05-08] (Skytech Co., Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1406293489&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.eazytosearch.info/?l=1&q={searchTerms}&pid=724&r=2014/06/08&hid=12766663853909689536&lg=EN&cc=AT
BHO: savie on -> {481C847C-431D-CF2C-9B50-B13C0BF98265} -> C:\Program Files (x86)\savie on\Zu.x64.dll ()
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: savie on -> {481C847C-431D-CF2C-9B50-B13C0BF98265} -> C:\Program Files (x86)\savie on\Zu.dll ()
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======
CHR HomePage: hxxp://istart.webssearches.com/?type=hppp&ts=1404718433&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
CHR StartupUrls: "hxxp://www.search.ask.com/?tpid=ORJ-SPE&o=APN11412&pf=V7&trgb=CR&p2=%5EBBK%5EOSJ000%5EYY%5EAT&gct=hp&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=cr_35.0.1916.114&apn_uid=1E455068-CB0D-4341-A302-6FF7D0D23B0B&itbv=12.15.1.20&doi=2014-07-24&psv=&pt=tb", "hxxp://istart.webssearches.com/?type=hppp&ts=1404718433&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX"
CHR DefaultSearchKeyword: ask search
CHR DefaultSearchProvider: Ask Search
CHR DefaultSearchURL: hxxp://www.search.ask.com/web?tpid=ORJ-SPE&o=APN11412&l=dis&pf=V7&p2=%5EBBK%5EOSJ000%5EYY%5EAT&gct=&itbv=12.15.1.20&doi=2014-07-24&apn_uid=1E455068-CB0D-4341-A302-6FF7D0D23B0B&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=cr_35.0.1916.114&psv=&pt=tb&trgb=CR&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-20]
CHR Extension: (Google Mail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2014-05-18] () [File not signed]
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-30] (BitRaider, LLC)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21007192 2014-04-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-04-29] ()
R2 SystemUpdatekb70007; C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe [18944 2014-05-08] () [File not signed]
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18776 2014-04-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 BRDriver64; \??\C:\ProgramData\BitRaider\BRDriver64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 16:18 - 2014-07-25 16:18 - 00016375 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:17 - 2014-07-25 16:18 - 00000000 ____D () C:\FRST
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:58 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 17:21 - 2014-07-24 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-07-24 17:21 - 2014-07-24 19:23 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-07-24 17:21 - 2014-07-24 17:21 - 00000000 ____D () C:\Users\user\AppData\Roaming\Nico Mak Computing
2014-07-24 17:21 - 2014-07-24 17:21 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-07-24 16:31 - 2014-07-24 17:57 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-07-24 16:31 - 2014-07-24 16:31 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-07-24 16:31 - 2014-07-24 16:31 - 00000000 ____D () C:\ProgramData\APN
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-10 03:33 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-10 03:33 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-10 03:33 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 03:33 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 03:33 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 03:33 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 03:33 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 03:33 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 03:33 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 03:33 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 03:33 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 03:33 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 03:33 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 03:33 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 03:33 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 03:33 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 03:33 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 03:33 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 03:33 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 03:33 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 03:33 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 03:33 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 03:33 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 03:33 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 03:33 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 03:33 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 03:32 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 03:32 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 03:32 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 03:32 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 03:32 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 21:20 - 2014-07-24 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-06 14:58 - 2014-07-24 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-06 14:58 - 2009-09-16 07:02 - 00031232 _____ (Tunngle.net) C:\Windows\system32\Drivers\tap0901t.sys
2014-07-06 14:10 - 2014-07-06 14:14 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:09 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-06 12:22 - 2014-07-06 14:01 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-03 08:35 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-03 08:03 - 2014-07-03 08:03 - 00000000 ____D () C:\ProgramData\DSearchLink
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:42 - 2014-07-24 23:30 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:32 - 2014-07-24 23:30 - 00000000 ____D () C:\AeriaGames
2014-06-30 04:32 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:17 - 2014-06-27 04:18 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 16:18 - 2014-07-25 16:18 - 00016375 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:18 - 2014-07-25 16:17 - 00000000 ____D () C:\FRST
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2014-07-25 16:12 - 2014-03-20 17:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\Skype
2014-07-25 15:34 - 2014-04-28 15:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-25 15:32 - 2014-03-20 16:44 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-25 15:10 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-25 15:10 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-25 15:07 - 2014-03-20 16:31 - 01684609 _____ () C:\Windows\WindowsUpdate.log
2014-07-25 15:02 - 2009-07-14 06:51 - 00049710 _____ () C:\Windows\setupact.log
2014-07-25 15:01 - 2014-06-08 22:26 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-25 15:01 - 2014-03-20 16:44 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-25 15:01 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-24 23:30 - 2014-06-30 04:42 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-07-24 23:30 - 2014-06-30 04:32 - 00000000 ____D () C:\AeriaGames
2014-07-24 23:30 - 2014-05-27 22:50 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-07-24 23:28 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-24 22:56 - 2014-04-28 15:17 - 00000000 ____D () C:\Users\user\AppData\Roaming\TS3Client
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 19:23 - 2014-07-24 17:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-07-24 19:23 - 2014-07-24 17:21 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-07-24 18:58 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:58 - 2014-07-06 14:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-24 18:58 - 2014-03-20 16:54 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1
2014-07-24 18:58 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-07-24 18:57 - 2014-07-06 14:09 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-24 18:57 - 2014-07-03 08:35 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-24 18:57 - 2014-06-09 16:42 - 00000000 ____D () C:\Users\user\Downloads\Minecraft
2014-07-24 18:57 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-24 18:56 - 2014-07-09 21:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-24 18:56 - 2014-06-30 04:32 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-07-24 18:56 - 2014-06-23 02:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-24 18:56 - 2014-06-21 22:35 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2014-07-24 18:56 - 2014-06-19 17:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:28 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 18:35 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\Program Files (x86)\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-27 22:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-07-24 18:56 - 2014-05-17 00:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
2014-07-24 18:56 - 2014-05-07 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-07-24 18:56 - 2014-05-07 17:35 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-07-24 18:56 - 2014-04-30 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA
2014-07-24 18:56 - 2014-04-30 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2014-07-24 18:56 - 2014-04-28 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2014-07-24 18:56 - 2014-03-20 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-07-24 18:56 - 2014-03-20 17:05 - 00000000 ____D () C:\ProgramData\Package Cache
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-24 18:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-07-24 18:55 - 2014-06-08 22:32 - 00000000 ____D () C:\Users\user\AppData\Local\NVIDIA
2014-07-24 18:52 - 2014-06-23 02:25 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-24 18:52 - 2014-06-08 22:30 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 17:57 - 2014-07-24 16:31 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-07-24 17:55 - 2014-06-08 18:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-24 17:21 - 2014-07-24 17:21 - 00000000 ____D () C:\Users\user\AppData\Roaming\Nico Mak Computing
2014-07-24 17:21 - 2014-07-24 17:21 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-07-24 17:09 - 2014-03-20 16:33 - 00000000 __SHD () C:\Recovery
2014-07-24 17:05 - 2014-03-20 17:20 - 00064408 _____ () C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 17:03 - 2014-06-08 22:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 16:31 - 2014-07-24 16:31 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-07-24 16:31 - 2014-07-24 16:31 - 00000000 ____D () C:\ProgramData\APN
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-22 22:02 - 2014-05-27 22:46 - 00000000 ____D () C:\Users\user\AppData\Local\PMB Files
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-12 13:20 - 2014-04-28 15:48 - 00185593 _____ () C:\Windows\DirectX.log
2014-07-11 09:31 - 2009-07-14 06:45 - 00294776 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 00:54 - 2014-05-07 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-11 00:54 - 2010-11-21 09:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 21:45 - 2014-06-05 21:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 21:43 - 2014-06-09 03:00 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 00:02 - 2014-06-09 17:06 - 00000000 ____D () C:\Users\user\AppData\Roaming\Tunngle
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-09 12:34 - 2014-04-28 15:20 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 12:34 - 2014-04-28 15:20 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 12:34 - 2014-04-28 15:20 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-07 09:32 - 2010-11-21 05:47 - 00013530 _____ () C:\Windows\PFRO.log
2014-07-06 14:14 - 2014-07-06 14:10 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:01 - 2014-07-06 12:22 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-05 18:01 - 2014-05-27 22:46 - 00000000 ____D () C:\ProgramData\PMB Files
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-03 08:03 - 2014-07-03 08:03 - 00000000 ____D () C:\ProgramData\DSearchLink
2014-07-02 16:18 - 2014-04-30 19:47 - 00000000 ____D () C:\ProgramData\BitRaider
2014-07-02 04:37 - 2014-05-11 03:32 - 00000145 _____ () C:\Users\user\Desktop\arma 3 royal.txt
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:09 - 2014-07-10 03:33 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-10 03:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:18 - 2014-06-27 04:17 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:35 - 2014-06-22 00:54 - 00000000 ____D () C:\Users\user\Documents\4a games
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-06-25 12:27 - 2010-11-21 08:50 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-06-25 12:27 - 2010-11-21 08:50 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-06-25 12:27 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\buenosearch.exe
C:\Users\user\AppData\Local\Temp\BuenoSearchTB.exe
C:\Users\user\AppData\Local\Temp\BuenoSearchTB[1].exe
C:\Users\user\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\user\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\user\AppData\Local\Temp\f.exe
C:\Users\user\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll
C:\Users\user\AppData\Local\Temp\JavaRa.exe
C:\Users\user\AppData\Local\Temp\jli.dll
C:\Users\user\AppData\Local\Temp\jolejolevs Deck Pack.rar__3515_i876280781_il6771304.exe
C:\Users\user\AppData\Local\Temp\jre-7u55-windows-i586.exe
C:\Users\user\AppData\Local\Temp\jre-7u60-windows-i586.exe
C:\Users\user\AppData\Local\Temp\keytool.exe
C:\Users\user\AppData\Local\Temp\msvcr100.dll
C:\Users\user\AppData\Local\Temp\node.exe
C:\Users\user\AppData\Local\Temp\nsy262C.exe
C:\Users\user\AppData\Local\Temp\nsy6012.exe
C:\Users\user\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\user\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\user\AppData\Local\Temp\nvStInst.exe
C:\Users\user\AppData\Local\Temp\optprosetup.exe
C:\Users\user\AppData\Local\Temp\PreExe_ID_13667.exe
C:\Users\user\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\user\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\user\AppData\Local\Temp\SPSetup.exe
C:\Users\user\AppData\Local\Temp\sqlite3.exe
C:\Users\user\AppData\Local\Temp\sSetup-se.exe
C:\Users\user\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\user\AppData\Local\Temp\xmlUpdater.exe
C:\Users\user\AppData\Local\Temp\YgoUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-08 13:30

==================== End Of Log ============================
--- --- ---

--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014 01
Ran by user at 2014-07-25 16:18:38
Running from C:\Users\user\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.9.9 - BitRaider, LLC)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)
Free YouTube to MP3 Converter version 3.12.34.430 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.34.430 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\{FBD50733-2ABE-3D23-88B4-7B0C0A0ADDA0}) (Version: 65.181.32922 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Infestation: Survivor Stories (HKLM-x32\...\Steam App 226700) (Version:  - Hammerpoint Interactive)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
Killing Floor (HKLM-x32\...\Steam App 1250) (Version:  - Tripwire Interactive)
Killing Floor Mod: Defence Alliance 2 (HKLM-x32\...\Steam App 35420) (Version:  - Defence Alliance Team)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.3.38 - Client Connect LTD) <==== ATTENTION
SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden
Skype™ 6.14 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.14.104 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2189.2 - Hi-Rez Studios)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version:  - Rebellion)
Star Wars - Battlefront II (HKLM-x32\...\Steam App 6060) (Version:  - Pandemic Studios)
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 7.0.0.40 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
System Update kb70007 (x32 Version: 1.0.0 - MSR) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

18-07-2014 13:18:52 Windows Update
22-07-2014 13:29:00 Windows Update
24-07-2014 13:26:34 Removed Aeria Ignite
24-07-2014 14:27:59 Installed Java 7 Update 65
24-07-2014 14:49:29 DirectX wurde installiert
24-07-2014 14:59:21 Wiederherstellungsvorgang
24-07-2014 15:26:45 Windows Update
24-07-2014 15:54:29 Installed Java 7 Update 65
24-07-2014 16:36:15 Windows Update
24-07-2014 16:38:04 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
24-07-2014 16:49:21 Wiederherstellungsvorgang
24-07-2014 17:08:58 Windows Update
24-07-2014 21:29:42 Removed Aeria Ignite

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3A49BE3B-C0E9-4070-B4AB-A78DF69C6026} - System32\Tasks\{77245E9B-B20B-4898-B5D7-D462B0BD13D5} => C:\Breaking Point\BreakingPoint.exe [2014-05-17] (Alderon Games)
Task: {73EC966E-3D69-4FD3-BCBD-55EAF1C596CB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {9065BED3-D8AF-4BA4-B261-A5EE0BB6AE6B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {A6BAC2CB-2BC1-4037-9804-DDF12F4FB462} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-06-08 22:31 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-06-18 17:24 - 2012-06-18 17:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2014-04-29 10:23 - 2014-04-29 10:23 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-06-16 02:20 - 2014-05-08 11:45 - 00018944 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
2014-06-08 22:16 - 2014-06-08 22:16 - 00472064 _____ () C:\Program Files (x86)\savie on\Zu.x64.dll
2014-06-16 02:20 - 2014-05-08 11:45 - 00061952 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\InstallerLibrary.dll
2014-06-16 02:20 - 2014-05-08 11:45 - 00016896 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\Installer.dll
2014-06-16 02:20 - 2014-07-25 15:02 - 00086528 _____ () C:\Program Files (x86)\MSR\Privoxy\mgwz.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/25/2014 03:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17207, Zeitstempel: 0x53a20d78
Name des fehlerhaften Moduls: Zu.x64.dll, Version: 1.1.0.0, Zeitstempel: 0x52b8d88b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000202f9
ID des fehlerhaften Prozesses: 0x9ec
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (07/25/2014 03:03:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 00:11:04 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 07:00:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 06:47:59 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 06:27:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 05:17:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 05:06:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 04:42:39 PM) (Source: MsiInstaller) (EventID: 10005) (User: user-PC)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox

Error: (07/24/2014 04:22:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/25/2014 03:05:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/24/2014 10:06:46 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PnkBstrA" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/24/2014 10:05:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (07/24/2014 10:05:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IePlugin Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/24/2014 10:04:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hi-Rez Studios Authenticate and Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/24/2014 10:03:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AMD External Events Utility" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/24/2014 07:01:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/24/2014 06:28:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/24/2014 06:11:56 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎24.‎07.‎2014 um 18:09:30 unerwartet heruntergefahren.

Error: (07/24/2014 06:07:06 PM) (Source: DCOM) (EventID: 10016) (User: user-PC)
Description: AnwendungsspezifischLokalAktivierung{8BC3F05E-D86B-11D0-A075-00C04FB68820}{8BC3F05E-D86B-11D0-A075-00C04FB68820}user-PCGastS-1-5-21-850184543-3320550329-2664725720-501LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================
Error: (07/25/2014 03:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.1720753a20d78Zu.x64.dll1.1.0.052b8d88bc000000500000000000202f99ec01cfa80f5a87bedeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files (x86)\savie on\Zu.x64.dll9967a95b-1402-11e4-b040-0022159198be

Error: (07/25/2014 03:03:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 00:11:04 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 07:00:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 06:47:59 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 06:27:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 05:17:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 05:06:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 04:42:39 PM) (Source: MsiInstaller) (EventID: 10005) (User: user-PC)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox	(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (07/24/2014 04:22:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 28%
Total physical RAM: 8191.05 MB
Available physical RAM: 5865.72 MB
Total Pagefile: 16380.29 MB
Available Pagefile: 13735.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:667.93 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: B99ACCF5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================
__________________
Alt 25.07.2014, 15:27   #4
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Hi, so geht's weiter...

Schritt 1

Bitte deinstalliere folgende Programme:

Search Protect


Versuche es bei Windows 7 zunächst über Systemsteuerung/Programme deinstallieren.

Sollte das nicht gehen, lade Dir bitte Revo Uninstallerhier herunter. Entpacke die zip-Datei auf den Desktop.
  • Starte die Revouninstaller.exe
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus.
    Klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

Wenn Du ein Programm nicht deinstallieren kannst, mach mit dem nächsten weiter.
Auch wenn am Ende noch Programme übrig geblieben sind, führe den nächsten Schritt aus:

Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3
Bitte lade Dir zoek.exe von hier: http://hijackthis.nl/smeenk/
  • Bitte deaktiviere während des Scans den Virenscanner, da dieser Zoek stören könnte.
  • Starte die zoek.exe mit einem Doppelklick (der Programmstart benötigt einige Sekunden).
  • Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und sollte nicht 1:1 auf andere Computer übernommen werden.
  • Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
    Code:
    ATTFilter
    resetIEproxy; 
FFdefaults;
CHRdefaults;
iedefaults;
emptyclsid;
autoclean;
  • Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
  • Wenn das Tool fertig ist, wird sich eine Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:
  • Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken)

Schritt 4



Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 25.07.2014, 16:15   #5
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Code:
ATTFilter
# AdwCleaner v3.216 - Bericht erstellt am 25/07/2014 um 16:32:03
# Aktualisiert 17/07/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : user - USER-PC
# Gestartet von : C:\Users\user\Downloads\adwcleaner_3.216.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : IePluginServices

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\374311380 
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork
Ordner Gelöscht : C:\ProgramData\DSearchLink
Ordner Gelöscht : C:\ProgramData\IePluginServices
Ordner Gelöscht : C:\ProgramData\Nico Mak Computing
Ordner Gelöscht : C:\ProgramData\Registry Helper
Ordner Gelöscht : C:\ProgramData\WindowsProtectManger
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\save on
Ordner Gelöscht : C:\ProgramData\savie on
Ordner Gelöscht : C:\ProgramData\Seearcch-NewTaB
Ordner Gelöscht : C:\ProgramData\YoutubeAdblocker
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Program Files (x86)\Greener Web
[!] Ordner Gelöscht : C:\Program Files (x86)\MSR
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Program Files (x86)\Speedial
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Program Files (x86)\ViewPassword-soft
Ordner Gelöscht : C:\Program Files (x86)\WinZip Malware Protector
Ordner Gelöscht : C:\Program Files (x86)\save on
Ordner Gelöscht : C:\Program Files (x86)\savie on
Ordner Gelöscht : C:\Program Files (x86)\Seearcch-NewTaB
Ordner Gelöscht : C:\Program Files (x86)\YoutubeAdblocker
Ordner Gelöscht : C:\users\user\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\users\user\AppData\Local\globalUpdate
Ordner Gelöscht : C:\users\user\AppData\Local\torch
Ordner Gelöscht : C:\users\user\AppData\Local\Temp\apn
Ordner Gelöscht : C:\users\user\AppData\Roaming\InetStat
Ordner Gelöscht : C:\users\user\AppData\Roaming\Nico Mak Computing
Ordner Gelöscht : C:\users\user\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\users\user\AppData\Roaming\SkypEmoticons
Ordner Gelöscht : C:\users\user\AppData\Roaming\Speedial
Ordner Gelöscht : C:\users\user\AppData\Roaming\SupTab
Ordner Gelöscht : C:\users\user\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Windows\SysWOW64\RegistryHelperLM.ocx
Datei Gelöscht : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_continuetosave.info_0.localstorage-journal
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_sb.scorecardresearch.com_0.localstorage
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_sb.scorecardresearch.com_0.localstorage-journal
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.buenosearch.com_0.localstorage
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.buenosearch.com_0.localstorage-journal
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage-journal

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Registry Helper]
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-860614263
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\RegisteredApplicationsEx
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Schlüssel Gelöscht : HKLM\Software\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\Software\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Schlüssel Gelöscht : HKLM\Software\Registry Helper
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWindowsProtectManger
Schlüssel Gelöscht : HKLM\Software\webssearchesSoftware
Schlüssel Gelöscht : HKLM\Software\Wpm
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~1.DLL
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~2.DLL

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v

-\\ Google Chrome v35.0.1916.114

[ Datei : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://www.buenosearch.com/?babsrc=SP_kms&tt=na&mntrId=0bd2db8320bfbfa9646c2ae6bb4fd4cd&affID=128493&tsp=5297&q={searchTerms}
Gelöscht [Search Provider] : hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_vit_14_23_ch&cd=2XzuyEtN2Y1L1QzutDtDtBtBtCyDzytCzyzz0B0E0DyC0F0AtN0D0Tzu0SzzzytDtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StCtBtCzytBtCzyzztGyEzytAtDtGyDyCtB0AtGtB0BzyzytGtCzztB0EzztB0DyCzzyCtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0F0DtA0AtCtDtCtGzz0CyC0DtGtC0DyEtBtG0E0BtB0AtGtAyDyC0D0EtBtB0Fzz0Azz0B2Q&cr=1938505641&ir=
Gelöscht [Search Provider] : hxxp://www.sweet-page.com/web/?type=dspp&ts=1402245343&from=vit&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
Gelöscht [Search Provider] : hxxp://websearch.eazytosearch.info/?l=1&q={searchTerms}&pid=724&r=2014/06/08&hid=12766663853909689536&lg=EN&cc=AT
Gelöscht [Search Provider] : hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=CCD90022159198BE&affID=128492&tsp=5272
Gelöscht [Search Provider] : hxxp://istart.webssearches.com/web/?type=dspp&ts=1404552197&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
Gelöscht [Search Provider] : hxxp://www.search.ask.com/web?tpid=ORJ-SPE&o=APN11412&l=dis&pf=V7&p2=%5EBBK%5EOSJ000%5EYY%5EAT&gct=&itbv=12.15.1.20&doi=2014-07-24&apn_uid=1E455068-CB0D-4341-A302-6FF7D0D23B0B&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=cr_35.0.1916.114&psv=&pt=tb&trgb=CR&q={searchTerms}
Gelöscht [Startup_urls] : hxxp://www.search.ask.com/?tpid=ORJ-SPE&o=APN11412&pf=V7&trgb=CR&p2=%5EBBK%5EOSJ000%5EYY%5EAT&gct=hp&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=cr_35.0.1916.114&apn_uid=1E455068-CB0D-4341-A302-6FF7D0D23B0B&itbv=12.15.1.20&doi=2014-07-24&psv=&pt=tb
Gelöscht [Startup_urls] : hxxp://istart.webssearches.com/?type=hppp&ts=1404718433&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
Gelöscht [Homepage] : hxxp://istart.webssearches.com/?type=hppp&ts=1404718433&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX

*************************

AdwCleaner[R0].txt - [14968 octets] - [25/07/2014 16:31:18]
AdwCleaner[S0].txt - [13379 octets] - [25/07/2014 16:32:03]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [13440 octets] ##########
Code:
ATTFilter
Zoek.exe v5.0.0.0 Updated 24-07-2014
Tool run by user on 25.07.2014 at 16:37:29,87.
Microsoft Windows 7 Professional  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\user\Downloads\zoek.exe [Scan all users] [Script inserted] 

==== System Restore Info ======================

25.07.2014 16:38:58 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default\prefs.js:

Added to C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default

user.js not found
---- FireFox user.js and prefs.js backups ---- 


==== Deleting Files \ Folders ======================

C:\Users\Gast.user-PC\AppData\LocalLow\{481C847C-431D-CF2C-9B50-B13C0BF98265} deleted
C:\Users\Mike\AppData\LocalLow\{481C847C-431D-CF2C-9B50-B13C0BF98265} deleted
C:\Users\user\AppData\LocalLow\{481C847C-431D-CF2C-9B50-B13C0BF98265} deleted
C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\{481C847C-431D-CF2C-9B50-B13C0BF98265} deleted
C:\PROGRA~2\GUT97FB.tmp deleted
C:\PROGRA~2\GUM97FA.tmp deleted
C:\PROGRA~2\COMMON~1\DVDVideoSoft\bin deleted
C:\PROGRA~2\Plus-HD-9.5 deleted
C:\Users\user\AppData\Roaming\BreakingPoint_Login.ini deleted
C:\Users\user\AppData\Roaming\BreakingPoint_Options.ini deleted
C:\PROGRA~3\Supersoftware App deleted
C:\PROGRA~3\InstallMate deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\user\Searches deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Windows\SysWow64\AI_RecycleBin deleted
"C:\Windows\Installer\2b244f4.msi" deleted
"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default\extensions\toolbar_ORJ-SPE@apn.ask.com.xpi" deleted
"C:\PROGRA~3\11c0f66442da2493\{4820778D-AB0D-6D18-C316-52A6A0E1D507}" deleted
"C:\PROGRA~3\11c0f66442da2493\{4820778D-AB0D-6D18-C316-52A6A0E1D507}.old" deleted
"C:\PROGRA~3\11c0f66442da2493\{993EA8F6-6E55-7E4E-39DE-5796E3226DB9}" deleted
"C:\PROGRA~3\11c0f66442da2493\{993EA8F6-6E55-7E4E-39DE-5796E3226DB9}.old" deleted
"C:\PROGRA~3\11c0f66442da2493\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}" deleted
"C:\PROGRA~3\11c0f66442da2493\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD}" deleted
"C:\PROGRA~3\11c0f66442da2493\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD}.old" deleted
"C:\PROGRA~2\MSR\Privoxy\mgwz.dll" deleted
"C:\PROGRA~2\MSR\Privoxy\privoxy.exe" deleted
"C:\PROGRA~2\MSR\Privoxy\privoxy.log" not deleted
"C:\PROGRA~3\11c0f66442da2493" deleted
"C:\PROGRA~2\MSR" not deleted
"C:\PROGRA~2\MSR\Privoxy" not deleted

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================


==== Chrome Look ======================

save on - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
Saving Flash - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Administrator\AppData\Local\Torch\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Administrator\AppData\Local\Torch\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Administrator\AppData\Local\Torch\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Administrator\AppData\Local\Torch\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Administrator\AppData\Local\Torch\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
Saving Flash - Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Gast\AppData\Local\Torch\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Gast\AppData\Local\Torch\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Gast\AppData\Local\Torch\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Gast\AppData\Local\Torch\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Gast\AppData\Local\Torch\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm

==== Chrome Fix ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.superfish.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.superfish.com_0.localstorage-journal deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.eazytosearch.info_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.eazytosearch.info_0.localstorage-journal deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_istart.webssearches.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_istart.webssearches.com_0.localstorage-journal deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_continuetosave.info_0.localstorage deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lfmcnadpaibmankmboobghcdnbeffiao_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lfmcnadpaibmankmboobghcdnbeffiao_0.localstorage-journal deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="hxxp://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"

==== Reset Google Chrome ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyServer"="http=127.0.0.1:8118;https=127.0.0.1:8118"
"ProxyOverride"="<-loopback>;<local>"
"ProxyEnable"=dword:00000001

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F60730A4A66673047777F5728467D401 deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\68a64305-ae05-41a9-8441-d7a16ea30084 deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F60730A4A66673047777F5728467D401 deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast.user-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast.user-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Mike\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Mike\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2HLGIGWJ will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A30Z03RN will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I6NSJI3T will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LMQR720F will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QXQ6TE8M will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WL4QV01K will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WU4U76BU will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y4T7Y7NM will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\rz12kcz3.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=611 folders=193 51107223 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Gast.user-PC\AppData\Local\Temp emptied successfully
C:\Users\Mike\AppData\Local\Temp emptied successfully
C:\Users\user\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\user\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\PROGRA~2\MSR\Privoxy\privoxy.log"  not deleted
"C:\PROGRA~2\MSR"  not deleted
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2HLGIGWJ" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A30Z03RN" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I6NSJI3T" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LMQR720F" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QXQ6TE8M" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WL4QV01K" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WU4U76BU" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y4T7Y7NM" not found

==== EOF on 25.07.2014 at 16:53:03,47 ======================
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014 01
Ran by user (administrator) on USER-PC on 25-07-2014 17:06:06
Running from C:\Users\user\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(The Privoxy team - www.privoxy.org) C:\Program Files (x86)\MSR\Privoxy\privoxy.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-29] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Akamai NetSession Interface] => C:\Users\user\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======
CHR Extension: (Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-20]
CHR Extension: (Google Mail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2014-05-18] () [File not signed]
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-30] (BitRaider, LLC)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21007192 2014-04-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-04-29] ()
R2 SystemUpdatekb70007; C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe [18944 2014-05-08] () [File not signed]
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18776 2014-04-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 BRDriver64; \??\C:\ProgramData\BitRaider\BRDriver64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 17:06 - 2014-07-25 17:06 - 00011475 _____ () C:\Users\user\Desktop\FRST.txt
2014-07-25 16:52 - 2014-07-25 16:52 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-07-25 16:51 - 2014-07-25 16:37 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-07-25 16:38 - 2014-07-25 16:53 - 00026624 _____ () C:\zoek-results.log
2014-07-25 16:37 - 2014-07-25 16:49 - 00000000 ____D () C:\zoek_backup
2014-07-25 16:37 - 2014-07-25 16:37 - 01287168 _____ () C:\Users\user\Downloads\zoek.exe
2014-07-25 16:31 - 2014-07-25 16:32 - 00000000 ____D () C:\AdwCleaner
2014-07-25 16:31 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-25 16:30 - 2014-07-25 16:30 - 01354223 _____ () C:\Users\user\Downloads\adwcleaner_3.216.exe
2014-07-25 16:18 - 2014-07-25 16:19 - 00053570 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:18 - 2014-07-25 16:19 - 00025490 _____ () C:\Users\user\Downloads\Addition.txt
2014-07-25 16:17 - 2014-07-25 17:06 - 00000000 ____D () C:\FRST
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:58 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-10 03:33 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-10 03:33 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-10 03:33 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 03:33 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 03:33 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 03:33 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 03:33 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 03:33 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 03:33 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 03:33 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 03:33 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 03:33 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 03:33 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 03:33 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 03:33 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 03:33 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 03:33 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 03:33 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 03:33 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 03:33 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 03:33 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 03:33 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 03:33 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 03:33 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 03:33 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 03:33 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 03:32 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 03:32 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 03:32 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 03:32 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 03:32 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 21:20 - 2014-07-24 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-06 14:58 - 2014-07-24 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-06 14:58 - 2009-09-16 07:02 - 00031232 _____ (Tunngle.net) C:\Windows\system32\Drivers\tap0901t.sys
2014-07-06 14:10 - 2014-07-06 14:14 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:09 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-06 12:22 - 2014-07-06 14:01 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-03 08:35 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:42 - 2014-07-24 23:30 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:32 - 2014-07-24 23:30 - 00000000 ____D () C:\AeriaGames
2014-06-30 04:32 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:17 - 2014-06-27 04:18 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 17:06 - 2014-07-25 17:06 - 00011475 _____ () C:\Users\user\Desktop\FRST.txt
2014-07-25 17:06 - 2014-07-25 16:17 - 00000000 ____D () C:\FRST
2014-07-25 17:04 - 2014-03-20 17:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\Skype
2014-07-25 17:03 - 2014-06-08 22:26 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-25 17:03 - 2014-03-20 16:44 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-25 17:03 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-25 17:03 - 2009-07-14 06:51 - 00050214 _____ () C:\Windows\setupact.log
2014-07-25 17:02 - 2014-03-20 16:31 - 01702186 _____ () C:\Windows\WindowsUpdate.log
2014-07-25 17:01 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-25 17:00 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-25 17:00 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-25 16:53 - 2014-07-25 16:38 - 00026624 _____ () C:\zoek-results.log
2014-07-25 16:52 - 2014-07-25 16:52 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-07-25 16:52 - 2010-11-21 05:47 - 00014174 _____ () C:\Windows\PFRO.log
2014-07-25 16:49 - 2014-07-25 16:37 - 00000000 ____D () C:\zoek_backup
2014-07-25 16:37 - 2014-07-25 16:51 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-07-25 16:37 - 2014-07-25 16:37 - 01287168 _____ () C:\Users\user\Downloads\zoek.exe
2014-07-25 16:34 - 2014-04-28 15:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-25 16:32 - 2014-07-25 16:31 - 00000000 ____D () C:\AdwCleaner
2014-07-25 16:32 - 2014-03-20 16:44 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-25 16:30 - 2014-07-25 16:30 - 01354223 _____ () C:\Users\user\Downloads\adwcleaner_3.216.exe
2014-07-25 16:19 - 2014-07-25 16:18 - 00053570 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:19 - 2014-07-25 16:18 - 00025490 _____ () C:\Users\user\Downloads\Addition.txt
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-07-24 23:30 - 2014-06-30 04:42 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-07-24 23:30 - 2014-06-30 04:32 - 00000000 ____D () C:\AeriaGames
2014-07-24 23:28 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-24 22:56 - 2014-04-28 15:17 - 00000000 ____D () C:\Users\user\AppData\Roaming\TS3Client
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 18:58 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:58 - 2014-07-06 14:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-24 18:58 - 2014-03-20 16:54 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1
2014-07-24 18:58 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-07-24 18:57 - 2014-07-06 14:09 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-24 18:57 - 2014-07-03 08:35 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-24 18:57 - 2014-06-09 16:42 - 00000000 ____D () C:\Users\user\Downloads\Minecraft
2014-07-24 18:57 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-24 18:56 - 2014-07-09 21:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-24 18:56 - 2014-06-30 04:32 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-07-24 18:56 - 2014-06-23 02:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-24 18:56 - 2014-06-21 22:35 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2014-07-24 18:56 - 2014-06-19 17:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:28 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\Program Files (x86)\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-27 22:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-07-24 18:56 - 2014-05-17 00:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
2014-07-24 18:56 - 2014-05-07 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-07-24 18:56 - 2014-04-30 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA
2014-07-24 18:56 - 2014-04-30 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2014-07-24 18:56 - 2014-04-28 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2014-07-24 18:56 - 2014-03-20 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-24 18:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-07-24 18:55 - 2014-06-08 22:32 - 00000000 ____D () C:\Users\user\AppData\Local\NVIDIA
2014-07-24 18:52 - 2014-06-23 02:25 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-24 18:52 - 2014-06-08 22:30 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 17:55 - 2014-06-08 18:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-24 17:09 - 2014-03-20 16:33 - 00000000 __SHD () C:\Recovery
2014-07-24 17:05 - 2014-03-20 17:20 - 00064408 _____ () C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 17:03 - 2014-06-08 22:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-22 22:02 - 2014-05-27 22:46 - 00000000 ____D () C:\Users\user\AppData\Local\PMB Files
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-12 13:20 - 2014-04-28 15:48 - 00185593 _____ () C:\Windows\DirectX.log
2014-07-11 09:31 - 2009-07-14 06:45 - 00294776 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 00:54 - 2014-05-07 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-11 00:54 - 2010-11-21 09:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 21:45 - 2014-06-05 21:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 21:43 - 2014-06-09 03:00 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 00:02 - 2014-06-09 17:06 - 00000000 ____D () C:\Users\user\AppData\Roaming\Tunngle
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-09 12:34 - 2014-04-28 15:20 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 12:34 - 2014-04-28 15:20 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 12:34 - 2014-04-28 15:20 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-06 14:14 - 2014-07-06 14:10 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:01 - 2014-07-06 12:22 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-05 18:01 - 2014-05-27 22:46 - 00000000 ____D () C:\ProgramData\PMB Files
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-02 16:18 - 2014-04-30 19:47 - 00000000 ____D () C:\ProgramData\BitRaider
2014-07-02 04:37 - 2014-05-11 03:32 - 00000145 _____ () C:\Users\user\Desktop\arma 3 royal.txt
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:09 - 2014-07-10 03:33 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-10 03:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:18 - 2014-06-27 04:17 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:35 - 2014-06-22 00:54 - 00000000 ____D () C:\Users\user\Documents\4a games
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-06-25 12:27 - 2010-11-21 08:50 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-06-25 12:27 - 2010-11-21 08:50 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-06-25 12:27 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-08 13:30

==================== End Of Log ============================
--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014 01
Ran by user at 2014-07-25 17:07:12
Running from C:\Users\user\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.9.9 - BitRaider, LLC)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)
Free YouTube to MP3 Converter version 3.12.34.430 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.34.430 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\{FBD50733-2ABE-3D23-88B4-7B0C0A0ADDA0}) (Version: 65.181.32922 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Infestation: Survivor Stories (HKLM-x32\...\Steam App 226700) (Version:  - Hammerpoint Interactive)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Killing Floor (HKLM-x32\...\Steam App 1250) (Version:  - Tripwire Interactive)
Killing Floor Mod: Defence Alliance 2 (HKLM-x32\...\Steam App 35420) (Version:  - Defence Alliance Team)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden
Skype™ 6.14 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.14.104 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2189.2 - Hi-Rez Studios)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version:  - Rebellion)
Star Wars - Battlefront II (HKLM-x32\...\Steam App 6060) (Version:  - Pandemic Studios)
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 7.0.0.40 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
System Update kb70007 (x32 Version: 1.0.0 - MSR) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

18-07-2014 13:18:52 Windows Update
22-07-2014 13:29:00 Windows Update
24-07-2014 13:26:34 Removed Aeria Ignite
24-07-2014 14:27:59 Installed Java 7 Update 65
24-07-2014 14:49:29 DirectX wurde installiert
24-07-2014 14:59:21 Wiederherstellungsvorgang
24-07-2014 15:26:45 Windows Update
24-07-2014 15:54:29 Installed Java 7 Update 65
24-07-2014 16:36:15 Windows Update
24-07-2014 16:38:04 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
24-07-2014 16:49:21 Wiederherstellungsvorgang
24-07-2014 17:08:58 Windows Update
24-07-2014 21:29:42 Removed Aeria Ignite
25-07-2014 14:38:43 zoek.exe restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3A49BE3B-C0E9-4070-B4AB-A78DF69C6026} - System32\Tasks\{77245E9B-B20B-4898-B5D7-D462B0BD13D5} => C:\Breaking Point\BreakingPoint.exe [2014-05-17] (Alderon Games)
Task: {73EC966E-3D69-4FD3-BCBD-55EAF1C596CB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {9065BED3-D8AF-4BA4-B261-A5EE0BB6AE6B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {A6BAC2CB-2BC1-4037-9804-DDF12F4FB462} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-06-08 22:31 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-04-29 10:23 - 2014-04-29 10:23 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-06-16 02:20 - 2014-05-08 11:45 - 00018944 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
2014-06-16 02:20 - 2014-05-08 11:45 - 00061952 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\InstallerLibrary.dll
2014-06-16 02:20 - 2014-05-08 11:45 - 00016896 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\Installer.dll
2014-07-25 16:52 - 2014-07-25 17:04 - 00086528 _____ () C:\Program Files (x86)\MSR\Privoxy\mgwz.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/25/2014 05:05:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 04:54:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 04:51:34 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/25/2014 04:35:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 03:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17207, Zeitstempel: 0x53a20d78
Name des fehlerhaften Moduls: Zu.x64.dll, Version: 1.1.0.0, Zeitstempel: 0x52b8d88b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000202f9
ID des fehlerhaften Prozesses: 0x9ec
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (07/25/2014 03:03:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 00:11:04 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 07:00:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 06:47:59 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 06:27:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/25/2014 05:06:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 04:54:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 04:51:30 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (07/25/2014 04:47:17 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:47:17 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:47:16 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:47:16 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:47:15 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:35:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 03:05:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (07/25/2014 05:05:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 04:54:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 04:51:34 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/25/2014 04:35:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 03:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.1720753a20d78Zu.x64.dll1.1.0.052b8d88bc000000500000000000202f99ec01cfa80f5a87bedeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files (x86)\savie on\Zu.x64.dll9967a95b-1402-11e4-b040-0022159198be

Error: (07/25/2014 03:03:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 00:11:04 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 07:00:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 06:47:59 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 06:27:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 22%
Total physical RAM: 8191.05 MB
Available physical RAM: 6318.74 MB
Total Pagefile: 16380.29 MB
Available Pagefile: 14317.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:670.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: B99ACCF5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================


Alt 25.07.2014, 16:27   #6
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Hi, das machst Du prima...

Darfst gleich nochmal...

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
--> Blauer trojaner er unterstreicht mir blaue wörter manche mit links

Alt 25.07.2014, 16:53   #7
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Code:
ATTFilter
ComboFix 14-07-25.01 - user 25.07.2014  17:37:53.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8191.6202 [GMT 2:00]
ausgeführt von:: c:\users\user\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\windows\MICROSOFT
c:\windows\MICROSOFT\SystemUpdatekb70007\Installer.dll
c:\windows\MICROSOFT\SystemUpdatekb70007\InstallerLibrary.dll
c:\windows\MICROSOFT\SystemUpdatekb70007\Newtonsoft.Json.dll
c:\windows\MICROSOFT\SystemUpdatekb70007\SQLite.Interop.dll
c:\windows\MICROSOFT\SystemUpdatekb70007\System.Data.SQLite.dll
c:\windows\MICROSOFT\SystemUpdatekb70007\win32.reg
c:\windows\MICROSOFT\SystemUpdatekb70007\WindowsUpdater.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SystemUpdatekb70007
-------\Service_SystemUpdatekb70007
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-06-25 bis 2014-07-25  ))))))))))))))))))))))))))))))
.
.
2014-07-25 14:52 . 2014-07-25 14:52	--------	d-----w-	c:\program files (x86)\MSR
2014-07-25 14:51 . 2014-07-25 14:37	24064	----a-w-	c:\windows\zoek-delete.exe
2014-07-25 14:51 . 2014-07-25 15:45	--------	d-----w-	c:\users\user\AppData\Local\Temp
2014-07-25 14:37 . 2014-07-25 14:49	--------	d-----w-	C:\zoek_backup
2014-07-25 14:31 . 2010-08-30 06:34	536576	----a-w-	c:\windows\SysWow64\sqlite3.dll
2014-07-25 14:31 . 2014-07-25 14:32	--------	d-----w-	C:\AdwCleaner
2014-07-25 14:17 . 2014-07-25 15:07	--------	d-----w-	C:\FRST
2014-07-24 17:09 . 2014-05-02 14:07	1031560	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A51A40EC-80DE-43C1-85CF-BFCF2AB3E668}\gapaengine.dll
2014-07-24 17:09 . 2014-07-02 03:09	10924376	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0C6BCE0D-CC37-447A-A4C8-838DC34650BF}\mpengine.dll
2014-07-24 16:58 . 2014-06-05 10:54	10779000	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-07-24 16:32 . 2014-07-24 16:58	--------	d-----w-	c:\users\Mike
2014-07-24 16:05 . 2014-07-24 17:23	--------	d-----w-	c:\users\Gast.user-PC
2014-07-24 14:26 . 2014-07-24 14:26	--------	d-----w-	c:\users\user\AppData\Local\Mozilla
2014-07-10 01:32 . 2014-06-19 00:14	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-07-10 01:32 . 2014-06-19 01:39	23464448	----a-w-	c:\windows\system32\mshtml.dll
2014-07-10 01:32 . 2014-06-05 14:45	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-07-10 01:32 . 2014-06-05 14:26	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-07-10 01:32 . 2014-06-05 14:25	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-07-09 19:20 . 2014-07-09 19:20	--------	d-----w-	c:\users\user\AppData\Roaming\TERA
2014-07-09 19:20 . 2014-07-09 19:20	--------	d-----w-	c:\program files (x86)\TERA
2014-07-06 12:58 . 2009-09-16 05:02	31232	----a-w-	c:\windows\system32\drivers\tap0901t.sys
2014-07-06 12:58 . 2014-07-24 16:56	--------	d-----w-	c:\program files (x86)\Tunngle
2014-07-06 10:29 . 2014-07-06 10:29	--------	d-----w-	c:\windows\system32\appmgmt
2014-07-01 17:37 . 2014-07-01 17:37	--------	d-----w-	c:\users\user\AppData\Local\mslug3
2014-06-30 02:44 . 2014-06-30 02:44	--------	d-----w-	c:\users\user\AppData\Local\Aeria Games
2014-06-30 02:43 . 2014-06-30 02:43	--------	d-----w-	c:\programdata\Aeria Games
2014-06-30 02:40 . 2014-06-30 02:40	--------	d-----w-	c:\users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 02:32 . 2014-07-24 16:56	--------	d-----w-	c:\users\user\AppData\Local\Akamai
2014-06-30 02:32 . 2014-07-24 21:30	--------	d-----w-	C:\AeriaGames
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-10 19:43 . 2014-06-09 01:00	96441528	----a-w-	c:\windows\system32\MRT.exe
2014-07-09 10:34 . 2014-04-28 13:20	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 10:34 . 2014-04-28 13:20	699056	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-06-23 00:25 . 2014-06-23 00:25	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-06-21 20:35 . 2014-06-21 20:35	466456	----a-w-	c:\windows\system32\wrap_oal.dll
2014-06-21 20:35 . 2014-06-21 20:35	444952	----a-w-	c:\windows\SysWow64\wrap_oal.dll
2014-06-21 20:35 . 2014-06-21 20:35	122904	----a-w-	c:\windows\system32\OpenAL32.dll
2014-06-21 20:35 . 2014-06-21 20:35	109080	----a-w-	c:\windows\SysWow64\OpenAL32.dll
2014-05-20 02:44 . 2014-06-08 20:29	9735256	----a-w-	c:\windows\SysWow64\nvcuda.dll
2014-05-20 02:44 . 2014-06-08 20:29	9697640	----a-w-	c:\windows\SysWow64\nvopencl.dll
2014-05-20 02:44 . 2014-06-08 20:29	895776	----a-w-	c:\windows\system32\NvIFR64.dll
2014-05-20 02:44 . 2014-06-08 20:29	892704	----a-w-	c:\windows\system32\NvFBC64.dll
2014-05-20 02:44 . 2014-06-08 20:29	867784	----a-w-	c:\windows\SysWow64\NvIFR.dll
2014-05-20 02:44 . 2014-06-08 20:29	861128	----a-w-	c:\windows\SysWow64\NvFBC.dll
2014-05-20 02:44 . 2014-06-08 20:29	3141976	----a-w-	c:\windows\system32\nvcuvid.dll
2014-05-20 02:44 . 2014-06-08 20:29	31387936	----a-w-	c:\windows\system32\nvoglv64.dll
2014-05-20 02:44 . 2014-06-08 20:29	3109248	----a-w-	c:\windows\system32\nvapi64.dll
2014-05-20 02:44 . 2014-06-08 20:29	2953672	----a-w-	c:\windows\SysWow64\nvcuvid.dll
2014-05-20 02:44 . 2014-06-08 20:29	2785568	----a-w-	c:\windows\system32\nvcuvenc.dll
2014-05-20 02:44 . 2014-06-08 20:29	2730208	----a-w-	c:\windows\SysWow64\nvapi.dll
2014-05-20 02:44 . 2014-06-08 20:29	25256224	----a-w-	c:\windows\system32\nvcompiler.dll
2014-05-20 02:44 . 2014-06-08 20:29	2412376	----a-w-	c:\windows\SysWow64\nvcuvenc.dll
2014-05-20 02:44 . 2014-06-08 20:29	24025376	----a-w-	c:\windows\SysWow64\nvoglv32.dll
2014-05-20 02:44 . 2014-06-08 20:29	1889112	----a-w-	c:\windows\system32\nvdispco6433788.dll
2014-05-20 02:44 . 2014-06-08 20:29	17561544	----a-w-	c:\windows\SysWow64\nvcompiler.dll
2014-05-20 02:44 . 2014-06-08 20:29	16003912	----a-w-	c:\windows\SysWow64\nvwgf2um.dll
2014-05-20 02:44 . 2014-06-08 20:29	1541576	----a-w-	c:\windows\system32\nvdispgenco6433788.dll
2014-05-20 02:44 . 2014-06-08 20:29	12688328	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2014-05-20 02:44 . 2014-06-08 20:29	11644928	----a-w-	c:\windows\system32\nvcuda.dll
2014-05-20 02:44 . 2014-06-08 20:29	11599072	----a-w-	c:\windows\system32\nvopencl.dll
2014-05-20 02:44 . 2009-07-13 21:59	18531568	----a-w-	c:\windows\system32\nvwgf2umx.dll
2014-05-20 02:44 . 2009-07-13 21:59	17480432	----a-w-	c:\windows\system32\nvd3dumx.dll
2014-05-20 02:44 . 2009-06-10 20:37	14434704	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2014-05-20 01:25 . 2014-06-08 20:31	6769096	----a-w-	c:\windows\system32\nvcpl.dll
2014-05-20 01:25 . 2014-06-08 20:31	3514144	----a-w-	c:\windows\system32\nvsvc64.dll
2014-05-20 01:25 . 2014-06-08 20:31	927520	----a-w-	c:\windows\system32\nvvsvc.exe
2014-05-20 01:25 . 2014-06-08 20:31	62808	----a-w-	c:\windows\system32\nvshext.dll
2014-05-20 01:25 . 2014-06-08 20:31	387528	----a-w-	c:\windows\system32\nvmctray.dll
2014-05-20 01:25 . 2014-06-08 20:31	2560968	----a-w-	c:\windows\system32\nvsvcr.dll
2014-05-19 23:10 . 2014-06-24 16:25	601432	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2014-05-14 23:49 . 2014-06-08 20:31	3774821	----a-w-	c:\windows\system32\nvcoproc.bin
2014-05-02 14:07 . 2014-04-17 15:29	1031560	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-04-30 18:27 . 2014-06-08 20:32	1081112	----a-w-	c:\windows\SysWow64\nvspcap.dll
2014-04-30 18:26 . 2014-06-08 20:32	1225920	----a-w-	c:\windows\system32\nvspcap64.dll
2014-04-30 01:03 . 2014-04-30 01:03	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2014-04-30 01:03 . 2014-04-30 01:03	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2014-04-30 01:03 . 2014-04-30 01:03	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2014-04-30 01:03 . 2014-04-30 01:03	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2014-04-30 01:03 . 2014-04-30 01:03	337408	----a-w-	c:\windows\SysWow64\html.iec
2014-04-30 01:03 . 2014-04-30 01:03	235008	----a-w-	c:\windows\system32\elshyph.dll
2014-04-30 01:03 . 2014-04-30 01:03	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2014-04-30 01:03 . 2014-04-30 01:03	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2014-04-30 01:03 . 2014-04-30 01:03	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2014-04-30 01:03 . 2014-04-30 01:03	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2014-04-30 01:03 . 2014-04-30 01:03	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2014-04-30 01:03 . 2014-04-30 01:03	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2014-04-30 01:03 . 2014-04-30 01:03	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2014-04-30 01:03 . 2014-04-30 01:03	942592	----a-w-	c:\windows\system32\jsIntl.dll
2014-04-30 01:03 . 2014-04-30 01:03	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2014-04-30 01:03 . 2014-04-30 01:03	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2014-04-30 01:03 . 2014-04-30 01:03	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2014-04-30 01:03 . 2014-04-30 01:03	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2014-04-30 01:03 . 2014-04-30 01:03	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2014-04-30 01:03 . 2014-04-30 01:03	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2014-04-30 01:03 . 2014-04-30 01:03	48640	----a-w-	c:\windows\system32\mshtmler.dll
2014-04-30 01:03 . 2014-04-30 01:03	247808	----a-w-	c:\windows\system32\msls31.dll
2014-04-30 01:03 . 2014-04-30 01:03	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2014-04-30 01:03 . 2014-04-30 01:03	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2014-04-30 01:03 . 2014-04-30 01:03	105984	----a-w-	c:\windows\system32\iesysprep.dll
2014-04-30 01:03 . 2014-04-30 01:03	81408	----a-w-	c:\windows\system32\icardie.dll
2014-04-30 01:03 . 2014-04-30 01:03	77312	----a-w-	c:\windows\system32\tdc.ocx
2014-04-30 01:03 . 2014-04-30 01:03	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2014-04-30 01:03 . 2014-04-30 01:03	413696	----a-w-	c:\windows\system32\html.iec
2014-04-30 01:03 . 2014-04-30 01:03	30208	----a-w-	c:\windows\system32\licmgr10.dll
2014-04-30 01:03 . 2014-04-30 01:03	243200	----a-w-	c:\windows\system32\webcheck.dll
2014-04-30 01:03 . 2014-04-30 01:03	235520	----a-w-	c:\windows\system32\url.dll
2014-04-30 01:03 . 2014-04-30 01:03	167424	----a-w-	c:\windows\system32\iexpress.exe
2014-04-30 01:03 . 2014-04-30 01:03	143872	----a-w-	c:\windows\system32\wextract.exe
2014-04-30 01:03 . 2014-04-30 01:03	101376	----a-w-	c:\windows\system32\inseng.dll
2014-04-30 01:03 . 2014-04-30 01:03	147968	----a-w-	c:\windows\system32\occache.dll
2014-04-30 01:03 . 2014-04-30 01:03	774144	----a-w-	c:\windows\system32\jscript.dll
2014-04-30 01:03 . 2014-04-30 01:03	62464	----a-w-	c:\windows\system32\pngfilt.dll
2014-04-30 01:03 . 2014-04-30 01:03	48128	----a-w-	c:\windows\system32\imgutil.dll
2014-04-30 01:03 . 2014-04-30 01:03	13824	----a-w-	c:\windows\system32\mshta.exe
2014-04-30 01:03 . 2014-04-30 01:03	135680	----a-w-	c:\windows\system32\iepeers.dll
2014-04-29 08:24 . 2014-04-29 08:24	291128	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2014-04-29 08:24 . 2014-04-29 08:23	291128	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2014-04-29 08:23 . 2014-04-29 08:23	281872	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2014-04-29 08:23 . 2014-04-29 08:23	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
2014-04-28 11:19 . 2014-04-28 11:19	9728	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	9728	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	4096	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	4096	---ha-w-	c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	364544	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2014-04-28 11:19 . 2014-04-28 11:19	3584	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-04-28 11:19 . 2014-04-28 11:19	3584	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20917408]
"Akamai NetSession Interface"="c:\users\user\AppData\Local\Akamai\netsession_win.exe" [2014-04-17 4672920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-12-06 766208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-05-07 256896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 BRDriver64;BRDriver64;c:\programdata\BitRaider\BRDriver64.sys;c:\programdata\BitRaider\BRDriver64.sys [x]
R3 BRSptSvc;BitRaider Mini-Support Service;c:\programdata\BitRaider\BRSptSvc.exe;c:\programdata\BitRaider\BRSptSvc.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-27 04:33	1091912	----a-w-	c:\program files (x86)\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-07-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28 10:34]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-29 7982112]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-04-30 2199840]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-04-30 1225920]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=127.0.0.1:8118;https=127.0.0.1:8118
uInternet Settings,ProxyOverride = <-loopback>;<local>
Trusted Zone: aeriagames.com
TCP: DhcpNameServer = 195.34.133.21 212.186.211.21
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-{95716cce-fc71-413f-8ad5-56c2892d4b3a} - c:\programdata\Package Cache\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\vcredist_x86.exe
AddRemove-{a1909659-0a08-4554-8af1-2175904903a1} - c:\programdata\Package Cache\{a1909659-0a08-4554-8af1-2175904903a1}\vcredist_x64.exe
AddRemove-{ce085a78-074e-4823-8dc1-8a721b94b76d} - c:\programdata\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-07-25  17:49:30 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-07-25 15:49
.
Vor Suchlauf: 15 Verzeichnis(se), 719.047.786.496 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 718.503.092.224 Bytes frei
.
- - End Of File - - D04C76E4C8C3CD224122A6DBEF7AC66F
A36C5E4F47E84449FF07ED3517B43A31

Alt 25.07.2014, 16:57   #8
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Prima...

Letzte Kontrolle:


Schritt 1

Malwarebytes Antimalware
  • Download-Link
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
  • Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
  • Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.


Schritt 2

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 3



Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 25.07.2014, 18:21   #9
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 25.07.2014
Suchlauf-Zeit: 18:03:09
Logdatei: 
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.07.25.05
Rootkit Datenbank: v2014.07.17.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: user

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 400043
Verstrichene Zeit: 11 Min, 1 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 3
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}, In Quarantäne, [5849930df18a3cfa60ab3c5c22e06997], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, In Quarantäne, [5849930df18a3cfa60ab3c5c22e06997], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, In Quarantäne, [5849930df18a3cfa60ab3c5c22e06997], 

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 1
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[a7fa6838e5965adc1666a60dfb0917e9]

Ordner: 9
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_olnkgiapbjhdboldbhkagdodklkphaip_0, In Quarantäne, [6041732ddd9ed95da858694617eb32ce], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\olnkgiapbjhdboldbhkagdodklkphaip, In Quarantäne, [01a09e0284f72a0c1af2edc2758dde22], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\images, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 

Dateien: 75
PUP.Optional.OneFloorApp, C:\Users\user\Downloads\PDF_Creator.exe, In Quarantäne, [7a27584823585bdb18f9a5fe897b06fa], 
PUP.Optional.Amonetize, C:\Windows\Installer\2ed38ed.msi, In Quarantäne, [138e1888c2b91620d2521482ae538b75], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_olnkgiapbjhdboldbhkagdodklkphaip_0.localstorage, In Quarantäne, [0d94ffa191eab086c2535c89b15106fa], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_olnkgiapbjhdboldbhkagdodklkphaip_0.localstorage-journal, In Quarantäne, [a2ff0c9443380234b4616f7660a2e61a], 
PUP.Optional.QuickStart.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pelmeidfhdlhlbjimpabfcbnnojbboma_0.localstorage, In Quarantäne, [8021633d6c0f49edb4dabe699d6750b0], 
PUP.Optional.QuickStart.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pelmeidfhdlhlbjimpabfcbnnojbboma_0.localstorage-journal, In Quarantäne, [653cfaa6067565d1e0ae23046b99d32d], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_olnkgiapbjhdboldbhkagdodklkphaip_0\2, In Quarantäne, [6041732ddd9ed95da858694617eb32ce], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\olnkgiapbjhdboldbhkagdodklkphaip\000005.ldb, In Quarantäne, [01a09e0284f72a0c1af2edc2758dde22], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\olnkgiapbjhdboldbhkagdodklkphaip\000026.log, In Quarantäne, [01a09e0284f72a0c1af2edc2758dde22], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\olnkgiapbjhdboldbhkagdodklkphaip\CURRENT, In Quarantäne, [01a09e0284f72a0c1af2edc2758dde22], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\olnkgiapbjhdboldbhkagdodklkphaip\LOCK, In Quarantäne, [01a09e0284f72a0c1af2edc2758dde22], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\olnkgiapbjhdboldbhkagdodklkphaip\LOG, In Quarantäne, [01a09e0284f72a0c1af2edc2758dde22], 
PUP.Optional.CrossRider.A, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\olnkgiapbjhdboldbhkagdodklkphaip\MANIFEST-000024, In Quarantäne, [01a09e0284f72a0c1af2edc2758dde22], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\AUTHORS.txt, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\config.txt, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\default.action, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\default.filter, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\LICENSE.txt, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\match-all.action, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\mgwz.dll, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\privoxy.exe, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\privoxy.log, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\privoxy_uninstall.exe, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\README.txt, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\trust.txt, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\user.action, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\user.action_empty, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\user.filter, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\user.filter_old, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\p_doc.css, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual\coding.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual\cvs.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual\documentation.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual\index.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual\introduction.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual\newrelease.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual\testing.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\developer-manual\webserver-update.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq\configuration.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq\contact.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq\copyright.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq\general.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq\index.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq\installation.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq\misc.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\faq\trouble.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\images\files-in-use.jpg, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\images\proxy_setup.jpg, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\actions-file.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\appendix.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\config.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\configuration.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\contact.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\copyright.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\files-in-use.jpg, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\filter-file.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\index.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\installation.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\introduction.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\proxy2.jpg, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\proxy_setup.jpg, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\p_doc.css, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\quickstart.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\seealso.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\startup.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\templates.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\doc\user-manual\whatsnew.html, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates\cgi-style.css, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates\connect-failed, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates\mod-local-help, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates\mod-support-and-service, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates\mod-title, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates\mod-unstable-warning, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates\no-such-domain, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 
PUP.Optional.Privoxy.A, C:\Program Files (x86)\MSR\Privoxy\templates\url-info-osd.xml, In Quarantäne, [29787828f883e94dfa3d3981aa5850b0], 

Physische Sektoren: 0
(No malicious items detected)


(end)
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=1216db46e8ee6b43b1620e8a8282cd91
# engine=19349
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-25 04:23:22
# local_time=2014-07-25 06:23:22 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 8556308 29285796 0 0
# scanned=3276
# found=21
# cleaned=0
# scan_time=115
sh=E12820C3C449E8DF12132666647822B9FE266BA3 ft=1 fh=661cdf041cef5cb3 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\Installer.dll.vir"
sh=E99D65BD24FAF328D7314F02B98EE8C3BD793B77 ft=1 fh=8661b13c20727ec0 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\InstallerLibrary.dll.vir"
sh=B11B91F706EA1AFD3D4D625201192EAB850FD3CE ft=1 fh=04b2478a5da86198 vn="MSIL/Adware.Proxomoto.B Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\InstallFirefoxExtension.dll.vir"
sh=5BD97BEAE0E1E79B233B821DA6813A831B5075FB ft=1 fh=5310de0062903084 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\NewVersionUploader.exe.vir"
sh=49DEEED4E6B0E6134D47A582E209511FCBFD2B72 ft=1 fh=14e2fb72d7f3d82c vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\WindowsUpdater.exe.vir"
sh=E99D65BD24FAF328D7314F02B98EE8C3BD793B77 ft=1 fh=8661b13c20727ec0 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\backup\InstallerLibrary.dll.vir"
sh=0DAFA42039405F8D49A6790180194076BD57C833 ft=1 fh=c71c001147036410 vn="Variante von Win32/AdWare.MultiPlug.N Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\savie on\Zu.dll.vir"
sh=61CB4B5228E6253863391EF3346C2F9920DBC554 ft=1 fh=c71c00112b13579c vn="Variante von Win64/Adware.MultiPlug.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\savie on\Zu.x64.dll.vir"
sh=C7C0F42A23562AA6DCCD60326FD8CC2AA41B5448 ft=1 fh=c053642cee9f3def vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=125B1C393F2104CBA08183E495C0907BFF7EDA22 ft=1 fh=ea25908c8365106f vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"
sh=8E85792765D0E0BF52107CFF4A6620995DB19BB0 ft=1 fh=627da500ea2e265f vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir"
sh=2FCA2173F2DD16DF8F1F990170FA4479FC5D5BFC ft=1 fh=c528dd1cda99a111 vn="Variante von Win32/ELEX.AR evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\RSHP.exe.vir"
sh=6043D1ACD51FD373472020FBB748C405AAF22397 ft=1 fh=4c716dbbae6c21b9 vn="Win32/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir"
sh=FF431CD8693F4045BD7BD87DBCE54B820F000FC0 ft=1 fh=16c2e1bd3fd6b7e2 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir"
sh=5836A5DF3860241F6B69F2292ABCE592A13689B6 ft=1 fh=a3db04555f559ea8 vn="Variante von Win32/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv32.dll.vir"
sh=E97CBDBD7CFED2C58464C1ABF186520022DE5666 ft=1 fh=7a2ea5ecc33ad0e3 vn="Variante von Win64/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv64.dll.vir"
sh=9DC13DB9C123270C2356ED410128E11D5ADF7C6E ft=1 fh=023ab782f0a9b07d vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"
sh=246DDBC3A2C223A6B9072637D93DC2A2832D097A ft=1 fh=c71c0011b04f613a vn="Win32/Toolbar.Babylon.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\DSearchLink\DSearchLink.exe.vir"
sh=56659F7FF1F1FA7906A77228E315F65F38BCEF73 ft=1 fh=0ff759dfc352fd03 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir"
sh=A506AEDE7D055BAA580C7657DBAFD498EF0B2E58 ft=1 fh=c71c00117d7abedf vn="Variante von Win32/AdWare.MultiPlug.Y Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\savie on\klD.exe.vir"
sh=C4420C6E94B8CAACCB3811384280D8A93CB0A37D ft=1 fh=25f111c507a31a21 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\OpenCandy\16EDD084AECD424B91F869D491C9AF0F\sp-downloader.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=1216db46e8ee6b43b1620e8a8282cd91
# engine=19349
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-25 05:12:51
# local_time=2014-07-25 07:12:51 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 8559277 29288765 0 0
# scanned=193706
# found=26
# cleaned=0
# scan_time=2854
sh=E12820C3C449E8DF12132666647822B9FE266BA3 ft=1 fh=661cdf041cef5cb3 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\Installer.dll.vir"
sh=E99D65BD24FAF328D7314F02B98EE8C3BD793B77 ft=1 fh=8661b13c20727ec0 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\InstallerLibrary.dll.vir"
sh=B11B91F706EA1AFD3D4D625201192EAB850FD3CE ft=1 fh=04b2478a5da86198 vn="MSIL/Adware.Proxomoto.B Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\InstallFirefoxExtension.dll.vir"
sh=5BD97BEAE0E1E79B233B821DA6813A831B5075FB ft=1 fh=5310de0062903084 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\NewVersionUploader.exe.vir"
sh=49DEEED4E6B0E6134D47A582E209511FCBFD2B72 ft=1 fh=14e2fb72d7f3d82c vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\WindowsUpdater.exe.vir"
sh=E99D65BD24FAF328D7314F02B98EE8C3BD793B77 ft=1 fh=8661b13c20727ec0 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MSR\backup\System Update kb70007\backup\InstallerLibrary.dll.vir"
sh=0DAFA42039405F8D49A6790180194076BD57C833 ft=1 fh=c71c001147036410 vn="Variante von Win32/AdWare.MultiPlug.N Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\savie on\Zu.dll.vir"
sh=61CB4B5228E6253863391EF3346C2F9920DBC554 ft=1 fh=c71c00112b13579c vn="Variante von Win64/Adware.MultiPlug.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\savie on\Zu.x64.dll.vir"
sh=C7C0F42A23562AA6DCCD60326FD8CC2AA41B5448 ft=1 fh=c053642cee9f3def vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=125B1C393F2104CBA08183E495C0907BFF7EDA22 ft=1 fh=ea25908c8365106f vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"
sh=8E85792765D0E0BF52107CFF4A6620995DB19BB0 ft=1 fh=627da500ea2e265f vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir"
sh=2FCA2173F2DD16DF8F1F990170FA4479FC5D5BFC ft=1 fh=c528dd1cda99a111 vn="Variante von Win32/ELEX.AR evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\RSHP.exe.vir"
sh=6043D1ACD51FD373472020FBB748C405AAF22397 ft=1 fh=4c716dbbae6c21b9 vn="Win32/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir"
sh=FF431CD8693F4045BD7BD87DBCE54B820F000FC0 ft=1 fh=16c2e1bd3fd6b7e2 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir"
sh=5836A5DF3860241F6B69F2292ABCE592A13689B6 ft=1 fh=a3db04555f559ea8 vn="Variante von Win32/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv32.dll.vir"
sh=E97CBDBD7CFED2C58464C1ABF186520022DE5666 ft=1 fh=7a2ea5ecc33ad0e3 vn="Variante von Win64/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv64.dll.vir"
sh=9DC13DB9C123270C2356ED410128E11D5ADF7C6E ft=1 fh=023ab782f0a9b07d vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"
sh=246DDBC3A2C223A6B9072637D93DC2A2832D097A ft=1 fh=c71c0011b04f613a vn="Win32/Toolbar.Babylon.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\DSearchLink\DSearchLink.exe.vir"
sh=56659F7FF1F1FA7906A77228E315F65F38BCEF73 ft=1 fh=0ff759dfc352fd03 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir"
sh=A506AEDE7D055BAA580C7657DBAFD498EF0B2E58 ft=1 fh=c71c00117d7abedf vn="Variante von Win32/AdWare.MultiPlug.Y Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\savie on\klD.exe.vir"
sh=C4420C6E94B8CAACCB3811384280D8A93CB0A37D ft=1 fh=25f111c507a31a21 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\OpenCandy\16EDD084AECD424B91F869D491C9AF0F\sp-downloader.exe.vir"
sh=E12820C3C449E8DF12132666647822B9FE266BA3 ft=1 fh=661cdf041cef5cb3 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Windows\Microsoft\SystemUpdatekb70007\Installer.dll.vir"
sh=E99D65BD24FAF328D7314F02B98EE8C3BD793B77 ft=1 fh=8661b13c20727ec0 vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Windows\Microsoft\SystemUpdatekb70007\InstallerLibrary.dll.vir"
sh=49DEEED4E6B0E6134D47A582E209511FCBFD2B72 ft=1 fh=14e2fb72d7f3d82c vn="MSIL/Adware.Proxomoto.A Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe.vir"
sh=21A7728CEAC323C137D992A941E5C056FC83EA2F ft=1 fh=2ec8eb5ba41e7380 vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000"
sh=168A3F2B9AB8C712B98AC0288AB012784D6224D4 ft=1 fh=c71c001198f425ea vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_PROGRA~3_InstallMate\{EA58153E-1EB9-4805-AAEE-569B31BB37C8}\Custom.dll"
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014 01
Ran by user (administrator) on USER-PC on 25-07-2014 19:19:21
Running from C:\Users\user\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-29] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Akamai NetSession Interface] => C:\Users\user\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-20]
CHR Extension: (Google Mail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2014-05-18] () [File not signed]
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-30] (BitRaider, LLC)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21007192 2014-04-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-04-29] ()
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 MWAC; \??\C:\Windows\system32\drivers\ [0 ] () [File not signed]
S3 MWAC; \??\C:\Windows\SysWOW64\drivers\ [0 ] () [File not signed]
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18776 2014-04-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 BRDriver64; \??\C:\ProgramData\BitRaider\BRDriver64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 18:20 - 2014-07-25 18:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-25 18:19 - 2014-07-25 18:19 - 02347384 _____ (ESET) C:\Users\user\Downloads\esetsmartinstaller_deu.exe
2014-07-25 18:01 - 2014-07-25 18:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-25 18:00 - 2014-07-25 18:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\user\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-25 18:00 - 2014-07-25 18:00 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-25 18:00 - 2014-07-25 18:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-25 18:00 - 2014-07-25 18:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-25 18:00 - 2014-07-25 18:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-25 18:00 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-25 18:00 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-25 18:00 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-25 17:49 - 2014-07-25 17:49 - 00024743 _____ () C:\ComboFix.txt
2014-07-25 17:36 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-07-25 17:36 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-07-25 17:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-07-25 17:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-07-25 17:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-07-25 17:36 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-07-25 17:36 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-07-25 17:36 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-07-25 17:30 - 2014-07-25 17:49 - 00000000 ____D () C:\Qoobox
2014-07-25 17:30 - 2014-07-25 17:48 - 00000000 ____D () C:\Windows\erdnt
2014-07-25 17:29 - 2014-07-25 17:29 - 05563277 ____R (Swearware) C:\Users\user\Downloads\ComboFix.exe
2014-07-25 17:07 - 2014-07-25 17:07 - 00025457 _____ () C:\Users\user\Desktop\Addition.txt
2014-07-25 17:06 - 2014-07-25 19:19 - 00012137 _____ () C:\Users\user\Desktop\FRST.txt
2014-07-25 16:52 - 2014-07-25 18:14 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-07-25 16:51 - 2014-07-25 16:37 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-07-25 16:38 - 2014-07-25 16:53 - 00026624 _____ () C:\zoek-results.log
2014-07-25 16:37 - 2014-07-25 16:49 - 00000000 ____D () C:\zoek_backup
2014-07-25 16:37 - 2014-07-25 16:37 - 01287168 _____ () C:\Users\user\Downloads\zoek.exe
2014-07-25 16:31 - 2014-07-25 16:32 - 00000000 ____D () C:\AdwCleaner
2014-07-25 16:31 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-25 16:30 - 2014-07-25 16:30 - 01354223 _____ () C:\Users\user\Downloads\adwcleaner_3.216.exe
2014-07-25 16:18 - 2014-07-25 16:19 - 00053570 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:18 - 2014-07-25 16:19 - 00025490 _____ () C:\Users\user\Downloads\Addition.txt
2014-07-25 16:17 - 2014-07-25 19:19 - 00000000 ____D () C:\FRST
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:58 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-10 03:33 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-10 03:33 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-10 03:33 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 03:33 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 03:33 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 03:33 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 03:33 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 03:33 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 03:33 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 03:33 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 03:33 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 03:33 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 03:33 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 03:33 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 03:33 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 03:33 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 03:33 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 03:33 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 03:33 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 03:33 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 03:33 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 03:33 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 03:33 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 03:33 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 03:33 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 03:33 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 03:32 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 03:32 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 03:32 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 03:32 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 03:32 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 21:20 - 2014-07-24 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-06 14:58 - 2014-07-24 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-06 14:58 - 2009-09-16 07:02 - 00031232 _____ (Tunngle.net) C:\Windows\system32\Drivers\tap0901t.sys
2014-07-06 14:10 - 2014-07-06 14:14 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:09 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-06 12:22 - 2014-07-06 14:01 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-03 08:35 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:42 - 2014-07-24 23:30 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:32 - 2014-07-24 23:30 - 00000000 ____D () C:\AeriaGames
2014-06-30 04:32 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:17 - 2014-06-27 04:18 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 19:19 - 2014-07-25 17:06 - 00012137 _____ () C:\Users\user\Desktop\FRST.txt
2014-07-25 19:19 - 2014-07-25 16:17 - 00000000 ____D () C:\FRST
2014-07-25 19:17 - 2014-03-20 17:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\Skype
2014-07-25 18:59 - 2014-03-20 16:31 - 01716795 _____ () C:\Windows\WindowsUpdate.log
2014-07-25 18:34 - 2014-04-28 15:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-25 18:24 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-25 18:24 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-25 18:20 - 2014-07-25 18:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-25 18:19 - 2014-07-25 18:19 - 02347384 _____ (ESET) C:\Users\user\Downloads\esetsmartinstaller_deu.exe
2014-07-25 18:17 - 2014-07-25 18:01 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-25 18:16 - 2014-06-08 22:26 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-25 18:16 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-25 18:16 - 2009-07-14 06:51 - 00050550 _____ () C:\Windows\setupact.log
2014-07-25 18:15 - 2010-11-21 05:47 - 00038194 _____ () C:\Windows\PFRO.log
2014-07-25 18:14 - 2014-07-25 16:52 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-07-25 18:00 - 2014-07-25 18:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\user\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-25 18:00 - 2014-07-25 18:00 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-25 18:00 - 2014-07-25 18:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-25 18:00 - 2014-07-25 18:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-25 18:00 - 2014-07-25 18:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-25 17:49 - 2014-07-25 17:49 - 00024743 _____ () C:\ComboFix.txt
2014-07-25 17:49 - 2014-07-25 17:30 - 00000000 ____D () C:\Qoobox
2014-07-25 17:49 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-07-25 17:48 - 2014-07-25 17:30 - 00000000 ____D () C:\Windows\erdnt
2014-07-25 17:45 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-25 17:43 - 2009-07-14 04:34 - 56098816 _____ () C:\Windows\system32\config\software.bak
2014-07-25 17:43 - 2009-07-14 04:34 - 20185088 _____ () C:\Windows\system32\config\system.bak
2014-07-25 17:43 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-07-25 17:43 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-07-25 17:43 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\default.bak
2014-07-25 17:29 - 2014-07-25 17:29 - 05563277 ____R (Swearware) C:\Users\user\Downloads\ComboFix.exe
2014-07-25 17:07 - 2014-07-25 17:07 - 00025457 _____ () C:\Users\user\Desktop\Addition.txt
2014-07-25 17:01 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-25 16:53 - 2014-07-25 16:38 - 00026624 _____ () C:\zoek-results.log
2014-07-25 16:49 - 2014-07-25 16:37 - 00000000 ____D () C:\zoek_backup
2014-07-25 16:37 - 2014-07-25 16:51 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-07-25 16:37 - 2014-07-25 16:37 - 01287168 _____ () C:\Users\user\Downloads\zoek.exe
2014-07-25 16:32 - 2014-07-25 16:31 - 00000000 ____D () C:\AdwCleaner
2014-07-25 16:30 - 2014-07-25 16:30 - 01354223 _____ () C:\Users\user\Downloads\adwcleaner_3.216.exe
2014-07-25 16:19 - 2014-07-25 16:18 - 00053570 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:19 - 2014-07-25 16:18 - 00025490 _____ () C:\Users\user\Downloads\Addition.txt
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-07-24 23:30 - 2014-06-30 04:42 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-07-24 23:30 - 2014-06-30 04:32 - 00000000 ____D () C:\AeriaGames
2014-07-24 23:28 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-24 22:56 - 2014-04-28 15:17 - 00000000 ____D () C:\Users\user\AppData\Roaming\TS3Client
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 18:58 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:58 - 2014-07-06 14:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-24 18:58 - 2014-03-20 16:54 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1
2014-07-24 18:58 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-07-24 18:57 - 2014-07-06 14:09 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-24 18:57 - 2014-07-03 08:35 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-24 18:57 - 2014-06-09 16:42 - 00000000 ____D () C:\Users\user\Downloads\Minecraft
2014-07-24 18:57 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-24 18:56 - 2014-07-09 21:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-24 18:56 - 2014-06-30 04:32 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-07-24 18:56 - 2014-06-23 02:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-24 18:56 - 2014-06-21 22:35 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2014-07-24 18:56 - 2014-06-19 17:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:28 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\Program Files (x86)\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-27 22:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-07-24 18:56 - 2014-05-17 00:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
2014-07-24 18:56 - 2014-05-07 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-07-24 18:56 - 2014-04-30 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA
2014-07-24 18:56 - 2014-04-30 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2014-07-24 18:56 - 2014-04-28 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2014-07-24 18:56 - 2014-03-20 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-24 18:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-07-24 18:55 - 2014-06-08 22:32 - 00000000 ____D () C:\Users\user\AppData\Local\NVIDIA
2014-07-24 18:52 - 2014-06-23 02:25 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-24 18:52 - 2014-06-08 22:30 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 17:55 - 2014-06-08 18:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-24 17:09 - 2014-03-20 16:33 - 00000000 ____D () C:\Recovery
2014-07-24 17:05 - 2014-03-20 17:20 - 00064408 _____ () C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 17:03 - 2014-06-08 22:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-22 22:02 - 2014-05-27 22:46 - 00000000 ____D () C:\Users\user\AppData\Local\PMB Files
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-12 13:20 - 2014-04-28 15:48 - 00185593 _____ () C:\Windows\DirectX.log
2014-07-11 09:31 - 2009-07-14 06:45 - 00294776 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 00:54 - 2014-05-07 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-11 00:54 - 2010-11-21 09:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 21:45 - 2014-06-05 21:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 21:43 - 2014-06-09 03:00 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 00:02 - 2014-06-09 17:06 - 00000000 ____D () C:\Users\user\AppData\Roaming\Tunngle
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-09 12:34 - 2014-04-28 15:20 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 12:34 - 2014-04-28 15:20 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 12:34 - 2014-04-28 15:20 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-06 14:14 - 2014-07-06 14:10 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:01 - 2014-07-06 12:22 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-05 18:01 - 2014-05-27 22:46 - 00000000 ____D () C:\ProgramData\PMB Files
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-02 16:18 - 2014-04-30 19:47 - 00000000 ____D () C:\ProgramData\BitRaider
2014-07-02 04:37 - 2014-05-11 03:32 - 00000145 _____ () C:\Users\user\Desktop\arma 3 royal.txt
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:09 - 2014-07-10 03:33 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-10 03:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:18 - 2014-06-27 04:17 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:35 - 2014-06-22 00:54 - 00000000 ____D () C:\Users\user\Documents\4a games
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-06-25 12:27 - 2010-11-21 08:50 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-06-25 12:27 - 2010-11-21 08:50 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-06-25 12:27 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-08 13:30

==================== End Of Log ============================
--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014 01
Ran by user at 2014-07-25 19:19:54
Running from C:\Users\user\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.9.9 - BitRaider, LLC)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Free YouTube to MP3 Converter version 3.12.34.430 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.34.430 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\{FBD50733-2ABE-3D23-88B4-7B0C0A0ADDA0}) (Version: 65.181.32922 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Infestation: Survivor Stories (HKLM-x32\...\Steam App 226700) (Version:  - Hammerpoint Interactive)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Killing Floor (HKLM-x32\...\Steam App 1250) (Version:  - Tripwire Interactive)
Killing Floor Mod: Defence Alliance 2 (HKLM-x32\...\Steam App 35420) (Version:  - Defence Alliance Team)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden
Skype™ 6.14 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.14.104 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2189.2 - Hi-Rez Studios)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version:  - Rebellion)
Star Wars - Battlefront II (HKLM-x32\...\Steam App 6060) (Version:  - Pandemic Studios)
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 7.0.0.40 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
System Update kb70007 (x32 Version: 1.0.0 - MSR) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

18-07-2014 13:18:52 Windows Update
22-07-2014 13:29:00 Windows Update
24-07-2014 13:26:34 Removed Aeria Ignite
24-07-2014 14:27:59 Installed Java 7 Update 65
24-07-2014 14:49:29 DirectX wurde installiert
24-07-2014 14:59:21 Wiederherstellungsvorgang
24-07-2014 15:26:45 Windows Update
24-07-2014 15:54:29 Installed Java 7 Update 65
24-07-2014 16:36:15 Windows Update
24-07-2014 16:38:04 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
24-07-2014 16:49:21 Wiederherstellungsvorgang
24-07-2014 17:08:58 Windows Update
24-07-2014 21:29:42 Removed Aeria Ignite
25-07-2014 14:38:43 zoek.exe restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-07-25 17:45 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3A49BE3B-C0E9-4070-B4AB-A78DF69C6026} - System32\Tasks\{77245E9B-B20B-4898-B5D7-D462B0BD13D5} => C:\Breaking Point\BreakingPoint.exe [2014-05-17] (Alderon Games)
Task: {73EC966E-3D69-4FD3-BCBD-55EAF1C596CB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-06-08 22:31 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-04-29 10:23 - 2014-04-29 10:23 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/25/2014 07:18:49 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (07/25/2014 06:23:59 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (07/25/2014 06:23:57 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (07/25/2014 06:23:57 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (07/25/2014 06:23:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (07/25/2014 06:20:05 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (07/25/2014 06:19:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (07/25/2014 06:17:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 05:45:42 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 05:05:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/25/2014 06:18:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 05:46:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 05:43:04 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (07/25/2014 05:42:56 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 05:42:50 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 05:42:31 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (07/25/2014 05:40:42 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 05:37:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SystemUpdatekb70007" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/25/2014 05:06:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 04:54:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (07/25/2014 07:18:49 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (07/25/2014 06:23:59 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\user\Downloads\esetsmartinstaller_deu.exe

Error: (07/25/2014 06:23:57 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\user\Downloads\esetsmartinstaller_deu.exe

Error: (07/25/2014 06:23:57 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\user\Downloads\esetsmartinstaller_deu.exe

Error: (07/25/2014 06:23:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\user\Downloads\esetsmartinstaller_deu.exe

Error: (07/25/2014 06:20:05 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\user\Downloads\esetsmartinstaller_deu.exe

Error: (07/25/2014 06:19:43 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\user\Downloads\esetsmartinstaller_deu.exe

Error: (07/25/2014 06:17:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 05:45:42 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 05:05:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2014-07-25 17:42:31.528
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-07-25 17:42:31.488
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 28%
Total physical RAM: 8191.05 MB
Available physical RAM: 5858.87 MB
Total Pagefile: 16380.29 MB
Available Pagefile: 13675.47 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:668.09 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: B99ACCF5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Problem ist weg und keine anderen Problem mehr ich danke dir vielmals

Alt 25.07.2014, 18:42   #10
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Hi,
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Java installieren.

Java 7 Update 60 dann deinstallieren.


Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.




Falls Combofix verwendet wurde:
Combofix-Deinstallation.
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.






Alle Logs gepostet? Ja! Dann lade Dir bitte DelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.




>>clean<<
Wir haben es geschafft!
Die Logs sehen für mich im Moment sauber aus.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.
Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen.

Wie kann ich mich in Zukunft besser schützen?

Tipps, Dos & Don'ts

Updates & Software
Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.

Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.



Firewall, Antivirus & Co.
  • Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.
  • Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. (Updatefunktion aktivieren!)
    Meine Empfehlungen:
    Kaspersky Antivirus
    Emsisoft Anti-Malware
    avast Free Antivirus
  • Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

    Optional:
  • NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.


Cracks, Downloads & Co.


Neben unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert.
Der Besuch dubioser Websites kann bereits Risiken bergen. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
Illegale Cracks, Keygens und Serials sind ein ausgesprochen einfacher und beliebter Weg um Malware zu verbreiten.
Bei Dateien aus Peer-to-Peer- und Filesharingprogrammen oder von Filehostern kann man nie sicher sein, ob auch wirklich drin ist, was drauf steht. (Trojanisches Pferd^^)
  • Auch virustotal.com ist Dein Freund! Lade dubiose oder unbekannte Dateien hoch, bevor Du diese startest oder installierst.

Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden zu verleiten, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).
  • Surfe daher mit Vorsicht und klicke mit Verstand.
  • Sei skeptisch bei unerwarteten E-Mails, insbesondere wenn sie Anhänge enthalten. Auch wenn sie auf den ersten Blick authentisch wirken, persönliche Daten von Dir enthalten oder vermeintlich von einem bekannten Absender stammen: Lieber nochmals in Ruhe überdenken oder nachfragen, anstatt einfach mal Links oder ausführbare Anhänge öffnen oder irgendwo Deine Daten eingeben.
  • Auch in sozialen Netzwerken oder über Instant Messaging Systeme können schädliche Links oder Dateien die Runde machen. Erhältst Du von einem Deiner Freunde eine Nachricht, die merkwürdig ist oder so sensationell interessant, dass man einfach draufklicken muss, dann hat bei ihm/ihr wahrscheinlich Neugier über Verstand gesiegt und Du solltest nicht denselben Fehler machen.

Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.
  • Lade Software in erster Priorität immer direkt vom Hersteller herunter. Viele Softwareportale (z.B. Softonic) packen noch unnützes Zeug mit in die Installation. Alternativ dazu wähle ein sauberes Portal wie Filepony oder heise.
  • Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
  • Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
  • Erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
  • Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 25.07.2014, 19:04   #11
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-07-2014 01
Ran by user at 2014-07-25 19:47:50 Run:1
Running from C:\Users\user\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000
         
*****************

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000 => Moved successfully.


The system needed a reboot. 

==== End of Fixlog ====
Code:
ATTFilter
# DelFix v10.7 - Datei am 25/07/2014 um 20:05:01 erstellt
# Aktualisiert am 27/04/2014 von Xplode
# Benutzer : user - USER-PC
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)

~ Aktiviere die Benutzerkontensteuerung ... OK

~ Entferne die Bereinigungsprogramme ...

Gelöscht : C:\Combofix
Gelöscht : C:\FRST
Gelöscht : C:\zoek_backup
Gelöscht : C:\AdwCleaner
Gelöscht : C:\zoek-results.log
Gelöscht : C:\Users\user\Desktop\Addition.txt
Gelöscht : C:\Users\user\Desktop\Fixlog.txt
Gelöscht : C:\Users\user\Desktop\FRST.txt
Gelöscht : C:\Users\user\Desktop\FRST64.exe
Gelöscht : C:\Users\user\Downloads\Addition.txt
Gelöscht : C:\Users\user\Downloads\adwcleaner_3.216.exe
Gelöscht : C:\Users\user\Downloads\ComboFix.exe
Gelöscht : C:\Users\user\Downloads\esetsmartinstaller_deu.exe
Gelöscht : C:\Users\user\Downloads\FRST.txt
Gelöscht : C:\Users\user\Downloads\zoek.exe
Gelöscht : C:\Windows\grep.exe
Gelöscht : C:\Windows\PEV.exe
Gelöscht : C:\Windows\NIRCMD.exe
Gelöscht : C:\Windows\MBR.exe
Gelöscht : C:\Windows\SED.exe
Gelöscht : C:\Windows\SWREG.exe
Gelöscht : C:\Windows\SWSC.exe
Gelöscht : C:\Windows\SWXCACLS.exe
Gelöscht : C:\Windows\Zip.exe
Gelöscht : HKCU\console_combofixbackup
Gelöscht : HKLM\SOFTWARE\AdwCleaner
Gelöscht : HKLM\SOFTWARE\Swearware
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys

~ Erstelle ein Backup der Registrierungsdatenbank ... OK

~ Lösche die Wiederherstellungspunkte ...

Gelöscht : RP #104 [Windows Update | 07/24/2014 16:36:15]
Gelöscht : RP #105 [Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 | 07/24/2014 16:38:04]
Gelöscht : RP #106 [Wiederherstellungsvorgang | 07/24/2014 16:49:21]
Gelöscht : RP #107 [Windows Update | 07/24/2014 17:08:58]
Gelöscht : RP #108 [Removed Aeria Ignite | 07/24/2014 21:29:42]
Gelöscht : RP #109 [zoek.exe restore point | 07/25/2014 14:38:43]
Gelöscht : RP #110 [Installed Java 7 Update 65 (64-bit) | 07/25/2014 17:53:03]
Gelöscht : RP #111 [Installed Java 7 Update 65 | 07/25/2014 17:55:25]

Ein neuer Wiederherstellungspunkt wurde erstellt !

~ Stelle die Systemeinstellungen wieder her ... OK

########## - EOF - ##########

Alt 25.07.2014, 19:22   #12
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Prima!
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Antwort

Themen zu Blauer trojaner er unterstreicht mir blaue wörter manche mit links
blaue wörter, msil/adware.proxomoto.a, msil/adware.proxomoto.b, pup.optional.amonetize, pup.optional.crossrider.a, pup.optional.onefloorapp, pup.optional.outbrowse, pup.optional.privoxy.a, pup.optional.qone8, pup.optional.quickstart.a, sweet-page, sweet-page entfernen, win32/adware.multiplug.n, win32/adware.multiplug.y, win32/elex.ad, win32/elex.ar, win32/installerex.m, win32/thinknice.a, win32/thinknice.b, win32/thinknice.c, win32/toolbar.babylon.y, win32/toolbar.conduit.r, win64/adware.multiplug.a, win64/thinknice.a, win64/thinknice.c


« Windows 7: Werbung überall und Tabs öffnen sich von selbst | Java 64bit verursacht Bluescreen »


Ähnliche Themen: Blauer trojaner er unterstreicht mir blaue wörter manche mit links


  1. Chrome funktioniert nicht mehr richtig, Werbung bei jedem Klick, blaue unterstrichene Wörter
    Plagegeister aller Art und deren Bekämpfung - 08.09.2015 (7)
  2. Macbook Air OSX Version 10.9.5: Unterstrichene blaue Wörter mit grünem Pfeil - Fenster mit Werbung öffnen sich andauernd.
    Alles rund um Mac OSX & Linux - 02.06.2015 (1)
  3. unerwünschte Werbung bei Firefox und blaue doppelt unterstrichene Wörter in Chrome
    Plagegeister aller Art und deren Bekämpfung - 20.02.2015 (28)
  4. einzelne doppelt unterstrichene blaue Wörter und unerwünschte Werbung
    Plagegeister aller Art und deren Bekämpfung - 03.02.2015 (13)
  5. Blaue Wörter mit grünen Pfeilen in Firefox
    Log-Analyse und Auswertung - 26.10.2014 (11)
  6. Trojaner, der Wörter grün schreibt und sie doppelt unterstreicht
    Plagegeister aller Art und deren Bekämpfung - 20.09.2014 (10)
  7. Blaue doppelt unterstrichene Wörter, Werbung (Firefox)
    Log-Analyse und Auswertung - 12.09.2014 (19)
  8. Windows 8 unterstreicht Wörter doppelt und überall blinkt Werbung auf
    Plagegeister aller Art und deren Bekämpfung - 08.09.2014 (3)
  9. Habe einen Trojaner, der Wörter grün schreibt und sie doppelt unterstreicht, außerdem öffnen sich ständig Pop-ups.
    Plagegeister aller Art und deren Bekämpfung - 24.08.2014 (9)
  10. Windows Vista: blaue, doppelunterstrichende Wörter mit Verlinkungen und willkührlich sich öffnende Tabs
    Log-Analyse und Auswertung - 26.03.2014 (15)
  11. Trojaner? Doppelt unterstrichene blaue Links im Browser
    Log-Analyse und Auswertung - 22.02.2014 (18)
  12. Google Chrome blaue unterstrichene Wörter wo Links hinter versteckt sind, ich verzweifle
    Log-Analyse und Auswertung - 17.02.2014 (3)
  13. Manche Wörter in Firefox grün und doppelt unterstrichen, virus?
    Plagegeister aller Art und deren Bekämpfung - 20.01.2014 (11)
  14. Mozilla Firefox: überall Werbung, unterstrichene Wörter mit Links, Weiterleitung zu Links
    Plagegeister aller Art und deren Bekämpfung - 23.10.2013 (11)
  15. Seltsame blaue Links und dubiose Werbung
    Plagegeister aller Art und deren Bekämpfung - 17.10.2013 (10)
  16. blaue, unterstrichene Wörter im Chrome mit Links auf komische Seiten
    Log-Analyse und Auswertung - 17.10.2013 (1)
  17. Ständig Werbeeinblendungen und doppelt unterstrichene blaue Links
    Log-Analyse und Auswertung - 09.10.2013 (10)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Hey, Bei mir werden immer wieder wörter blau markiert und mit links verlinkt wie bekomme ich das wieder weg - Blauer trojaner er unterstreicht mir blaue wörter manche mit links...
Archiv
Du betrachtest: Blauer trojaner er unterstreicht mir blaue wörter manche mit links auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131