Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Blauer trojaner er unterstreicht mir blaue wörter manche mit links

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Log-Analyse und Auswertung: Blauer trojaner er unterstreicht mir blaue wörter manche mit links

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 25.07.2014, 14:33   #1
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Hey,

Bei mir werden immer wieder wörter blau markiert und mit links verlinkt wie bekomme ich das wieder weg

Alt 25.07.2014, 15:04   #2
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links




Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab.
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.



Los geht's:

Schritt 1


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 25.07.2014, 15:21   #3
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014 01
Ran by user (administrator) on USER-PC on 25-07-2014 16:18:06
Running from C:\Users\user\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(The Privoxy team - www.privoxy.org) C:\Program Files (x86)\MSR\Privoxy\privoxy.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-29] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Registry Helper] => "C:\Program Files (x86)\Registry Helper\RegistryHelper.Exe" /boot
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Akamai NetSession Interface] => C:\Users\user\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\Program Files (x86)\SupTab\SearchProtect64.dll [102512 2014-05-08] (Skytech Co., Ltd.)
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => C:\Program Files (x86)\SupTab\SearchProtect32.dll [91248 2014-05-08] (Skytech Co., Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1406293489&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402877950&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.eazytosearch.info/?l=1&q={searchTerms}&pid=724&r=2014/06/08&hid=12766663853909689536&lg=EN&cc=AT
BHO: savie on -> {481C847C-431D-CF2C-9B50-B13C0BF98265} -> C:\Program Files (x86)\savie on\Zu.x64.dll ()
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: savie on -> {481C847C-431D-CF2C-9B50-B13C0BF98265} -> C:\Program Files (x86)\savie on\Zu.dll ()
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======
CHR HomePage: hxxp://istart.webssearches.com/?type=hppp&ts=1404718433&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
CHR StartupUrls: "hxxp://www.search.ask.com/?tpid=ORJ-SPE&o=APN11412&pf=V7&trgb=CR&p2=%5EBBK%5EOSJ000%5EYY%5EAT&gct=hp&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=cr_35.0.1916.114&apn_uid=1E455068-CB0D-4341-A302-6FF7D0D23B0B&itbv=12.15.1.20&doi=2014-07-24&psv=&pt=tb", "hxxp://istart.webssearches.com/?type=hppp&ts=1404718433&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX"
CHR DefaultSearchKeyword: ask search
CHR DefaultSearchProvider: Ask Search
CHR DefaultSearchURL: hxxp://www.search.ask.com/web?tpid=ORJ-SPE&o=APN11412&l=dis&pf=V7&p2=%5EBBK%5EOSJ000%5EYY%5EAT&gct=&itbv=12.15.1.20&doi=2014-07-24&apn_uid=1E455068-CB0D-4341-A302-6FF7D0D23B0B&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=cr_35.0.1916.114&psv=&pt=tb&trgb=CR&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-20]
CHR Extension: (Google Mail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2014-05-18] () [File not signed]
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-30] (BitRaider, LLC)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21007192 2014-04-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-04-29] ()
R2 SystemUpdatekb70007; C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe [18944 2014-05-08] () [File not signed]
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18776 2014-04-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 BRDriver64; \??\C:\ProgramData\BitRaider\BRDriver64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 16:18 - 2014-07-25 16:18 - 00016375 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:17 - 2014-07-25 16:18 - 00000000 ____D () C:\FRST
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:58 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 17:21 - 2014-07-24 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-07-24 17:21 - 2014-07-24 19:23 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-07-24 17:21 - 2014-07-24 17:21 - 00000000 ____D () C:\Users\user\AppData\Roaming\Nico Mak Computing
2014-07-24 17:21 - 2014-07-24 17:21 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-07-24 16:31 - 2014-07-24 17:57 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-07-24 16:31 - 2014-07-24 16:31 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-07-24 16:31 - 2014-07-24 16:31 - 00000000 ____D () C:\ProgramData\APN
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-10 03:33 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-10 03:33 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-10 03:33 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 03:33 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 03:33 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 03:33 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 03:33 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 03:33 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 03:33 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 03:33 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 03:33 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 03:33 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 03:33 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 03:33 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 03:33 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 03:33 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 03:33 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 03:33 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 03:33 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 03:33 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 03:33 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 03:33 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 03:33 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 03:33 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 03:33 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 03:33 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 03:32 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 03:32 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 03:32 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 03:32 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 03:32 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 21:20 - 2014-07-24 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-06 14:58 - 2014-07-24 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-06 14:58 - 2009-09-16 07:02 - 00031232 _____ (Tunngle.net) C:\Windows\system32\Drivers\tap0901t.sys
2014-07-06 14:10 - 2014-07-06 14:14 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:09 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-06 12:22 - 2014-07-06 14:01 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-03 08:35 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-03 08:03 - 2014-07-03 08:03 - 00000000 ____D () C:\ProgramData\DSearchLink
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:42 - 2014-07-24 23:30 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:32 - 2014-07-24 23:30 - 00000000 ____D () C:\AeriaGames
2014-06-30 04:32 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:17 - 2014-06-27 04:18 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 16:18 - 2014-07-25 16:18 - 00016375 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:18 - 2014-07-25 16:17 - 00000000 ____D () C:\FRST
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2014-07-25 16:12 - 2014-03-20 17:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\Skype
2014-07-25 15:34 - 2014-04-28 15:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-25 15:32 - 2014-03-20 16:44 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-25 15:10 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-25 15:10 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-25 15:07 - 2014-03-20 16:31 - 01684609 _____ () C:\Windows\WindowsUpdate.log
2014-07-25 15:02 - 2009-07-14 06:51 - 00049710 _____ () C:\Windows\setupact.log
2014-07-25 15:01 - 2014-06-08 22:26 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-25 15:01 - 2014-03-20 16:44 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-25 15:01 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-24 23:30 - 2014-06-30 04:42 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-07-24 23:30 - 2014-06-30 04:32 - 00000000 ____D () C:\AeriaGames
2014-07-24 23:30 - 2014-05-27 22:50 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-07-24 23:28 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-24 22:56 - 2014-04-28 15:17 - 00000000 ____D () C:\Users\user\AppData\Roaming\TS3Client
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 19:23 - 2014-07-24 17:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-07-24 19:23 - 2014-07-24 17:21 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-07-24 18:58 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:58 - 2014-07-06 14:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-24 18:58 - 2014-03-20 16:54 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1
2014-07-24 18:58 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-07-24 18:57 - 2014-07-06 14:09 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-24 18:57 - 2014-07-03 08:35 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-24 18:57 - 2014-06-09 16:42 - 00000000 ____D () C:\Users\user\Downloads\Minecraft
2014-07-24 18:57 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-24 18:56 - 2014-07-09 21:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-24 18:56 - 2014-06-30 04:32 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-07-24 18:56 - 2014-06-23 02:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-24 18:56 - 2014-06-21 22:35 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2014-07-24 18:56 - 2014-06-19 17:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:28 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 18:35 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\Program Files (x86)\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-27 22:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-07-24 18:56 - 2014-05-17 00:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
2014-07-24 18:56 - 2014-05-07 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-07-24 18:56 - 2014-05-07 17:35 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-07-24 18:56 - 2014-04-30 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA
2014-07-24 18:56 - 2014-04-30 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2014-07-24 18:56 - 2014-04-28 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2014-07-24 18:56 - 2014-03-20 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-07-24 18:56 - 2014-03-20 17:05 - 00000000 ____D () C:\ProgramData\Package Cache
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-24 18:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-07-24 18:55 - 2014-06-08 22:32 - 00000000 ____D () C:\Users\user\AppData\Local\NVIDIA
2014-07-24 18:52 - 2014-06-23 02:25 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-24 18:52 - 2014-06-08 22:30 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 17:57 - 2014-07-24 16:31 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-07-24 17:55 - 2014-06-08 18:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-24 17:21 - 2014-07-24 17:21 - 00000000 ____D () C:\Users\user\AppData\Roaming\Nico Mak Computing
2014-07-24 17:21 - 2014-07-24 17:21 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-07-24 17:09 - 2014-03-20 16:33 - 00000000 __SHD () C:\Recovery
2014-07-24 17:05 - 2014-03-20 17:20 - 00064408 _____ () C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 17:03 - 2014-06-08 22:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 16:31 - 2014-07-24 16:31 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-07-24 16:31 - 2014-07-24 16:31 - 00000000 ____D () C:\ProgramData\APN
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-22 22:02 - 2014-05-27 22:46 - 00000000 ____D () C:\Users\user\AppData\Local\PMB Files
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-12 13:20 - 2014-04-28 15:48 - 00185593 _____ () C:\Windows\DirectX.log
2014-07-11 09:31 - 2009-07-14 06:45 - 00294776 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 00:54 - 2014-05-07 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-11 00:54 - 2010-11-21 09:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 21:45 - 2014-06-05 21:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 21:43 - 2014-06-09 03:00 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 00:02 - 2014-06-09 17:06 - 00000000 ____D () C:\Users\user\AppData\Roaming\Tunngle
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-09 12:34 - 2014-04-28 15:20 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 12:34 - 2014-04-28 15:20 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 12:34 - 2014-04-28 15:20 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-07 09:32 - 2010-11-21 05:47 - 00013530 _____ () C:\Windows\PFRO.log
2014-07-06 14:14 - 2014-07-06 14:10 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:01 - 2014-07-06 12:22 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-05 18:01 - 2014-05-27 22:46 - 00000000 ____D () C:\ProgramData\PMB Files
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-03 08:03 - 2014-07-03 08:03 - 00000000 ____D () C:\ProgramData\DSearchLink
2014-07-02 16:18 - 2014-04-30 19:47 - 00000000 ____D () C:\ProgramData\BitRaider
2014-07-02 04:37 - 2014-05-11 03:32 - 00000145 _____ () C:\Users\user\Desktop\arma 3 royal.txt
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:09 - 2014-07-10 03:33 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-10 03:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:18 - 2014-06-27 04:17 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:35 - 2014-06-22 00:54 - 00000000 ____D () C:\Users\user\Documents\4a games
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-06-25 12:27 - 2010-11-21 08:50 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-06-25 12:27 - 2010-11-21 08:50 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-06-25 12:27 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\buenosearch.exe
C:\Users\user\AppData\Local\Temp\BuenoSearchTB.exe
C:\Users\user\AppData\Local\Temp\BuenoSearchTB[1].exe
C:\Users\user\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\user\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\user\AppData\Local\Temp\f.exe
C:\Users\user\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll
C:\Users\user\AppData\Local\Temp\JavaRa.exe
C:\Users\user\AppData\Local\Temp\jli.dll
C:\Users\user\AppData\Local\Temp\jolejolevs Deck Pack.rar__3515_i876280781_il6771304.exe
C:\Users\user\AppData\Local\Temp\jre-7u55-windows-i586.exe
C:\Users\user\AppData\Local\Temp\jre-7u60-windows-i586.exe
C:\Users\user\AppData\Local\Temp\keytool.exe
C:\Users\user\AppData\Local\Temp\msvcr100.dll
C:\Users\user\AppData\Local\Temp\node.exe
C:\Users\user\AppData\Local\Temp\nsy262C.exe
C:\Users\user\AppData\Local\Temp\nsy6012.exe
C:\Users\user\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\user\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\user\AppData\Local\Temp\nvStInst.exe
C:\Users\user\AppData\Local\Temp\optprosetup.exe
C:\Users\user\AppData\Local\Temp\PreExe_ID_13667.exe
C:\Users\user\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\user\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\user\AppData\Local\Temp\SPSetup.exe
C:\Users\user\AppData\Local\Temp\sqlite3.exe
C:\Users\user\AppData\Local\Temp\sSetup-se.exe
C:\Users\user\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\user\AppData\Local\Temp\xmlUpdater.exe
C:\Users\user\AppData\Local\Temp\YgoUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-08 13:30

==================== End Of Log ============================
--- --- ---

--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014 01
Ran by user at 2014-07-25 16:18:38
Running from C:\Users\user\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.9.9 - BitRaider, LLC)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)
Free YouTube to MP3 Converter version 3.12.34.430 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.34.430 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\{FBD50733-2ABE-3D23-88B4-7B0C0A0ADDA0}) (Version: 65.181.32922 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Infestation: Survivor Stories (HKLM-x32\...\Steam App 226700) (Version:  - Hammerpoint Interactive)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
Killing Floor (HKLM-x32\...\Steam App 1250) (Version:  - Tripwire Interactive)
Killing Floor Mod: Defence Alliance 2 (HKLM-x32\...\Steam App 35420) (Version:  - Defence Alliance Team)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.3.38 - Client Connect LTD) <==== ATTENTION
SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden
Skype™ 6.14 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.14.104 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2189.2 - Hi-Rez Studios)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version:  - Rebellion)
Star Wars - Battlefront II (HKLM-x32\...\Steam App 6060) (Version:  - Pandemic Studios)
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 7.0.0.40 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
System Update kb70007 (x32 Version: 1.0.0 - MSR) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

18-07-2014 13:18:52 Windows Update
22-07-2014 13:29:00 Windows Update
24-07-2014 13:26:34 Removed Aeria Ignite
24-07-2014 14:27:59 Installed Java 7 Update 65
24-07-2014 14:49:29 DirectX wurde installiert
24-07-2014 14:59:21 Wiederherstellungsvorgang
24-07-2014 15:26:45 Windows Update
24-07-2014 15:54:29 Installed Java 7 Update 65
24-07-2014 16:36:15 Windows Update
24-07-2014 16:38:04 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
24-07-2014 16:49:21 Wiederherstellungsvorgang
24-07-2014 17:08:58 Windows Update
24-07-2014 21:29:42 Removed Aeria Ignite

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3A49BE3B-C0E9-4070-B4AB-A78DF69C6026} - System32\Tasks\{77245E9B-B20B-4898-B5D7-D462B0BD13D5} => C:\Breaking Point\BreakingPoint.exe [2014-05-17] (Alderon Games)
Task: {73EC966E-3D69-4FD3-BCBD-55EAF1C596CB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {9065BED3-D8AF-4BA4-B261-A5EE0BB6AE6B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {A6BAC2CB-2BC1-4037-9804-DDF12F4FB462} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-06-08 22:31 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-06-18 17:24 - 2012-06-18 17:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2014-04-29 10:23 - 2014-04-29 10:23 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-06-16 02:20 - 2014-05-08 11:45 - 00018944 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
2014-06-08 22:16 - 2014-06-08 22:16 - 00472064 _____ () C:\Program Files (x86)\savie on\Zu.x64.dll
2014-06-16 02:20 - 2014-05-08 11:45 - 00061952 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\InstallerLibrary.dll
2014-06-16 02:20 - 2014-05-08 11:45 - 00016896 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\Installer.dll
2014-06-16 02:20 - 2014-07-25 15:02 - 00086528 _____ () C:\Program Files (x86)\MSR\Privoxy\mgwz.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/25/2014 03:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17207, Zeitstempel: 0x53a20d78
Name des fehlerhaften Moduls: Zu.x64.dll, Version: 1.1.0.0, Zeitstempel: 0x52b8d88b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000202f9
ID des fehlerhaften Prozesses: 0x9ec
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (07/25/2014 03:03:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 00:11:04 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 07:00:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 06:47:59 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 06:27:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 05:17:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 05:06:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 04:42:39 PM) (Source: MsiInstaller) (EventID: 10005) (User: user-PC)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox

Error: (07/24/2014 04:22:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/25/2014 03:05:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/24/2014 10:06:46 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PnkBstrA" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/24/2014 10:05:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (07/24/2014 10:05:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IePlugin Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/24/2014 10:04:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hi-Rez Studios Authenticate and Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/24/2014 10:03:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AMD External Events Utility" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/24/2014 07:01:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/24/2014 06:28:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/24/2014 06:11:56 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎24.‎07.‎2014 um 18:09:30 unerwartet heruntergefahren.

Error: (07/24/2014 06:07:06 PM) (Source: DCOM) (EventID: 10016) (User: user-PC)
Description: AnwendungsspezifischLokalAktivierung{8BC3F05E-D86B-11D0-A075-00C04FB68820}{8BC3F05E-D86B-11D0-A075-00C04FB68820}user-PCGastS-1-5-21-850184543-3320550329-2664725720-501LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================
Error: (07/25/2014 03:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.1720753a20d78Zu.x64.dll1.1.0.052b8d88bc000000500000000000202f99ec01cfa80f5a87bedeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files (x86)\savie on\Zu.x64.dll9967a95b-1402-11e4-b040-0022159198be

Error: (07/25/2014 03:03:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 00:11:04 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 07:00:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 06:47:59 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 06:27:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 05:17:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 05:06:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 04:42:39 PM) (Source: MsiInstaller) (EventID: 10005) (User: user-PC)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox	(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (07/24/2014 04:22:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 28%
Total physical RAM: 8191.05 MB
Available physical RAM: 5865.72 MB
Total Pagefile: 16380.29 MB
Available Pagefile: 13735.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:667.93 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: B99ACCF5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================
__________________
Alt 25.07.2014, 15:27   #4
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Hi, so geht's weiter...

Schritt 1

Bitte deinstalliere folgende Programme:

Search Protect


Versuche es bei Windows 7 zunächst über Systemsteuerung/Programme deinstallieren.

Sollte das nicht gehen, lade Dir bitte Revo Uninstallerhier herunter. Entpacke die zip-Datei auf den Desktop.
  • Starte die Revouninstaller.exe
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus.
    Klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

Wenn Du ein Programm nicht deinstallieren kannst, mach mit dem nächsten weiter.
Auch wenn am Ende noch Programme übrig geblieben sind, führe den nächsten Schritt aus:

Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3
Bitte lade Dir zoek.exe von hier: http://hijackthis.nl/smeenk/
  • Bitte deaktiviere während des Scans den Virenscanner, da dieser Zoek stören könnte.
  • Starte die zoek.exe mit einem Doppelklick (der Programmstart benötigt einige Sekunden).
  • Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und sollte nicht 1:1 auf andere Computer übernommen werden.
  • Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
    Code:
    ATTFilter
    resetIEproxy; 
FFdefaults;
CHRdefaults;
iedefaults;
emptyclsid;
autoclean;
  • Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
  • Wenn das Tool fertig ist, wird sich eine Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:
  • Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken)

Schritt 4



Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Alt 25.07.2014, 16:15   #5
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Code:
ATTFilter
# AdwCleaner v3.216 - Bericht erstellt am 25/07/2014 um 16:32:03
# Aktualisiert 17/07/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : user - USER-PC
# Gestartet von : C:\Users\user\Downloads\adwcleaner_3.216.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : IePluginServices

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\374311380 
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork
Ordner Gelöscht : C:\ProgramData\DSearchLink
Ordner Gelöscht : C:\ProgramData\IePluginServices
Ordner Gelöscht : C:\ProgramData\Nico Mak Computing
Ordner Gelöscht : C:\ProgramData\Registry Helper
Ordner Gelöscht : C:\ProgramData\WindowsProtectManger
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\save on
Ordner Gelöscht : C:\ProgramData\savie on
Ordner Gelöscht : C:\ProgramData\Seearcch-NewTaB
Ordner Gelöscht : C:\ProgramData\YoutubeAdblocker
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Program Files (x86)\Greener Web
[!] Ordner Gelöscht : C:\Program Files (x86)\MSR
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Program Files (x86)\Speedial
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Program Files (x86)\ViewPassword-soft
Ordner Gelöscht : C:\Program Files (x86)\WinZip Malware Protector
Ordner Gelöscht : C:\Program Files (x86)\save on
Ordner Gelöscht : C:\Program Files (x86)\savie on
Ordner Gelöscht : C:\Program Files (x86)\Seearcch-NewTaB
Ordner Gelöscht : C:\Program Files (x86)\YoutubeAdblocker
Ordner Gelöscht : C:\users\user\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\users\user\AppData\Local\globalUpdate
Ordner Gelöscht : C:\users\user\AppData\Local\torch
Ordner Gelöscht : C:\users\user\AppData\Local\Temp\apn
Ordner Gelöscht : C:\users\user\AppData\Roaming\InetStat
Ordner Gelöscht : C:\users\user\AppData\Roaming\Nico Mak Computing
Ordner Gelöscht : C:\users\user\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\users\user\AppData\Roaming\SkypEmoticons
Ordner Gelöscht : C:\users\user\AppData\Roaming\Speedial
Ordner Gelöscht : C:\users\user\AppData\Roaming\SupTab
Ordner Gelöscht : C:\users\user\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Windows\SysWOW64\RegistryHelperLM.ocx
Datei Gelöscht : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_continuetosave.info_0.localstorage-journal
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_sb.scorecardresearch.com_0.localstorage
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_sb.scorecardresearch.com_0.localstorage-journal
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.buenosearch.com_0.localstorage
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.buenosearch.com_0.localstorage-journal
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage
Datei Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage-journal

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Registry Helper]
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-860614263
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{481C847C-431D-CF2C-9B50-B13C0BF98265}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\RegisteredApplicationsEx
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Schlüssel Gelöscht : HKLM\Software\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\Software\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Schlüssel Gelöscht : HKLM\Software\Registry Helper
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWindowsProtectManger
Schlüssel Gelöscht : HKLM\Software\webssearchesSoftware
Schlüssel Gelöscht : HKLM\Software\Wpm
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~1.DLL
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~2.DLL

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v

-\\ Google Chrome v35.0.1916.114

[ Datei : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://www.buenosearch.com/?babsrc=SP_kms&tt=na&mntrId=0bd2db8320bfbfa9646c2ae6bb4fd4cd&affID=128493&tsp=5297&q={searchTerms}
Gelöscht [Search Provider] : hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_vit_14_23_ch&cd=2XzuyEtN2Y1L1QzutDtDtBtBtCyDzytCzyzz0B0E0DyC0F0AtN0D0Tzu0SzzzytDtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StCtBtCzytBtCzyzztGyEzytAtDtGyDyCtB0AtGtB0BzyzytGtCzztB0EzztB0DyCzzyCtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0F0DtA0AtCtDtCtGzz0CyC0DtGtC0DyEtBtG0E0BtB0AtGtAyDyC0D0EtBtB0Fzz0Azz0B2Q&cr=1938505641&ir=
Gelöscht [Search Provider] : hxxp://www.sweet-page.com/web/?type=dspp&ts=1402245343&from=vit&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
Gelöscht [Search Provider] : hxxp://websearch.eazytosearch.info/?l=1&q={searchTerms}&pid=724&r=2014/06/08&hid=12766663853909689536&lg=EN&cc=AT
Gelöscht [Search Provider] : hxxp://www.buenosearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=CCD90022159198BE&affID=128492&tsp=5272
Gelöscht [Search Provider] : hxxp://istart.webssearches.com/web/?type=dspp&ts=1404552197&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX&q={searchTerms}
Gelöscht [Search Provider] : hxxp://www.search.ask.com/web?tpid=ORJ-SPE&o=APN11412&l=dis&pf=V7&p2=%5EBBK%5EOSJ000%5EYY%5EAT&gct=&itbv=12.15.1.20&doi=2014-07-24&apn_uid=1E455068-CB0D-4341-A302-6FF7D0D23B0B&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=cr_35.0.1916.114&psv=&pt=tb&trgb=CR&q={searchTerms}
Gelöscht [Startup_urls] : hxxp://www.search.ask.com/?tpid=ORJ-SPE&o=APN11412&pf=V7&trgb=CR&p2=%5EBBK%5EOSJ000%5EYY%5EAT&gct=hp&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5EAT&apn_dbr=cr_35.0.1916.114&apn_uid=1E455068-CB0D-4341-A302-6FF7D0D23B0B&itbv=12.15.1.20&doi=2014-07-24&psv=&pt=tb
Gelöscht [Startup_urls] : hxxp://istart.webssearches.com/?type=hppp&ts=1404718433&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX
Gelöscht [Homepage] : hxxp://istart.webssearches.com/?type=hppp&ts=1404718433&from=amt&uid=HitachiXHDS721010CLA332_JP6921HD1W06LM1W06LMX

*************************

AdwCleaner[R0].txt - [14968 octets] - [25/07/2014 16:31:18]
AdwCleaner[S0].txt - [13379 octets] - [25/07/2014 16:32:03]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [13440 octets] ##########
Code:
ATTFilter
Zoek.exe v5.0.0.0 Updated 24-07-2014
Tool run by user on 25.07.2014 at 16:37:29,87.
Microsoft Windows 7 Professional  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\user\Downloads\zoek.exe [Scan all users] [Script inserted] 

==== System Restore Info ======================

25.07.2014 16:38:58 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default\prefs.js:

Added to C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default

user.js not found
---- FireFox user.js and prefs.js backups ---- 


==== Deleting Files \ Folders ======================

C:\Users\Gast.user-PC\AppData\LocalLow\{481C847C-431D-CF2C-9B50-B13C0BF98265} deleted
C:\Users\Mike\AppData\LocalLow\{481C847C-431D-CF2C-9B50-B13C0BF98265} deleted
C:\Users\user\AppData\LocalLow\{481C847C-431D-CF2C-9B50-B13C0BF98265} deleted
C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\{481C847C-431D-CF2C-9B50-B13C0BF98265} deleted
C:\PROGRA~2\GUT97FB.tmp deleted
C:\PROGRA~2\GUM97FA.tmp deleted
C:\PROGRA~2\COMMON~1\DVDVideoSoft\bin deleted
C:\PROGRA~2\Plus-HD-9.5 deleted
C:\Users\user\AppData\Roaming\BreakingPoint_Login.ini deleted
C:\Users\user\AppData\Roaming\BreakingPoint_Options.ini deleted
C:\PROGRA~3\Supersoftware App deleted
C:\PROGRA~3\InstallMate deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\user\Searches deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Windows\SysWow64\AI_RecycleBin deleted
"C:\Windows\Installer\2b244f4.msi" deleted
"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\rz12kcz3.default\extensions\toolbar_ORJ-SPE@apn.ask.com.xpi" deleted
"C:\PROGRA~3\11c0f66442da2493\{4820778D-AB0D-6D18-C316-52A6A0E1D507}" deleted
"C:\PROGRA~3\11c0f66442da2493\{4820778D-AB0D-6D18-C316-52A6A0E1D507}.old" deleted
"C:\PROGRA~3\11c0f66442da2493\{993EA8F6-6E55-7E4E-39DE-5796E3226DB9}" deleted
"C:\PROGRA~3\11c0f66442da2493\{993EA8F6-6E55-7E4E-39DE-5796E3226DB9}.old" deleted
"C:\PROGRA~3\11c0f66442da2493\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}" deleted
"C:\PROGRA~3\11c0f66442da2493\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD}" deleted
"C:\PROGRA~3\11c0f66442da2493\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD}.old" deleted
"C:\PROGRA~2\MSR\Privoxy\mgwz.dll" deleted
"C:\PROGRA~2\MSR\Privoxy\privoxy.exe" deleted
"C:\PROGRA~2\MSR\Privoxy\privoxy.log" not deleted
"C:\PROGRA~3\11c0f66442da2493" deleted
"C:\PROGRA~2\MSR" not deleted
"C:\PROGRA~2\MSR\Privoxy" not deleted

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================


==== Chrome Look ======================

save on - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
Saving Flash - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Administrator\AppData\Local\Torch\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Administrator\AppData\Local\Torch\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Administrator\AppData\Local\Torch\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Administrator\AppData\Local\Torch\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Administrator\AppData\Local\Torch\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
Saving Flash - Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - Gast\AppData\Local\Torch\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - Gast\AppData\Local\Torch\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - Gast\AppData\Local\Torch\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - Gast\AppData\Local\Torch\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - Gast\AppData\Local\Torch\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm
save on - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg
savoe on - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc
YoutubeAdblocker - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao
Seearcch-NewTaB - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad
Saving Flash - user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm

==== Chrome Fix ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.superfish.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.superfish.com_0.localstorage-journal deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.eazytosearch.info_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.eazytosearch.info_0.localstorage-journal deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_istart.webssearches.com_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_istart.webssearches.com_0.localstorage-journal deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_continuetosave.info_0.localstorage deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lfmcnadpaibmankmboobghcdnbeffiao_0.localstorage deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lfmcnadpaibmankmboobghcdnbeffiao_0.localstorage-journal deleted successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lfmcnadpaibmankmboobghcdnbeffiao deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\gioanecogbkbeapmeilhembpepjnhhpg deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kedoflehllocecikkkkbfmplijbcdgpc deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oecldjlhfpnbhhjhihcakjdagejbbaad deleted successfully
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\Gast\AppData\Local\Torch\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully
C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pldhclmeakjgffefknnkjoeomfjeclmm deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="hxxp://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"

==== Reset Google Chrome ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyServer"="http=127.0.0.1:8118;https=127.0.0.1:8118"
"ProxyOverride"="<-loopback>;<local>"
"ProxyEnable"=dword:00000001

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F60730A4A66673047777F5728467D401 deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\68a64305-ae05-41a9-8441-d7a16ea30084 deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F60730A4A66673047777F5728467D401 deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast.user-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gast.user-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Mike\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Mike\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2HLGIGWJ will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A30Z03RN will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I6NSJI3T will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LMQR720F will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QXQ6TE8M will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WL4QV01K will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WU4U76BU will be deleted at reboot
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y4T7Y7NM will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\rz12kcz3.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=611 folders=193 51107223 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Gast.user-PC\AppData\Local\Temp emptied successfully
C:\Users\Mike\AppData\Local\Temp emptied successfully
C:\Users\user\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\user\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\PROGRA~2\MSR\Privoxy\privoxy.log"  not deleted
"C:\PROGRA~2\MSR"  not deleted
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2HLGIGWJ" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A30Z03RN" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I6NSJI3T" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LMQR720F" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QXQ6TE8M" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WL4QV01K" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WU4U76BU" not found
"C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y4T7Y7NM" not found

==== EOF on 25.07.2014 at 16:53:03,47 ======================
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014 01
Ran by user (administrator) on USER-PC on 25-07-2014 17:06:06
Running from C:\Users\user\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\user\AppData\Local\Akamai\netsession_win.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(The Privoxy team - www.privoxy.org) C:\Program Files (x86)\MSR\Privoxy\privoxy.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-29] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart 
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-850184543-3320550329-2664725720-1000\...\Run: [Akamai NetSession Interface] => C:\Users\user\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======
CHR Extension: (Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]
CHR Extension: (Google-Suche) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]
CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-20]
CHR Extension: (Google Mail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2014-05-18] () [File not signed]
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-30] (BitRaider, LLC)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21007192 2014-04-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-04-29] ()
R2 SystemUpdatekb70007; C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe [18944 2014-05-08] () [File not signed]
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18776 2014-04-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 BRDriver64; \??\C:\ProgramData\BitRaider\BRDriver64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 17:06 - 2014-07-25 17:06 - 00011475 _____ () C:\Users\user\Desktop\FRST.txt
2014-07-25 16:52 - 2014-07-25 16:52 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-07-25 16:51 - 2014-07-25 16:37 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-07-25 16:38 - 2014-07-25 16:53 - 00026624 _____ () C:\zoek-results.log
2014-07-25 16:37 - 2014-07-25 16:49 - 00000000 ____D () C:\zoek_backup
2014-07-25 16:37 - 2014-07-25 16:37 - 01287168 _____ () C:\Users\user\Downloads\zoek.exe
2014-07-25 16:31 - 2014-07-25 16:32 - 00000000 ____D () C:\AdwCleaner
2014-07-25 16:31 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-25 16:30 - 2014-07-25 16:30 - 01354223 _____ () C:\Users\user\Downloads\adwcleaner_3.216.exe
2014-07-25 16:18 - 2014-07-25 16:19 - 00053570 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:18 - 2014-07-25 16:19 - 00025490 _____ () C:\Users\user\Downloads\Addition.txt
2014-07-25 16:17 - 2014-07-25 17:06 - 00000000 ____D () C:\FRST
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:58 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:05 - 2014-07-24 19:23 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-10 03:33 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-10 03:33 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-10 03:33 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 03:33 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 03:33 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 03:33 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 03:33 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 03:33 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 03:33 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 03:33 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 03:33 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 03:33 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 03:33 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 03:33 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 03:33 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 03:33 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 03:33 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 03:33 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 03:33 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 03:33 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 03:33 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 03:33 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 03:33 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 03:33 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 03:33 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 03:33 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 03:33 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 03:33 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 03:33 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 03:33 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 03:33 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 03:33 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 03:33 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 03:33 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 03:33 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 03:33 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 03:33 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 03:33 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 03:33 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 03:33 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 03:33 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 03:33 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 03:33 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 03:32 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 03:32 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 03:32 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 03:32 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 03:32 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 21:20 - 2014-07-24 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-06 14:58 - 2014-07-24 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-06 14:58 - 2014-07-24 18:56 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-06 14:58 - 2009-09-16 07:02 - 00031232 _____ (Tunngle.net) C:\Windows\system32\Drivers\tap0901t.sys
2014-07-06 14:10 - 2014-07-06 14:14 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:09 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-06 12:22 - 2014-07-06 14:01 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-03 08:35 - 2014-07-24 18:57 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:42 - 2014-07-24 23:30 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:32 - 2014-07-24 23:30 - 00000000 ____D () C:\AeriaGames
2014-06-30 04:32 - 2014-07-24 18:56 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:17 - 2014-06-27 04:18 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-25 17:06 - 2014-07-25 17:06 - 00011475 _____ () C:\Users\user\Desktop\FRST.txt
2014-07-25 17:06 - 2014-07-25 16:17 - 00000000 ____D () C:\FRST
2014-07-25 17:04 - 2014-03-20 17:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\Skype
2014-07-25 17:03 - 2014-06-08 22:26 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-25 17:03 - 2014-03-20 16:44 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-25 17:03 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-25 17:03 - 2009-07-14 06:51 - 00050214 _____ () C:\Windows\setupact.log
2014-07-25 17:02 - 2014-03-20 16:31 - 01702186 _____ () C:\Windows\WindowsUpdate.log
2014-07-25 17:01 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-25 17:00 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-25 17:00 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-25 16:53 - 2014-07-25 16:38 - 00026624 _____ () C:\zoek-results.log
2014-07-25 16:52 - 2014-07-25 16:52 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-07-25 16:52 - 2010-11-21 05:47 - 00014174 _____ () C:\Windows\PFRO.log
2014-07-25 16:49 - 2014-07-25 16:37 - 00000000 ____D () C:\zoek_backup
2014-07-25 16:37 - 2014-07-25 16:51 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-07-25 16:37 - 2014-07-25 16:37 - 01287168 _____ () C:\Users\user\Downloads\zoek.exe
2014-07-25 16:34 - 2014-04-28 15:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-25 16:32 - 2014-07-25 16:31 - 00000000 ____D () C:\AdwCleaner
2014-07-25 16:32 - 2014-03-20 16:44 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-25 16:30 - 2014-07-25 16:30 - 01354223 _____ () C:\Users\user\Downloads\adwcleaner_3.216.exe
2014-07-25 16:19 - 2014-07-25 16:18 - 00053570 _____ () C:\Users\user\Downloads\FRST.txt
2014-07-25 16:19 - 2014-07-25 16:18 - 00025490 _____ () C:\Users\user\Downloads\Addition.txt
2014-07-25 16:17 - 2014-07-25 16:17 - 02093568 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-07-24 23:30 - 2014-06-30 04:42 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames
2014-07-24 23:30 - 2014-06-30 04:32 - 00000000 ____D () C:\AeriaGames
2014-07-24 23:28 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-24 22:56 - 2014-04-28 15:17 - 00000000 ____D () C:\Users\user\AppData\Roaming\TS3Client
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ___RD () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 19:23 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC
2014-07-24 18:58 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike
2014-07-24 18:58 - 2014-07-06 14:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
2014-07-24 18:58 - 2014-03-20 16:54 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.0.1
2014-07-24 18:58 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-07-24 18:57 - 2014-07-06 14:09 - 00000000 ____D () C:\Users\user\Downloads\Warcraft 3
2014-07-24 18:57 - 2014-07-03 08:35 - 00000000 ____D () C:\Users\user\Desktop\Desmumu
2014-07-24 18:57 - 2014-06-09 16:42 - 00000000 ____D () C:\Users\user\Downloads\Minecraft
2014-07-24 18:57 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 18:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-24 18:56 - 2014-07-09 21:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Users\Public\Documents\Tunngle
2014-07-24 18:56 - 2014-07-06 14:58 - 00000000 ____D () C:\Program Files (x86)\Tunngle
2014-07-24 18:56 - 2014-06-30 04:32 - 00000000 ____D () C:\Users\user\AppData\Local\Akamai
2014-07-24 18:56 - 2014-06-23 02:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-24 18:56 - 2014-06-21 22:35 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2014-07-24 18:56 - 2014-06-19 17:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:31 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-07-24 18:56 - 2014-06-08 22:28 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-29 02:05 - 00000000 ____D () C:\Program Files (x86)\Hi-Rez Studios
2014-07-24 18:56 - 2014-05-27 22:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-07-24 18:56 - 2014-05-17 00:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
2014-07-24 18:56 - 2014-05-07 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-07-24 18:56 - 2014-04-30 19:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA
2014-07-24 18:56 - 2014-04-30 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2014-07-24 18:56 - 2014-04-28 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2014-07-24 18:56 - 2014-03-20 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-24 18:56 - 2014-03-20 16:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-24 18:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-07-24 18:55 - 2014-06-08 22:32 - 00000000 ____D () C:\Users\user\AppData\Local\NVIDIA
2014-07-24 18:52 - 2014-06-23 02:25 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-24 18:52 - 2014-06-08 22:30 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-07-24 18:35 - 2014-07-24 18:35 - 00000000 ____D () C:\Users\Mike\AppData\Local\Apps\2.0
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieUserList
2014-07-24 18:34 - 2014-07-24 18:34 - 00000000 __SHD () C:\Users\Mike\AppData\Local\EmieSiteList
2014-07-24 18:33 - 2014-07-24 18:33 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Macromedia
2014-07-24 18:32 - 2014-07-24 18:32 - 00064408 _____ () C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Vorlagen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Startmenü
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Netzwerkumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Lokale Einstellungen
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Eigene Dateien
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Druckumgebung
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Musik
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Documents\Eigene Bilder
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Verlauf
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\AppData\Local\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 _SHDL () C:\Users\Mike\Anwendungsdaten
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\ATI
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Adobe
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\VirtualStore
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA Corporation
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\NVIDIA
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\Google
2014-07-24 18:32 - 2014-07-24 18:32 - 00000000 ____D () C:\Users\Mike\AppData\Local\ATI
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieUserList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 __SHD () C:\Users\Gast.user-PC\AppData\Local\EmieSiteList
2014-07-24 18:07 - 2014-07-24 18:07 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Macromedia
2014-07-24 18:06 - 2014-07-24 18:06 - 00064408 _____ () C:\Users\Gast.user-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\ATI
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Roaming\Adobe
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\Google
2014-07-24 18:06 - 2014-07-24 18:06 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\ATI
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Vorlagen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Startmenü
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Netzwerkumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Lokale Einstellungen
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Eigene Dateien
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Druckumgebung
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Musik
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Documents\Eigene Bilder
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Verlauf
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\AppData\Local\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 _SHDL () C:\Users\Gast.user-PC\Anwendungsdaten
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\VirtualStore
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA Corporation
2014-07-24 18:05 - 2014-07-24 18:05 - 00000000 ____D () C:\Users\Gast.user-PC\AppData\Local\NVIDIA
2014-07-24 17:55 - 2014-06-08 18:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-24 17:09 - 2014-03-20 16:33 - 00000000 __SHD () C:\Recovery
2014-07-24 17:05 - 2014-03-20 17:20 - 00064408 _____ () C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 17:03 - 2014-06-08 22:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla
2014-07-24 16:26 - 2014-07-24 16:26 - 00000000 ____D () C:\ProgramData\Mozilla
2014-07-22 22:02 - 2014-05-27 22:46 - 00000000 ____D () C:\Users\user\AppData\Local\PMB Files
2014-07-19 02:51 - 2014-07-19 02:51 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
2014-07-12 13:20 - 2014-04-28 15:48 - 00185593 _____ () C:\Windows\DirectX.log
2014-07-11 09:31 - 2009-07-14 06:45 - 00294776 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 00:54 - 2014-05-07 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-11 00:54 - 2010-11-21 09:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-11 00:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 21:45 - 2014-06-05 21:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 21:43 - 2014-06-09 03:00 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-10 00:02 - 2014-06-09 17:06 - 00000000 ____D () C:\Users\user\AppData\Roaming\Tunngle
2014-07-09 21:20 - 2014-07-09 21:20 - 00001044 _____ () C:\Users\user\Desktop\TERA.lnk
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\TERA
2014-07-09 21:20 - 2014-07-09 21:20 - 00000000 ____D () C:\Program Files (x86)\TERA
2014-07-09 12:34 - 2014-04-28 15:20 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 12:34 - 2014-04-28 15:20 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 12:34 - 2014-04-28 15:20 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-06 14:14 - 2014-07-06 14:10 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-07-06 14:01 - 2014-07-06 12:22 - 1207728765 _____ () C:\Users\user\Downloads\Warcraft 3.rar
2014-07-06 12:30 - 2014-07-06 12:30 - 00000000 ____D () C:\Users\user\Documents\MGR
2014-07-06 12:29 - 2014-07-06 12:29 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-05 18:01 - 2014-05-27 22:46 - 00000000 ____D () C:\ProgramData\PMB Files
2014-07-03 08:06 - 2014-07-03 08:06 - 00000000 ____D () C:\Users\user\Desktop\pokemon
2014-07-02 16:18 - 2014-04-30 19:47 - 00000000 ____D () C:\ProgramData\BitRaider
2014-07-02 04:37 - 2014-05-11 03:32 - 00000145 _____ () C:\Users\user\Desktop\arma 3 royal.txt
2014-07-01 19:37 - 2014-07-01 19:37 - 00000000 ____D () C:\Users\user\AppData\Local\mslug3
2014-06-30 04:44 - 2014-06-30 04:44 - 00000000 ____D () C:\Users\user\AppData\Local\Aeria Games
2014-06-30 04:43 - 2014-06-30 04:43 - 00000000 ____D () C:\ProgramData\Aeria Games
2014-06-30 04:40 - 2014-06-30 04:40 - 00000000 ____D () C:\Users\user\AppData\Roaming\Aeria Games & Entertainment
2014-06-30 04:09 - 2014-07-10 03:33 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-10 03:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-29 05:07 - 2014-06-29 05:07 - 00000000 ____D () C:\Users\user\Documents\Telltale Games
2014-06-27 04:18 - 2014-06-27 04:17 - 00000000 ____D () C:\Users\user\Documents\Orcs Must Die
2014-06-25 14:35 - 2014-06-22 00:54 - 00000000 ____D () C:\Users\user\Documents\4a games
2014-06-25 14:26 - 2014-06-25 14:26 - 00000000 ____D () C:\Users\user\AppData\Local\4A Games
2014-06-25 14:23 - 2014-06-25 14:23 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-06-25 12:27 - 2010-11-21 08:50 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-06-25 12:27 - 2010-11-21 08:50 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-06-25 12:27 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-08 13:30

==================== End Of Log ============================
--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014 01
Ran by user at 2014-07-25 17:07:12
Running from C:\Users\user\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.9.9 - BitRaider, LLC)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)
Free YouTube to MP3 Converter version 3.12.34.430 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.34.430 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\{FBD50733-2ABE-3D23-88B4-7B0C0A0ADDA0}) (Version: 65.181.32922 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Infestation: Survivor Stories (HKLM-x32\...\Steam App 226700) (Version:  - Hammerpoint Interactive)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Killing Floor (HKLM-x32\...\Steam App 1250) (Version:  - Tripwire Interactive)
Killing Floor Mod: Defence Alliance 2 (HKLM-x32\...\Steam App 35420) (Version:  - Defence Alliance Team)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.154.1168 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden
Skype™ 6.14 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.14.104 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2189.2 - Hi-Rez Studios)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version:  - Rebellion)
Star Wars - Battlefront II (HKLM-x32\...\Steam App 6060) (Version:  - Pandemic Studios)
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 7.0.0.40 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
System Update kb70007 (x32 Version: 1.0.0 - MSR) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

18-07-2014 13:18:52 Windows Update
22-07-2014 13:29:00 Windows Update
24-07-2014 13:26:34 Removed Aeria Ignite
24-07-2014 14:27:59 Installed Java 7 Update 65
24-07-2014 14:49:29 DirectX wurde installiert
24-07-2014 14:59:21 Wiederherstellungsvorgang
24-07-2014 15:26:45 Windows Update
24-07-2014 15:54:29 Installed Java 7 Update 65
24-07-2014 16:36:15 Windows Update
24-07-2014 16:38:04 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
24-07-2014 16:49:21 Wiederherstellungsvorgang
24-07-2014 17:08:58 Windows Update
24-07-2014 21:29:42 Removed Aeria Ignite
25-07-2014 14:38:43 zoek.exe restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3A49BE3B-C0E9-4070-B4AB-A78DF69C6026} - System32\Tasks\{77245E9B-B20B-4898-B5D7-D462B0BD13D5} => C:\Breaking Point\BreakingPoint.exe [2014-05-17] (Alderon Games)
Task: {73EC966E-3D69-4FD3-BCBD-55EAF1C596CB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {9065BED3-D8AF-4BA4-B261-A5EE0BB6AE6B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {A6BAC2CB-2BC1-4037-9804-DDF12F4FB462} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-06-08 22:31 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-04-29 10:23 - 2014-04-29 10:23 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-06-16 02:20 - 2014-05-08 11:45 - 00018944 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
2014-06-16 02:20 - 2014-05-08 11:45 - 00061952 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\InstallerLibrary.dll
2014-06-16 02:20 - 2014-05-08 11:45 - 00016896 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\Installer.dll
2014-07-25 16:52 - 2014-07-25 17:04 - 00086528 _____ () C:\Program Files (x86)\MSR\Privoxy\mgwz.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/25/2014 05:05:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 04:54:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 04:51:34 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/25/2014 04:35:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 03:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17207, Zeitstempel: 0x53a20d78
Name des fehlerhaften Moduls: Zu.x64.dll, Version: 1.1.0.0, Zeitstempel: 0x52b8d88b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000202f9
ID des fehlerhaften Prozesses: 0x9ec
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (07/25/2014 03:03:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 00:11:04 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 07:00:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 06:47:59 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 06:27:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/25/2014 05:06:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 04:54:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 04:51:30 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (07/25/2014 04:47:17 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:47:17 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:47:16 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:47:16 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:47:15 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/25/2014 04:35:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/25/2014 03:05:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (07/25/2014 05:05:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 04:54:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 04:51:34 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/25/2014 04:35:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 03:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.1720753a20d78Zu.x64.dll1.1.0.052b8d88bc000000500000000000202f99ec01cfa80f5a87bedeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files (x86)\savie on\Zu.x64.dll9967a95b-1402-11e4-b040-0022159198be

Error: (07/25/2014 03:03:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/25/2014 00:11:04 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 07:00:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 06:47:59 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (07/24/2014 06:27:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 22%
Total physical RAM: 8191.05 MB
Available physical RAM: 6318.74 MB
Total Pagefile: 16380.29 MB
Available Pagefile: 14317.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:670.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: B99ACCF5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================


Alt 25.07.2014, 16:27   #6
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Hi, das machst Du prima...

Darfst gleich nochmal...

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
--> Blauer trojaner er unterstreicht mir blaue wörter manche mit links

Alt 25.07.2014, 19:04   #7
MiiKKee
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-07-2014 01
Ran by user at 2014-07-25 19:47:50 Run:1
Running from C:\Users\user\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000
         
*****************

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000 => Moved successfully.


The system needed a reboot. 

==== End of Fixlog ====
Code:
ATTFilter
# DelFix v10.7 - Datei am 25/07/2014 um 20:05:01 erstellt
# Aktualisiert am 27/04/2014 von Xplode
# Benutzer : user - USER-PC
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)

~ Aktiviere die Benutzerkontensteuerung ... OK

~ Entferne die Bereinigungsprogramme ...

Gelöscht : C:\Combofix
Gelöscht : C:\FRST
Gelöscht : C:\zoek_backup
Gelöscht : C:\AdwCleaner
Gelöscht : C:\zoek-results.log
Gelöscht : C:\Users\user\Desktop\Addition.txt
Gelöscht : C:\Users\user\Desktop\Fixlog.txt
Gelöscht : C:\Users\user\Desktop\FRST.txt
Gelöscht : C:\Users\user\Desktop\FRST64.exe
Gelöscht : C:\Users\user\Downloads\Addition.txt
Gelöscht : C:\Users\user\Downloads\adwcleaner_3.216.exe
Gelöscht : C:\Users\user\Downloads\ComboFix.exe
Gelöscht : C:\Users\user\Downloads\esetsmartinstaller_deu.exe
Gelöscht : C:\Users\user\Downloads\FRST.txt
Gelöscht : C:\Users\user\Downloads\zoek.exe
Gelöscht : C:\Windows\grep.exe
Gelöscht : C:\Windows\PEV.exe
Gelöscht : C:\Windows\NIRCMD.exe
Gelöscht : C:\Windows\MBR.exe
Gelöscht : C:\Windows\SED.exe
Gelöscht : C:\Windows\SWREG.exe
Gelöscht : C:\Windows\SWSC.exe
Gelöscht : C:\Windows\SWXCACLS.exe
Gelöscht : C:\Windows\Zip.exe
Gelöscht : HKCU\console_combofixbackup
Gelöscht : HKLM\SOFTWARE\AdwCleaner
Gelöscht : HKLM\SOFTWARE\Swearware
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys

~ Erstelle ein Backup der Registrierungsdatenbank ... OK

~ Lösche die Wiederherstellungspunkte ...

Gelöscht : RP #104 [Windows Update | 07/24/2014 16:36:15]
Gelöscht : RP #105 [Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 | 07/24/2014 16:38:04]
Gelöscht : RP #106 [Wiederherstellungsvorgang | 07/24/2014 16:49:21]
Gelöscht : RP #107 [Windows Update | 07/24/2014 17:08:58]
Gelöscht : RP #108 [Removed Aeria Ignite | 07/24/2014 21:29:42]
Gelöscht : RP #109 [zoek.exe restore point | 07/25/2014 14:38:43]
Gelöscht : RP #110 [Installed Java 7 Update 65 (64-bit) | 07/25/2014 17:53:03]
Gelöscht : RP #111 [Installed Java 7 Update 65 | 07/25/2014 17:55:25]

Ein neuer Wiederherstellungspunkt wurde erstellt !

~ Stelle die Systemeinstellungen wieder her ... OK

########## - EOF - ##########

Alt 25.07.2014, 19:22   #8
deeprybka
/// TB-Ausbilder
/// Anleitungs-Guru
 
Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Standard

Blauer trojaner er unterstreicht mir blaue wörter manche mit links


Prima!
__________________
Gruß
deeprybka

Lob, Kritik, Wünsche?

Spende fürs trojaner-board?
_______________________________________________
„Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Antwort

Themen zu Blauer trojaner er unterstreicht mir blaue wörter manche mit links
blaue wörter, msil/adware.proxomoto.a, msil/adware.proxomoto.b, pup.optional.amonetize, pup.optional.crossrider.a, pup.optional.onefloorapp, pup.optional.outbrowse, pup.optional.privoxy.a, pup.optional.qone8, pup.optional.quickstart.a, sweet-page, sweet-page entfernen, win32/adware.multiplug.n, win32/adware.multiplug.y, win32/elex.ad, win32/elex.ar, win32/installerex.m, win32/thinknice.a, win32/thinknice.b, win32/thinknice.c, win32/toolbar.babylon.y, win32/toolbar.conduit.r, win64/adware.multiplug.a, win64/thinknice.a, win64/thinknice.c


« Windows 7: Werbung überall und Tabs öffnen sich von selbst | Java 64bit verursacht Bluescreen »


Ähnliche Themen: Blauer trojaner er unterstreicht mir blaue wörter manche mit links


  1. Chrome funktioniert nicht mehr richtig, Werbung bei jedem Klick, blaue unterstrichene Wörter
    Plagegeister aller Art und deren Bekämpfung - 08.09.2015 (7)
  2. Macbook Air OSX Version 10.9.5: Unterstrichene blaue Wörter mit grünem Pfeil - Fenster mit Werbung öffnen sich andauernd.
    Alles rund um Mac OSX & Linux - 02.06.2015 (1)
  3. unerwünschte Werbung bei Firefox und blaue doppelt unterstrichene Wörter in Chrome
    Plagegeister aller Art und deren Bekämpfung - 20.02.2015 (28)
  4. einzelne doppelt unterstrichene blaue Wörter und unerwünschte Werbung
    Plagegeister aller Art und deren Bekämpfung - 03.02.2015 (13)
  5. Blaue Wörter mit grünen Pfeilen in Firefox
    Log-Analyse und Auswertung - 26.10.2014 (11)
  6. Trojaner, der Wörter grün schreibt und sie doppelt unterstreicht
    Plagegeister aller Art und deren Bekämpfung - 20.09.2014 (10)
  7. Blaue doppelt unterstrichene Wörter, Werbung (Firefox)
    Log-Analyse und Auswertung - 12.09.2014 (19)
  8. Windows 8 unterstreicht Wörter doppelt und überall blinkt Werbung auf
    Plagegeister aller Art und deren Bekämpfung - 08.09.2014 (3)
  9. Habe einen Trojaner, der Wörter grün schreibt und sie doppelt unterstreicht, außerdem öffnen sich ständig Pop-ups.
    Plagegeister aller Art und deren Bekämpfung - 24.08.2014 (9)
  10. Windows Vista: blaue, doppelunterstrichende Wörter mit Verlinkungen und willkührlich sich öffnende Tabs
    Log-Analyse und Auswertung - 26.03.2014 (15)
  11. Trojaner? Doppelt unterstrichene blaue Links im Browser
    Log-Analyse und Auswertung - 22.02.2014 (18)
  12. Google Chrome blaue unterstrichene Wörter wo Links hinter versteckt sind, ich verzweifle
    Log-Analyse und Auswertung - 17.02.2014 (3)
  13. Manche Wörter in Firefox grün und doppelt unterstrichen, virus?
    Plagegeister aller Art und deren Bekämpfung - 20.01.2014 (11)
  14. Mozilla Firefox: überall Werbung, unterstrichene Wörter mit Links, Weiterleitung zu Links
    Plagegeister aller Art und deren Bekämpfung - 23.10.2013 (11)
  15. Seltsame blaue Links und dubiose Werbung
    Plagegeister aller Art und deren Bekämpfung - 17.10.2013 (10)
  16. blaue, unterstrichene Wörter im Chrome mit Links auf komische Seiten
    Log-Analyse und Auswertung - 17.10.2013 (1)
  17. Ständig Werbeeinblendungen und doppelt unterstrichene blaue Links
    Log-Analyse und Auswertung - 09.10.2013 (10)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Blauer trojaner er unterstreicht mir blaue wörter manche mit links - Hey, Bei mir werden immer wieder wörter blau markiert und mit links verlinkt wie bekomme ich das wieder weg - Blauer trojaner er unterstreicht mir blaue wörter manche mit links...
Archiv
Du betrachtest: Blauer trojaner er unterstreicht mir blaue wörter manche mit links auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131