Hallo,
ich habe seit einigen Tagen keinen Zugriff mehr auf sämtliche Email Accounts. Mein Steam Account war weg, den habe ich aber auch wiederbekommen via "Passwort vergessen".

Es gab dort zugriffe aus Algerien.


Vermute einen keylogger. Scan habe ich mit Avira gemacht.

Zitat von Avira Logfile

Avira Internet Security
Erstellungsdatum der Reportdatei: Mittwoch, 6. August 2014 17:24


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen seit s nicht mehr zur Verfügung.

Lizenznehmer : *********
Seriennummer : 2226751750-ISECE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : GAMER-PC

Versionsinformationen:
BUILD.DAT : 13.0.0.4052 64557 Bytes 29.08.2013 17:54:00
AVSCAN.EXE : 13.6.20.2100 639032 Bytes 02.09.2013 14:22:31
AVSCANRC.DLL : 13.6.20.2174 63544 Bytes 02.09.2013 14:22:31
LUKE.DLL : 13.6.20.2174 65080 Bytes 02.09.2013 14:22:44
AVSCPLR.DLL : 13.6.20.2174 92216 Bytes 02.09.2013 14:22:31
AVREG.DLL : 13.6.20.2174 250424 Bytes 02.09.2013 14:22:31
avlode.dll : 13.6.20.2174 497720 Bytes 02.09.2013 14:22:29
avlode.rdf : 13.0.1.42 26846 Bytes 28.08.2013 09:37:21
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:00:13
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 22:39:17
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 22:39:19
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 22:39:21
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 23:04:57
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 09:12:33
VBASE006.VDF : 7.11.103.230 2293248 Bytes 24.09.2013 13:45:00
VBASE007.VDF : 7.11.103.231 2048 Bytes 24.09.2013 13:45:00
VBASE008.VDF : 7.11.103.232 2048 Bytes 24.09.2013 13:45:00
VBASE009.VDF : 7.11.103.233 2048 Bytes 24.09.2013 13:45:01
VBASE010.VDF : 7.11.103.234 2048 Bytes 24.09.2013 13:45:01
VBASE011.VDF : 7.11.103.235 2048 Bytes 24.09.2013 13:45:01
VBASE012.VDF : 7.11.103.236 2048 Bytes 24.09.2013 13:45:01
VBASE013.VDF : 7.11.103.237 2048 Bytes 24.09.2013 13:45:01
VBASE014.VDF : 7.11.104.123 282112 Bytes 26.09.2013 19:55:36
VBASE015.VDF : 7.11.104.237 359424 Bytes 28.09.2013 11:24:57
VBASE016.VDF : 7.11.105.103 195072 Bytes 02.10.2013 13:43:36
VBASE017.VDF : 7.11.105.243 571904 Bytes 07.10.2013 14:36:55
VBASE018.VDF : 7.11.106.91 185856 Bytes 08.10.2013 13:51:08
VBASE019.VDF : 7.11.106.167 183296 Bytes 09.10.2013 15:20:26
VBASE020.VDF : 7.11.106.168 2048 Bytes 09.10.2013 15:20:26
VBASE021.VDF : 7.11.106.169 2048 Bytes 09.10.2013 15:20:26
VBASE022.VDF : 7.11.106.170 2048 Bytes 09.10.2013 15:20:26
VBASE023.VDF : 7.11.106.171 2048 Bytes 09.10.2013 15:20:26
VBASE024.VDF : 7.11.106.172 2048 Bytes 09.10.2013 15:20:27
VBASE025.VDF : 7.11.106.173 2048 Bytes 09.10.2013 15:20:27
VBASE026.VDF : 7.11.106.174 2048 Bytes 09.10.2013 15:20:27
VBASE027.VDF : 7.11.106.175 2048 Bytes 09.10.2013 15:20:27
VBASE028.VDF : 7.11.106.176 2048 Bytes 09.10.2013 15:20:27
VBASE029.VDF : 7.11.106.177 2048 Bytes 09.10.2013 15:20:27
VBASE030.VDF : 7.11.106.178 2048 Bytes 09.10.2013 15:20:27
VBASE031.VDF : 7.11.106.210 68608 Bytes 09.10.2013 17:20:23
Engineversion : 8.2.12.126
AEVDF.DLL : 8.1.3.4 102774 Bytes 08.07.2013 22:39:29
AESCRIPT.DLL : 8.1.4.154 512382 Bytes 02.10.2013 13:43:40
AESCN.DLL : 8.1.10.4 131446 Bytes 26.03.2013 14:54:32
AESBX.DLL : 8.2.16.26 1245560 Bytes 23.08.2013 15:35:46
AERDL.DLL : 8.2.0.128 688504 Bytes 08.07.2013 22:39:29
AEPACK.DLL : 8.3.2.30 749945 Bytes 02.10.2013 13:43:40
AEOFFICE.DLL : 8.1.2.76 205181 Bytes 08.08.2013 13:45:25
AEHEUR.DLL : 8.1.4.676 6201722 Bytes 02.10.2013 13:43:39
AEHELP.DLL : 8.1.27.6 266617 Bytes 27.08.2013 13:23:58
AEGEN.DLL : 8.1.7.14 446839 Bytes 06.09.2013 09:02:31
AEEXP.DLL : 8.4.1.62 328055 Bytes 13.09.2013 15:08:15
AEEMU.DLL : 8.1.3.2 393587 Bytes 29.11.2012 10:16:10
AECORE.DLL : 8.1.32.0 201081 Bytes 23.08.2013 15:35:44
AEBB.DLL : 8.1.1.4 53619 Bytes 29.11.2012 10:16:10
AVWINLL.DLL : 13.6.20.2174 23608 Bytes 02.09.2013 14:22:24
AVPREF.DLL : 13.6.20.2174 48184 Bytes 02.09.2013 14:22:31
AVREP.DLL : 13.6.20.2174 175672 Bytes 02.09.2013 14:22:31
AVARKT.DLL : 13.6.20.2174 258104 Bytes 02.09.2013 14:22:25
AVEVTLOG.DLL : 13.6.20.2174 165432 Bytes 02.09.2013 14:22:27
SQLITE3.DLL : 3.7.0.1 397704 Bytes 25.01.2013 08:17:07
AVSMTP.DLL : 13.6.20.2174 60472 Bytes 02.09.2013 14:22:32
NETNT.DLL : 13.6.20.2174 13368 Bytes 02.09.2013 14:22:45
RCIMAGE.DLL : 13.6.20.2174 5159992 Bytes 02.09.2013 14:22:24
RCTEXT.DLL : 13.6.20.2174 68152 Bytes 02.09.2013 14:22:24

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_53e24825\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: Reparieren
Sekundäre Aktion......................: Quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: Vollständig

Beginn des Suchlaufs: Mittwoch, 6. August 2014 17:24

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '130' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avfwsvc.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'NvNetworkService.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvstreamsvc.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'PnkBstrA.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler64.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'avmailc.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvstreamsvc.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'sppsvc.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvstreamsvc.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'NvBackend.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '165' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmi64.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '102' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'chrome.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'Steam.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'THPanel.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'Steam.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'Origin.exe' - '108' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpohmr08.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'SSScheduler.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'net.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '116' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'Updater.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '120' Modul(e) wurden durchsucht
Durchsuche Prozess 'consent.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\Program Files (x86)\Steam\GameOverlayUI.exe'
C:\Program Files (x86)\Steam\GameOverlayUI.exe
[FUND] Ist das Trojanische Pferd TR/Dropper.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '52f2d9e7.qua' verschoben!
Beginne mit der Suche in 'C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\Cache\klavasyswatch.dll.817dda8857b98d41aec66b4d22610e2e'
C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\Cache\klavasyswatch.dll.817dda8857b98d41aec66b4d22610e2e
[FUND] Ist das Trojanische Pferd TR/Rootkit.Gen2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1836a70c.qua' verschoben!


Ende des Suchlaufs: Mittwoch, 6. August 2014 17:25
Benötigte Zeit: 01:10 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

0 Verzeichnisse wurden überprüft
782 Dateien wurden geprüft
2 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
2 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
780 Dateien ohne Befall
1 Archive wurden durchsucht
0 Warnungen
2 Hinweise

Hier die anderen Logs:

Zitat von gmer

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-06 17:50:04
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST1000DM003-9YN162 rev.CC4B 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Willi\AppData\Local\Temp\kgloqpow.sys


---- User code sections - GMER 2.1 ----

.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ed1465 2 bytes [ED, 76]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ed14bb 2 bytes [ED, 76]
.text ... * 2
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avp.exe[1888] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007762faa8 5 bytes JMP 0000000171fb18dd
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avp.exe[1888] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077630038 5 bytes JMP 0000000171fb1ed6
.text C:\Windows\SysWOW64\PnkBstrA.exe[2288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 000000006fc31a22 2 bytes [C3, 6F]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 000000006fc31ad0 2 bytes [C3, 6F]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 000000006fc31b08 2 bytes [C3, 6F]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 000000006fc31bba 2 bytes [C3, 6F]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 000000006fc31bda 2 bytes [C3, 6F]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ed1465 2 bytes [ED, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ed14bb 2 bytes [ED, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3816] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000076b454a9 5 bytes JMP 0000000100220800
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3816] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076ed1465 2 bytes [ED, 76]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3816] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000076ed14bb 2 bytes [ED, 76]
.text ... * 2

---- Threads - GMER 2.1 ----

Thread C:\Windows\system32\svchost.exe [1056:3596] 000007fef80d0ea8
Thread C:\Windows\system32\svchost.exe [1056:3600] 000007fef80c9db0
Thread C:\Windows\system32\svchost.exe [1056:3660] 000007fef80caa10
Thread C:\Windows\system32\svchost.exe [1056:3696] 000007fef80d1c94
Thread [3048:2100] 0000000077662e65
Thread [3048:1404] 0000000071d07950
Thread [3048:2140] 0000000071eac59c
Thread [3048:3032] 0000000071eac59c
Thread [3048:4372] 0000000071eac59c
Thread [3048:4384] 0000000071eac59c
Thread [3048:3460] 000000006322facd
Thread [3048:2752] 0000000063250623
Thread [3048:6932] 0000000063250623
Thread [3048:7060] 0000000057ead80c
Thread [3048:1124] 000000006d17784b
Thread [3048:284] 000000005c7b55e7
Thread [3048:2280] 000000005c1fe99b
Thread [3048:4284] 000000005c1fe99b
Thread [3048:5996] 000000005c1fe99b
Thread [3048:6272] 00000000767012e5
Thread [3048:6284] 00000000767012e5
Thread [3048:4224] 0000000077663e85
Thread [3048:6292] 000000005c1fe99b
Thread [3048:3820] 000000006d4a27c1
Thread [3048:5020] 0000000077663e85
Thread [3048:6584] 0000000071eac59c
---- Processes - GMER 2.1 ----

Process C:\Users\Willi\AppData\Roaming\Windows Net Data\net.exe (*** suspicious ***) @ C:\Users\Willi\AppData\Roaming\Windows Net Data\net.exe [2400] (Windows Net/Windows Net)(2013-10-17 15:28:29) 0000000000400000

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision 2005230

---- EOF - GMER 2.1 ----

Zitat von defogger_disable

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:32 on 06/08/2014 (Willi)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Zitat von FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-08-2014
Ran by Willi (administrator) on GAMER-PC on 06-08-2014 17:42:14
Running from C:\Users\Willi\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avpui.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\wmi64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Palit Microsystems Ltd.) C:\Program Files (x86)\Thunder Master\THPanel.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Windows Net) C:\Users\Willi\AppData\Roaming\Windows Net Data\net.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(TeamSpeak Systems GmbH) C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe
() C:\Users\Willi\Downloads\Gmer-19357.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)
HKLM\...\Run: [MRT] => C:\Windows\system32\MRT.exe [96441528 2014-07-09] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKU\.DEFAULT\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-12-29] (Microsoft Corporation)
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [THPanel] => C:\Program Files (x86)\Thunder Master\THPanel.exe [2050416 2012-07-13] (Palit Microsystems Ltd.)
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [SSync] => C:\Users\Willi\AppData\Roaming\SSync\SSync.exe [36864 2013-04-10] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [DataMgr] => C:\Users\Willi\AppData\Roaming\DataMgr\DataMgr.exe [168848 2013-06-26] (HTTO Group, Ltd.)
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1753280 2014-07-16] (Valve Corporation)
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3595608 2014-06-20] (Electronic Arts)
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [SCheck] => C:\Users\Willi\AppData\Roaming\SCheck\SCheck.exe [37376 2013-12-09] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [Snoozer] => C:\Users\Willi\AppData\Roaming\Snz\Snz.exe [1209624 2013-12-24] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [Intermediate] => C:\Users\Willi\AppData\Roaming\Intermediate\Intermediate.exe [37376 2013-12-09] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [OMESupervisor] => C:\Users\Willi\AppData\Local\omesuperv.exe [2239256 2013-12-24] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [GoogleChromeAutoLaunch_15ABF0FDC4412B2CD53E5201FB759E63] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-07-15] (Google Inc.)
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [8515eb34d8f9de5af815466e9715b3e5] => .. [0 2014-08-06] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [e101a39ab5de59589562aa0ff3295ba5] => .. [0 2014-08-06] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [038b9aec4f0fcf61b0a7ac87706c7c47] => .. [0 2014-08-06] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Run: [2f489e7cb5f8a5b3d67277572c4fdec5] => .. [0 2014-08-06] ()
HKU\S-1-5-21-1796275383-3995191035-40029559-1000\...\Policies\Explorer: [DisallowRun] 1
AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\hp psc 1000 series.lnk
ShortcutTarget: hp psc 1000 series.lnk -> C:\Program Files (x86)\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk
ShortcutTarget: hpoddt01.exe.lnk -> C:\Program Files (x86)\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Willi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk
ShortcutTarget: net.lnk -> C:\Users\Willi\AppData\Roaming\Windows Net Data\net.exe (Windows Net)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page =
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=sfde203fbdgy21
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=ST1000DM003-9YN162_S1DA6WM8XXXXS1DA6WM8&ts=1382263729
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST1000DM003-9YN162_S1DA6WM8XXXXS1DA6WM8&ts=1382263730&type=default&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST1000DM003-9YN162_S1DA6WM8XXXXS1DA6WM8&ts=1382263730&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST1000DM003-9YN162_S1DA6WM8XXXXS1DA6WM8&ts=1382263730&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST1000DM003-9YN162_S1DA6WM8XXXXS1DA6WM8&ts=1382263730&type=default&q={searchTerms}
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde203fbdgy21&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.my-online-search.com/?q={searchTerms}&babsrc=SP_ofln&mntrId=4A6BD43D7EB97343&cat=delta&dlb=2&affID=119357&tsp=5014
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST1000DM003-9YN162_S1DA6WM8XXXXS1DA6WM8&ts=1382263730&type=default&q={searchTerms}
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde203fbdgy21&q={searchTerms}
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO: Hotspot Shield Class -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @live.heroesandgenerals.com/npretox -> C:\Program Files (x86)\Heroes & Generals\live\npretox-1.0.6.1\npretoxlive-1.0.6.1.dll (Reto-Moto ApS)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Willi\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll (Bebo Media Ltd)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com [2014-08-06]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-06]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com [2014-08-06]

Chrome:
=======
CHR Extension: (Kaspersky Protection) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa [2014-08-06]
CHR Extension: (McAfee Security Scan+) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-02-23]
CHR Extension: (Adblock Plus) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-11-04]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-08-06]
CHR Extension: (OfferMosquito) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbmdkmlcnbapgegninelmjbfibaghdmk [2013-07-20]
CHR Extension: (Heroes & Generals) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbophcdhblbipoaacgchllkobdaolpge [2014-02-20]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-08-06]
CHR Extension: (Whilokii) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\iaimhpklononapfjngelgdokckfjekfc [2013-10-20]
CHR Extension: (Lightning Newtab) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo [2013-10-20]
CHR Extension: (Virtual Keyboard) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-08-06]
CHR Extension: (Steam Trader Helper (auto-buy)) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhoahihokddepjlegpenefeaahdkojog [2014-06-04]
CHR Extension: (Amazon-Icon) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg [2014-04-22]
CHR Extension: (Google Wallet) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (YouTube Unblocker) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2014-05-20]
CHR HKCU\...\Chrome\Extension: [gbmdkmlcnbapgegninelmjbfibaghdmk] - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\ext_offermosquito\ext_offermosquito.crx [2013-12-19]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [2013-12-19]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\urladvisor.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [dljhohhmfjfhgfhpgkfefjoojfobodhn] - C:\Program Files (x86)\Whilokii\dljhohhmfjfhgfhpgkfefjoojfobodhn.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx [2013-10-20]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Willi\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2014-04-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-02] (Avira Operations GmbH & Co. KG) [File not signed]
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG) [File not signed]
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG) [File not signed]
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG) [File not signed]
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avp.exe [214512 2014-05-28] (Kaspersky Lab ZAO)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1618888 2014-04-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21009352 2014-04-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-20] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 AFS; C:\Windows\SysWow64\Drivers\AFS.sys [77004 2013-09-17] (Oak Technology Inc.) [File not signed]
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-01-25] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-01-25] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-06] (Avira Operations GmbH & Co. KG)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-28] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-05-28] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-05-28] (Kaspersky Lab ZAO)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19744 2014-04-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.)
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
U3 kgloqpow; \??\C:\Users\Willi\AppData\Local\Temp\kgloqpow.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 17:42 - 2014-08-06 17:42 - 00024872 _____ () C:\Users\Willi\Downloads\FRST.txt
2014-08-06 17:38 - 2014-08-06 17:38 - 00380416 _____ () C:\Users\Willi\Downloads\Gmer-19357.exe
2014-08-06 17:33 - 2014-08-06 17:42 - 00000000 ____D () C:\FRST
2014-08-06 17:33 - 2014-08-06 17:33 - 02094080 _____ (Farbar) C:\Users\Willi\Downloads\FRST64.exe
2014-08-06 17:32 - 2014-08-06 17:32 - 00000472 _____ () C:\Users\Willi\Downloads\defogger_disable.log
2014-08-06 17:32 - 2014-08-06 17:32 - 00000000 _____ () C:\Users\Willi\defogger_reenable
2014-08-06 17:31 - 2014-08-06 17:31 - 00050477 _____ () C:\Users\Willi\Downloads\Defogger.exe
2014-08-06 17:09 - 2014-08-06 17:09 - 00262144 _____ () C:\Windows\system32\config\elam
2014-08-06 17:07 - 2014-08-06 17:22 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-08-06 17:07 - 2014-08-06 17:07 - 00001089 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-08-06 17:07 - 2014-08-06 17:07 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-08-06 17:07 - 2014-08-06 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2014-08-06 17:07 - 2014-08-06 17:07 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-08-06 17:07 - 2014-05-28 16:38 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-08-06 17:07 - 2014-05-28 16:38 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-08-06 17:07 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-08-06 17:00 - 2014-08-06 17:02 - 233071424 _____ () C:\Users\Willi\Downloads\kav14.0.0.4651abcdefg_de_6139.exe
2014-08-04 17:35 - 2014-08-04 17:35 - 00589696 _____ () C:\Users\Willi\Downloads\BEClient (3).dll
2014-08-02 19:57 - 2014-08-02 19:58 - 00000000 ____D () C:\Users\Willi\Desktop\Musik
2014-08-02 19:56 - 2014-08-02 19:57 - 00000000 ____D () C:\Spiele
2014-07-18 17:48 - 2014-08-02 19:58 - 00000000 ____D () C:\Users\Willi\Desktop\Müll
2014-07-09 12:38 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 12:38 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 12:38 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 12:38 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 12:38 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 12:38 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 12:38 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 12:38 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 12:38 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 12:38 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 12:38 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 12:38 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 12:38 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 12:38 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 12:38 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 12:38 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 12:38 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 12:38 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 12:38 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 12:38 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 12:38 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 12:38 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 12:38 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 12:38 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 12:38 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 12:38 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 12:38 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 12:38 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 12:38 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 12:38 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 12:38 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 12:38 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 12:38 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 12:38 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 12:38 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 12:38 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 12:38 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 12:38 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 12:38 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 12:38 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 12:38 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 12:38 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 12:38 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 12:38 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 12:38 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 12:38 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 12:38 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 12:38 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 12:38 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 12:38 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 12:38 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 12:38 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 12:38 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 12:38 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 12:38 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 12:38 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 12:38 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 12:38 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 12:38 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 12:38 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 12:38 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 12:38 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 12:37 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 12:37 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 12:37 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-07 19:25 - 2014-08-05 20:45 - 00000000 ____D () C:\Users\Willi\AppData\Roaming\SpinTires

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 17:42 - 2014-08-06 17:42 - 00024872 _____ () C:\Users\Willi\Downloads\FRST.txt
2014-08-06 17:42 - 2014-08-06 17:33 - 00000000 ____D () C:\FRST
2014-08-06 17:38 - 2014-08-06 17:38 - 00380416 _____ () C:\Users\Willi\Downloads\Gmer-19357.exe
2014-08-06 17:35 - 2013-07-05 03:48 - 00000000 ____D () C:\Users\Willi\AppData\Roaming\TS3Client
2014-08-06 17:33 - 2014-08-06 17:33 - 02094080 _____ (Farbar) C:\Users\Willi\Downloads\FRST64.exe
2014-08-06 17:33 - 2014-06-28 18:09 - 00000000 ____D () C:\install
2014-08-06 17:32 - 2014-08-06 17:32 - 00000472 _____ () C:\Users\Willi\Downloads\defogger_disable.log
2014-08-06 17:32 - 2014-08-06 17:32 - 00000000 _____ () C:\Users\Willi\defogger_reenable
2014-08-06 17:32 - 2013-07-04 19:09 - 00000000 ____D () C:\Users\Willi
2014-08-06 17:31 - 2014-08-06 17:31 - 00050477 _____ () C:\Users\Willi\Downloads\Defogger.exe
2014-08-06 17:27 - 2013-07-04 01:04 - 01509610 _____ () C:\Windows\WindowsUpdate.log
2014-08-06 17:25 - 2014-03-06 14:28 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-08-06 17:25 - 2014-03-06 14:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-06 17:25 - 2013-10-07 18:52 - 00000000 ____D () C:\ProgramData\Origin
2014-08-06 17:25 - 2013-07-30 22:32 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-06 17:25 - 2013-07-04 21:01 - 00000000 ____D () C:\Users\Willi\AppData\Roaming\Skype
2014-08-06 17:25 - 2013-07-04 21:01 - 00000000 ____D () C:\ProgramData\Skype
2014-08-06 17:22 - 2014-08-06 17:07 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-08-06 17:22 - 2014-05-07 15:18 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69f6d8fb6e77.job
2014-08-06 17:21 - 2013-07-09 00:29 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-08-06 17:21 - 2013-07-04 21:58 - 00311940 _____ () C:\Windows\PFRO.log
2014-08-06 17:21 - 2013-07-04 19:27 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-06 17:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-06 17:21 - 2009-07-14 06:51 - 00168481 _____ () C:\Windows\setupact.log
2014-08-06 17:20 - 2009-07-14 06:45 - 00010112 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-06 17:20 - 2009-07-14 06:45 - 00010112 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-06 17:09 - 2014-08-06 17:09 - 00262144 _____ () C:\Windows\system32\config\elam
2014-08-06 17:09 - 2014-05-20 09:09 - 00000000 ____D () C:\Users\Willi\AppData\Roaming\mscdm
2014-08-06 17:07 - 2014-08-06 17:07 - 00001089 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-08-06 17:07 - 2014-08-06 17:07 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-08-06 17:07 - 2014-08-06 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2014-08-06 17:07 - 2014-08-06 17:07 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-08-06 17:02 - 2014-08-06 17:00 - 233071424 _____ () C:\Users\Willi\Downloads\kav14.0.0.4651abcdefg_de_6139.exe
2014-08-06 16:32 - 2013-10-07 18:52 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-06 16:30 - 2005-04-08 04:16 - 00000000 ___HD () C:\Users\Willi\AppData\Roaming\4A6B5A10
2014-08-06 16:28 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2014-08-05 21:21 - 2013-07-04 21:05 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-05 20:46 - 2014-03-13 13:43 - 00000000 ____D () C:\Users\Willi\Desktop\DeadZReborn-Feb-28-2014
2014-08-05 20:45 - 2014-07-07 19:25 - 00000000 ____D () C:\Users\Willi\AppData\Roaming\SpinTires
2014-08-04 22:54 - 2014-02-21 12:57 - 00000000 ____D () C:\Users\Willi\Desktop\yolo
2014-08-04 18:02 - 2013-07-05 00:10 - 00000000 ____D () C:\Users\Willi\AppData\Local\ArmA 2 OA
2014-08-04 17:35 - 2014-08-04 17:35 - 00589696 _____ () C:\Users\Willi\Downloads\BEClient (3).dll
2014-08-02 20:02 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-02 19:58 - 2014-08-02 19:57 - 00000000 ____D () C:\Users\Willi\Desktop\Musik
2014-08-02 19:58 - 2014-07-18 17:48 - 00000000 ____D () C:\Users\Willi\Desktop\Müll
2014-08-02 19:58 - 2013-07-07 19:34 - 00000000 ____D () C:\Users\Willi\Desktop\Bilder
2014-08-02 19:57 - 2014-08-02 19:56 - 00000000 ____D () C:\Spiele
2014-08-02 19:57 - 2013-07-30 16:33 - 00000000 ____D () C:\Users\Willi\Desktop\Detektorn und alles
2014-08-02 19:55 - 2013-07-04 21:05 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-02 19:53 - 2013-07-05 12:07 - 00000000 ____D () C:\Fraps
2014-08-02 19:51 - 2014-06-28 16:31 - 00000000 ____D () C:\Users\Willi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-08-02 19:47 - 2013-10-07 18:57 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-02 19:47 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-08-02 16:40 - 2013-10-20 12:09 - 00105108 _____ () C:\Users\Willi\daemonprocess.txt
2014-08-01 22:56 - 2013-09-23 16:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-01 22:56 - 2013-09-23 16:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-22 21:01 - 2014-02-20 15:38 - 00000000 ____D () C:\Program Files (x86)\Heroes & Generals
2014-07-18 17:26 - 2013-07-04 21:05 - 00002471 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-17 13:37 - 2013-12-19 17:51 - 00000000 ____D () C:\Users\Willi\AppData\Local\DayZ
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-09 23:59 - 2009-07-14 06:45 - 00276968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 23:57 - 2009-07-14 20:18 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-09 18:51 - 2013-12-28 13:43 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-09 18:50 - 2013-12-28 13:43 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\Users\Willi\AppData\Roaming\cache.dat
C:\Users\Willi\AppData\Roaming\cache.ini


Some content of TEMP:
====================
C:\Users\Willi\AppData\Local\Temp\0ab370615dab3f9a76a82fdd201a8dc5.dll
C:\Users\Willi\AppData\Local\Temp\amazonicon.exe
C:\Users\Willi\AppData\Local\Temp\amazonicon_v4.exe
C:\Users\Willi\AppData\Local\Temp\amazoninstallernircmdc.exe
C:\Users\Willi\AppData\Local\Temp\APNSetup.exe
C:\Users\Willi\AppData\Local\Temp\Band.of.Brothers.Teil8.Der.Spezialauftrag.German.2001.DVDRiP.XviD.iNTERNAL MFi.avi.flv__3515_i66781867_il5424456.exe
C:\Users\Willi\AppData\Local\Temp\bdfilters.dll
C:\Users\Willi\AppData\Local\Temp\devcon64.exe
C:\Users\Willi\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Willi\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Willi\AppData\Local\Temp\i4jdel0.exe
C:\Users\Willi\AppData\Local\Temp\ICReinstall_MinecraftSetup.exe
C:\Users\Willi\AppData\Local\Temp\ICReinstall_PDFCreatorSetup.exe
C:\Users\Willi\AppData\Local\Temp\ICReinstall_ZipOpenerSetup.exe
C:\Users\Willi\AppData\Local\Temp\IminentSetup.exe
C:\Users\Willi\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Willi\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Willi\AppData\Local\Temp\nvStInst.exe
C:\Users\Willi\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Willi\AppData\Local\Temp\sdapskill.exe
C:\Users\Willi\AppData\Local\Temp\sdaspwn.exe
C:\Users\Willi\AppData\Local\Temp\securitascout_3.exe
C:\Users\Willi\AppData\Local\Temp\setup_fsu_cid.exe
C:\Users\Willi\AppData\Local\Temp\sonarinst.exe
C:\Users\Willi\AppData\Local\Temp\sweetpage_294wld.exe
C:\Users\Willi\AppData\Local\Temp\Tsu7078F02D.dll
C:\Users\Willi\AppData\Local\Temp\Tsu7B97E233.dll
C:\Users\Willi\AppData\Local\Temp\uninst1.exe
C:\Users\Willi\AppData\Local\Temp\uninstallkit.exe
C:\Users\Willi\AppData\Local\Temp\VIS_DE-2013-12-13.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-05 21:34

==================== End Of Log ============================

Zitat von addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-08-2014
Ran by Willi at 2014-08-06 17:42:42
Running from C:\Users\Willi\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AbiWord 2.9.4 (HKLM-x32\...\AbiWord2) (Version: 2.9.4 - AbiSource Developers)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.168 - Adobe Systems Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Any Video Converter 5.5.2 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
Arma 2 (HKLM-x32\...\Steam App 33910) (Version: - Bohemia Interactive)
Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version: - Bohemia Interactive)
Arma 2: Operation Arrowhead Beta (HKLM-x32\...\Steam App 219540) (Version: - )
Arma 3 (HKLM-x32\...\Steam App 107410) (Version: - Bohemia Interactive)
aTube Catcher (HKLM-x32\...\aTube Catcher) (Version: 2.9.1482 - DsNET Corp)
Avira Internet Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 13.0.0.4052 - Avira)
Bandicam (HKLM-x32\...\Bandicam) (Version: 1.9.2.454 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version: - Bandisoft.com)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.2.0.2 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.4.0 - EA Digital Illusions CE AB)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version: - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version: - )
Call of Duty: Ghosts - Multiplayer (HKLM-x32\...\Steam App 209170) (Version: - Infinity Ward)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)
DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
DayZ Commander (HKLM-x32\...\{0B74EC0B-2A85-4542-A167-3DE2132E7DAA}) (Version: 0.92.85 - Dotjosh Studios)
Dead Island (HKLM-x32\...\Steam App 91310) (Version: - Techland)
Extended Update (HKCU\...\UpdaterEX) (Version: - ) <==== ATTENTION
Fallout 3 (HKLM-x32\...\Steam App 22300) (Version: - Bethesda Game Studios)
Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version: - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Chrome Frame (HKLM-x32\...\{CD4ABC29-0547-388C-B8BC-EF88333E5C2E}) (Version: 65.119.72 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Heroes & Generals (HKLM-x32\...\Heroes & Generals) (Version: 1.0.6.1 - Reto-Moto)
Heroes & Generals (HKLM-x32\...\Steam App 227940) (Version: - Reto-Moto)
HP Foto- und Bildbearbeitung 2.0 - All-in-One (x32 Version: 1.10.0000 - Hewlett-Packard Company) Hidden
HP Foto und Bildbearbeitung 2.0 - hp psc 1200 series (HKLM-x32\...\HP PSC 1200 Series) (Version: - )
HP Foto- und Bildbearbeitung 2.0 All-in-One Treiber (x32 Version: 1.10.0000 - Hewlett-Packard Company) Hidden
hp psc 1200 series (x32 Version: 1.10.0000 - Hewlett-Packard Company) Hidden
HP Speicher-Disc (HKLM-x32\...\{B376402D-58EA-45EA-BD50-DD924EB67A70}) (Version: 1.0.4.805 - Hewlett-Packard Company)
Infestation Survivor Stories version 1.0 (HKLM-x32\...\{BC3051A7-1021-4B57-A3DA-AAC24566FAE7}_is1) (Version: 1.0 - OP Productions LLC)
InterActual Player (HKLM-x32\...\InterActual Player) (Version: - )
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Anti-Virus (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Metro: Last Light (HKLM-x32\...\Steam App 43160) (Version: - 4A Games)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
Nether (HKLM-x32\...\Steam App 247730) (Version: - Phosphor Games)
NVIDIA 3D Vision Controller-Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.82 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.82 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.82 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.151.1095 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden
NVIDIA Update 12.4.67 (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 12.4.67 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
Origin (HKLM-x32\...\Origin) (Version: 9.3.7.2735 - Electronic Arts, Inc.)
PDF Creator (HKLM\...\PDF Creator) (Version: - )
PlayClaw 3 (HKLM-x32\...\PlayClaw_is1) (Version: 3 - )
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6849 - Realtek Semiconductor Corp.)
Rust (HKLM-x32\...\Steam App 252490) (Version: - Facepunch Studios)
SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version: - Rebellion)
Spintires (HKLM-x32\...\Steam App 263280) (Version: - Oovee® Game Studios)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.11.1 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
The Forest (HKLM-x32\...\Steam App 242760) (Version: - Endnight Games Ltd)
Thunder Master v1.4 (HKLM-x32\...\{EE04522C-0814-4B63-AE57-0B63E5A355BB}_is1) (Version: 1.4.0.0 - Palit Microsystems Ltd.)
Update for Microsoft .NET Framework 4.5 (KB2750147) (HKLM-x32\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB2750147) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4.5 (KB2805221) (HKLM-x32\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB2805221) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4.5 (KB2805226) (HKLM-x32\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB2805226) (Version: 1 - Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
Vegas Pro 12.0 (64-bit) (HKLM\...\{A7C8BBDE-FE98-11E1-87C9-F04DA23A5C58}) (Version: 12.0.367 - Sony)
Warframe (HKLM-x32\...\{37C2917E-EA9B-4DB8-A97E-216A3117635D}) (Version: 1.0.0 - Digital Extremes)
Windows Utils (HKLM-x32\...\Windows Utils) (Version: - )
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version: - Wargaming.net)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

02-08-2014 17:48:33 Removed Vegas Pro 12.0 (64-bit)
02-08-2014 17:55:03 Removed Google Earth Pro.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1E195C07-C820-4A68-80CB-2FC46D0D82BB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-04] (Google Inc.)
Task: {43BDEACA-99D5-4BDE-8F19-4B2CDBFE2697} - System32\Tasks\{733F0D58-4E49-49BA-B23D-A6551532DDF5} => C:\Users\Willi\Documents\Infestation Survivor Stories\WarZlauncher.exe [2013-11-25] (Arktos Entertainment Group)
Task: {4674988C-1A23-4696-8403-50AEFCA614E6} - System32\Tasks\GoogleUpdateTaskMachineCore1cf69f6d8fb6e77 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-04] (Google Inc.)
Task: {56EEA90A-67E1-4F22-9A4E-1A5BB918C03F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-04] (Google Inc.)
Task: {918F9D44-19AB-4D4E-AAA1-3242DDF127FC} - System32\Tasks\{F866336B-B0E5-427D-9715-E14525902251} => C:\Users\Willi\Documents\Infestation Survivor Stories\WarZlauncher.exe [2013-11-25] (Arktos Entertainment Group)
Task: {E22530FD-9DF9-47C2-9848-3CA59C9F7878} - System32\Tasks\{E61017CE-99B9-4DB2-868E-424D5F5D4A67} => C:\Users\Willi\Documents\Infestation Survivor Stories\WarZlauncher.exe [2013-11-25] (Arktos Entertainment Group)
Task: {F487B078-F32A-4E50-BCD5-C0434F1CE189} - System32\Tasks\{D24142AE-E6CC-4A5B-A6A7-09E8C6A057AD} => Chrome.exe hxxp://ui.skype.com/ui/0/6.7.0.102/de/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf69f6d8fb6e77.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe

==================== Loaded Modules (whitelisted) =============

2013-07-04 19:26 - 2013-11-11 17:02 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-10-20 12:08 - 2011-10-04 22:43 - 00087552 _____ () C:\Windows\System32\custmon64i.dll
2013-07-07 22:16 - 2014-06-20 23:49 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-05 08:15 - 2013-08-05 08:15 - 00070712 _____ () C:\Windows\system32\bdmpega64.acm
2013-04-04 10:38 - 2013-08-23 22:30 - 00302056 _____ () C:\Program Files\TeamSpeak 3 Client\soundbackends\directsound_win64.dll
2013-04-04 10:38 - 2013-08-23 22:30 - 00320488 _____ () C:\Program Files\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win64.dll
2013-04-04 10:38 - 2013-08-23 22:30 - 00186344 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\appscanner_plugin.dll
2013-04-04 10:38 - 2013-08-23 22:30 - 00565224 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\clientquery_plugin.dll
2014-08-06 17:38 - 2014-08-06 17:38 - 00380416 _____ () C:\Users\Willi\Downloads\Gmer-19357.exe
2013-07-09 00:28 - 2013-01-25 10:17 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\kpcengine.2.3.dll
2013-07-09 00:28 - 2012-11-02 09:40 - 00447848 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\libxml2.dll
2013-07-09 00:28 - 2012-11-02 09:40 - 00060264 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\cares.dll
2014-07-18 17:26 - 2014-07-15 11:24 - 00718664 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libglesv2.dll
2014-07-18 17:26 - 2014-07-15 11:24 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libegl.dll
2014-07-18 17:26 - 2014-07-15 11:24 - 08537928 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll
2014-07-18 17:26 - 2014-07-15 11:24 - 00353096 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll
2014-07-18 17:26 - 2014-07-15 11:24 - 01732936 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll
2014-05-21 20:59 - 2014-07-12 02:53 - 01116672 _____ () C:\Program Files (x86)\Steam\libavcodec-55.dll
2014-04-22 23:13 - 2014-07-12 02:53 - 00438784 _____ () C:\Program Files (x86)\Steam\libavutil-53.dll
2014-05-21 20:59 - 2014-07-12 02:53 - 00399360 _____ () C:\Program Files (x86)\Steam\libavformat-55.dll
2014-01-08 16:22 - 2014-07-12 02:53 - 00331264 _____ () C:\Program Files (x86)\Steam\libavresample-1.dll
2013-07-01 08:20 - 2014-06-27 00:40 - 00764416 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-05-21 20:59 - 2014-07-16 04:28 - 02139328 _____ () C:\Program Files (x86)\Steam\video.dll
2014-05-21 20:59 - 2014-04-29 02:37 - 00519168 _____ () C:\Program Files (x86)\Steam\libswscale-2.dll
2013-07-26 14:46 - 2014-07-16 04:28 - 01116864 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-07-15 14:32 - 2014-05-02 01:35 - 20628160 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:AD022376

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/06/2014 05:20:30 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (08/06/2014 05:18:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 36.0.1985.125 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1208

Startzeit: 01cfb189a651add1

Endzeit: 3

Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Berichts-ID: ec671da1-1d7c-11e4-b161-d43d7eb97343

Error: (08/06/2014 05:18:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 36.0.1985.125 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: b84

Startzeit: 01cfb1899101481c

Endzeit: 5

Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Berichts-ID: dba63c34-1d7c-11e4-b161-d43d7eb97343

Error: (08/06/2014 05:16:08 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 36.0.1985.125 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 14a0

Startzeit: 01cfb1891f520df8

Endzeit: 2

Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Berichts-ID: 966197af-1d7c-11e4-b161-d43d7eb97343

Error: (08/06/2014 05:14:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 36.0.1985.125 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1850

Startzeit: 01cfb188f1c84886

Endzeit: 2

Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Berichts-ID: 5b5f715e-1d7c-11e4-b161-d43d7eb97343

Error: (08/06/2014 05:13:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 36.0.1985.125 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: a18

Startzeit: 01cfb182fd4b12ef

Endzeit: 4

Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Berichts-ID: 2b930672-1d7c-11e4-b161-d43d7eb97343

Error: (08/04/2014 08:14:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ArmA2OA.exe, Version: 1.63.125.548, Zeitstempel: 0x53b16561
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038cef
ID des fehlerhaften Prozesses: 0x1364
Startzeit der fehlerhaften Anwendung: 0xArmA2OA.exe0
Pfad der fehlerhaften Anwendung: ArmA2OA.exe1
Pfad des fehlerhaften Moduls: ArmA2OA.exe2
Berichtskennung: ArmA2OA.exe3

Error: (08/02/2014 07:45:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm DeadZ.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1430

Startzeit: 01cfae5d88f70e26

Endzeit: 390

Anwendungspfad: C:\Users\Willi\Desktop\DeadZReborn-Feb-28-2014\DeadZ.exe

Berichts-ID:

Error: (07/31/2014 06:25:31 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm ArmA2OA.exe, Version 1.63.125.548 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1ba0

Startzeit: 01cfacdbf074591f

Endzeit: 362

Anwendungspfad: C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA.exe

Berichts-ID:

Error: (07/31/2014 06:22:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm ArmA2OA.exe, Version 1.63.125.548 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1600

Startzeit: 01cfacdb9bd19cae

Endzeit: 1

Anwendungspfad: C:\Program Files (x86)\Steam\SteamApps\common\arma 2 operation arrowhead\ArmA2OA.exe

Berichts-ID: e0dc0135-18ce-11e4-b956-d43d7eb97343


System errors:
=============
Error: (08/06/2014 05:22:15 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS

Error: (08/06/2014 04:28:57 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS

Error: (08/05/2014 07:39:59 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS

Error: (08/04/2014 04:33:33 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS

Error: (08/03/2014 01:14:24 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS

Error: (08/02/2014 08:03:06 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS

Error: (08/02/2014 04:21:16 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS

Error: (08/02/2014 00:42:55 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.100
registriert werden. Der Computer mit IP-Adresse 192.168.2.102 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (08/02/2014 00:42:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS

Error: (08/01/2014 09:36:52 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFS


Microsoft Office Sessions:
=========================
Error: (08/06/2014 05:20:30 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (08/06/2014 05:18:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: chrome.exe36.0.1985.125120801cfb189a651add13C:\Program Files (x86)\Google\Chrome\Application\chrome.exeec671da1-1d7c-11e4-b161-d43d7eb97343

Error: (08/06/2014 05:18:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: chrome.exe36.0.1985.125b8401cfb1899101481c5C:\Program Files (x86)\Google\Chrome\Application\chrome.exedba63c34-1d7c-11e4-b161-d43d7eb97343

Error: (08/06/2014 05:16:08 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: chrome.exe36.0.1985.12514a001cfb1891f520df82C:\Program Files (x86)\Google\Chrome\Application\chrome.exe966197af-1d7c-11e4-b161-d43d7eb97343

Error: (08/06/2014 05:14:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: chrome.exe36.0.1985.125185001cfb188f1c848862C:\Program Files (x86)\Google\Chrome\Application\chrome.exe5b5f715e-1d7c-11e4-b161-d43d7eb97343

Error: (08/06/2014 05:13:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: chrome.exe36.0.1985.125a1801cfb182fd4b12ef4C:\Program Files (x86)\Google\Chrome\Application\chrome.exe2b930672-1d7c-11e4-b161-d43d7eb97343

Error: (08/04/2014 08:14:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ArmA2OA.exe1.63.125.54853b16561ntdll.dll6.1.7601.18247521ea8e7c000000500038cef136401cfaffd8259f340C:\Program Files (x86)\Steam\SteamApps\common\arma 2 operation arrowhead\ArmA2OA.exeC:\Windows\SysWOW64\ntdll.dll1f2b1e51-1c03-11e4-af27-d43d7eb97343

Error: (08/02/2014 07:45:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: DeadZ.exe0.0.0.0143001cfae5d88f70e26390C:\Users\Willi\Desktop\DeadZReborn-Feb-28-2014\DeadZ.exe

Error: (07/31/2014 06:25:31 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ArmA2OA.exe1.63.125.5481ba001cfacdbf074591f362C:\Program Files (x86)\Steam\steamapps\common\Arma 2 Operation Arrowhead\ArmA2OA.exe

Error: (07/31/2014 06:22:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ArmA2OA.exe1.63.125.548160001cfacdb9bd19cae1C:\Program Files (x86)\Steam\SteamApps\common\arma 2 operation arrowhead\ArmA2OA.exee0dc0135-18ce-11e4-b956-d43d7eb97343


==================== Memory info ===========================

Percentage of memory in use: 38%
Total physical RAM: 8105.85 MB
Available physical RAM: 5013.08 MB
Total Pagefile: 16209.88 MB
Available Pagefile: 12452.53 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:564.84 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: D301E6FD)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Hi,

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.