Trojaner Artemis!29760C4C151F eingefangen

Graves · 25.08.2014, 01:01

Hallo,

beim Surfen habe ich heute eine Meldung von McAfee bekommen das ein Trojaner erkannt wurde und ich bitte neustarten soll. Das habe ich gemacht. Daraufhin hab ich in dem Verlauf nachgeschaut und sah das McAfee den Trojaner Artemis!29760C4C151F gefunden hat.

Daraufhin habe ich McAfee Komplett scannen lassen - Resultat: Keine Probleme.

Ich hab Malwarebytes einmal drüber laufen gelassen und eine Menge Daten daraufhin in Quarantäne gesteckt. (Log angehängt)

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 25.08.2014
Scan Time: 00:51:12
Logfile: Malwarebytes.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.24.07
Rootkit Database: v2014.08.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Patrick

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 313226
Time Elapsed: 17 min, 32 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.MindSpark, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe, 3996, Delete-on-Reboot, [ed7ae8e2017a4aece129fbb5936efc04]

Modules: 0
(No malicious items detected)

Registry Keys: 127
PUP.Optional.AudioToAudioToolBar.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\RadioRage_4jService, Quarantined, [bea9dfeb92e9d26417cd5dd89769c937], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{78ba36c9-6036-482b-b48d-ecca6f964b84}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{9638b7d6-11f5-4406-b387-327642a11ffb}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{b872d222-3f52-4cd9-a4be-9d69ee4f293d}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{37B204F8-CD97-409B-BDBF-41C0EC0DFF24}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{7AFA5495-6C01-4BB8-AE21-C3BD6AB2F17C}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A1448C6E-0452-4550-B852-A1CE666D4907}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A25AA6E2-1CDE-4D0F-A5D4-4898D7FB3C86}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A5C9CB1C-1C0A-45A2-81CC-1DD342D0A478}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F2B8FCF4-73EA-4D12-AAFE-72909AFBA0A4}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{37B204F8-CD97-409B-BDBF-41C0EC0DFF24}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{7AFA5495-6C01-4BB8-AE21-C3BD6AB2F17C}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A1448C6E-0452-4550-B852-A1CE666D4907}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A25AA6E2-1CDE-4D0F-A5D4-4898D7FB3C86}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A5C9CB1C-1C0A-45A2-81CC-1DD342D0A478}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{F2B8FCF4-73EA-4D12-AAFE-72909AFBA0A4}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{b872d222-3f52-4cd9-a4be-9d69ee4f293d}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.SettingsPlugin.1, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.SettingsPlugin, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.SettingsPlugin, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.SettingsPlugin.1, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{9638B7D6-11F5-4406-B387-327642A11FFB}, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\RadioRage_4jbar Uninstall Firefox, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\RadioRage_4j, Quarantined, [a3c4af1b6f0cfb3bbbc829d861a28779], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@RadioRage_4j.com/Plugin, Quarantined, [5a0de4e6601bfc3a7b07f30ed3306a96], 
PUP.Optional.MindSpark.A, HKU\S-1-5-21-2761505586-3091770874-1174253457-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\RadioRage_4j, Quarantined, [72f516b47902a78ff490f20f42c1d32d], 
PUP.Optional.MindSpark.A, HKU\S-1-5-21-2761505586-3091770874-1174253457-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\RadioRage_4j, Quarantined, [fb6c2aa0314a95a19454de1d7092b44c], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{ecef0d95-32fa-48d3-8a2d-d6453b5b7361}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{4a50e810-71eb-43a8-a665-19ed8ccd1630}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{3C8E293A-99C8-45E1-93A3-77DAB6BB7928}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6E1CC883-54EB-47D3-96BC-B586CB8C2BD9}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FA7B5E21-57B6-4527-8863-6221854EDAA6}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3C8E293A-99C8-45E1-93A3-77DAB6BB7928}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6E1CC883-54EB-47D3-96BC-B586CB8C2BD9}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FA7B5E21-57B6-4527-8863-6221854EDAA6}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{4a50e810-71eb-43a8-a665-19ed8ccd1630}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{e23760be-23a3-4cef-9304-66af079f53db}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{597494da-c59f-4edf-b2d1-ce137e2db9e4}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{516434A0-985D-4312-843C-C92B3E19FC2D}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{AC73709C-65EF-462E-A665-D893C2655BA3}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{516434A0-985D-4312-843C-C92B3E19FC2D}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{AC73709C-65EF-462E-A665-D893C2655BA3}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{597494da-c59f-4edf-b2d1-ce137e2db9e4}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.FeedManager.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.FeedManager, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.FeedManager, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.FeedManager.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{581C7D7D-F809-4E03-A631-74C069D5F04A}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.HTMLMenu.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.HTMLMenu, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.HTMLMenu, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.HTMLMenu.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{581C7D7D-F809-4E03-A631-74C069D5F04A}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{d740ad89-baf4-47d5-9b5e-343d30f07a7a}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{0978c5fa-83c0-4118-a54f-99dacceecb8c}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{2FDB59A0-4024-4CED-94CF-B01E217DE4E5}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{EE54BA06-C150-4BF3-B3F3-D156767FBA12}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{2FDB59A0-4024-4CED-94CF-B01E217DE4E5}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{EE54BA06-C150-4BF3-B3F3-D156767FBA12}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{0978c5fa-83c0-4118-a54f-99dacceecb8c}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{68122f44-3a4a-4edb-b28f-0c0e07f89bd0}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{4dd9eb5d-8657-4856-a804-535841b09d73}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A93A372A-0AD5-4939-A228-7F4152124EA6}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B47151A4-CF8B-4481-A41A-BCF127431C01}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A93A372A-0AD5-4939-A228-7F4152124EA6}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{B47151A4-CF8B-4481-A41A-BCF127431C01}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{4dd9eb5d-8657-4856-a804-535841b09d73}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.HTMLPanel.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.HTMLPanel, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.HTMLPanel, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.HTMLPanel.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{68122F44-3A4A-4EDB-B28F-0C0E07F89BD0}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{f69fe1be-09c3-460c-ac89-8ccd9d3df1cc}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.MultipleButton.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.MultipleButton, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.MultipleButton, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.MultipleButton.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{00a2b7c6-7487-4b99-9f6c-1fdf57fe130b}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.Radio.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.Radio, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.Radio, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.Radio.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{dfeb941c-8b58-4899-97c3-88fe394e1285}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{1ed65be2-ae84-46cb-8ea6-1c2b86adf768}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B6395E0E-3DB2-40F8-94D8-DA605C52BCA5}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{B6395E0E-3DB2-40F8-94D8-DA605C52BCA5}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{1ed65be2-ae84-46cb-8ea6-1c2b86adf768}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.RadioSettings.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.RadioSettings, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.RadioSettings, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.RadioSettings.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11d4b723-18ca-48c6-ba13-965488f19a70}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.ScriptButton.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.ScriptButton, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.ScriptButton, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.ScriptButton.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{53855564-cf81-410c-9c1c-321c7e067816}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{1fdad7f1-b87c-4e79-9150-de235ff80b3a}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{30AE6757-B1D4-4CD5-8FEC-A9B6A545EF64}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{367DFE4B-7078-41FE-B1DD-6A6318C7DFF9}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A126B97A-C84F-40EE-B9D0-1276892A879E}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{D4C6D911-00C3-4B4C-A13B-F1DC381CB8E9}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{30AE6757-B1D4-4CD5-8FEC-A9B6A545EF64}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{367DFE4B-7078-41FE-B1DD-6A6318C7DFF9}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A126B97A-C84F-40EE-B9D0-1276892A879E}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D4C6D911-00C3-4B4C-A13B-F1DC381CB8E9}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{1fdad7f1-b87c-4e79-9150-de235ff80b3a}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{53855564-CF81-410C-9C1C-321C7E067816}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{e6ad866f-ea06-476a-8432-ed943683fab1}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{f706e19b-6c14-4272-ba98-2f16636a898d}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.PseudoTransparentPlugin.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.PseudoTransparentPlugin, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.PseudoTransparentPlugin, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.PseudoTransparentPlugin.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{F706E19B-6C14-4272-BA98-2F16636A898D}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{60b34f47-3fdd-46f8-ab6c-aaabea55c3d6}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{569a9014-22e3-4f11-a243-ca4e3d95aded}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{38C1B7DA-9876-4DEA-B740-19C4F57CE8E8}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{65267FD2-5B4E-48F7-A918-8E2697AEBB39}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{38C1B7DA-9876-4DEA-B740-19C4F57CE8E8}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{65267FD2-5B4E-48F7-A918-8E2697AEBB39}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{569a9014-22e3-4f11-a243-ca4e3d95aded}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.ThirdPartyInstaller.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\RadioRage_4j.ThirdPartyInstaller, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.ThirdPartyInstaller, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\RadioRage_4j.ThirdPartyInstaller.1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{60B34F47-3FDD-46F8-AB6C-AAABEA55C3D6}, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 

Registry Values: 1
PUP.Optional.MindSpark, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|RadioRage Home Page Guard 64 bit, "C:\PROGRA~2\RADIOR~1\bar\1.bin\AppIntegrator64.exe", Quarantined, [ed7ae8e2017a4aece129fbb5936efc04]

Registry Data: 0
(No malicious items detected)

Folders: 18
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\chrome, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\META-INF, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\plugins, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\chrome, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\ThirdPartyInstallers, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\assists, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\gen1, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\IE9Mesg, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\Message, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\Settings, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\LocalLow\RadioRage_4j, Quarantined, [a0c725a56e0d66d0632ad3fca35f25db], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\LocalLow\RadioRage_4j\bar, Quarantined, [a0c725a56e0d66d0632ad3fca35f25db], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\LocalLow\RadioRage_4j\bar\Settings, Quarantined, [a0c725a56e0d66d0632ad3fca35f25db], 

Files: 70
PUP.Optional.AudioToAudioToolBar.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbarsvc.exe, Delete-on-Reboot, [bea9dfeb92e9d26417cd5dd89769c937], 
PUP.Optional.MindSpark, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe, Delete-on-Reboot, [ed7ae8e2017a4aece129fbb5936efc04], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbar.dll, Quarantined, [184fe9e1cdaec670bd7d81f3f80a0ef2], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\bootstrap.js, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\chrome.manifest, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\install.rdf, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\install_no_bootstrap.rdf, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\chrome\4jffxtbr.jar, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\META-INF\manifest.mf, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\META-INF\zigbert.rsa, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\META-INF\zigbert.sf, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\extensions\4jffxtbr@RadioRage_4j.com\plugins\NativeMessagingDispatcher.dll, Quarantined, [98cf606a295290a6f768fccc2ed4b947], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jmedint.exe, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jauxstb64.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbrmon64.exe, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbrstub64.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jdatact.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jdlghk64.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jfeedmg.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jhighin.exe, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jhkstub.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jhtmlmu.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jhttpct.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jidle.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\BOOTSTRAP.JS, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\CHROME.MANIFEST, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\CREXT.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\CrExtP4j.exe, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\DPNMNGR.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\EXEMANAGER.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\FF-NativeMessagingDispatcher.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\Hpg64.dll, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\INSTALL.RDF, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\installKeys.js, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\LOGO.BMP, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\T8EPMSUP.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\T8EXTEX.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\T8EXTPEX.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\T8HTML.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\T8RES.DLL, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\T8TICKER.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\TPIMANAGERCONSOLE.EXE, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\UNIFIEDLOGGING.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\VERIFY.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jmlbtn.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jPlugin.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jradio.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jregfft.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jreghk.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jscript.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jskin.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jskplay.exe, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jSrchMn.exe, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jsrchmr.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jtpinst.dll, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\APPINTEGRATOR.EXE, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\APPINTEGRATORSTUB.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegratorStub64.dll, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\ASSISTMONITOR.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\ASSISTMONITOR64.DLL, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\chrome\4jffxtbr.jar, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL, Delete-on-Reboot, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\CONFIG.XML, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\gen1\COMMON.T8S, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\IE9Mesg\COMMON.T8S, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\Message\COMMON.T8S, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\RadioRage_4j\bar\Settings\s_pid.dat, Quarantined, [51168842dd9e8caa1d51bd0b8c7631cf], 

Physical Sectors: 0
(No malicious items detected)


(end)

Würde mich über Hilfe bei der Beseitigung des Trojaners freuen.

cosinus · 25.08.2014, 01:02

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Graves · 25.08.2014, 01:19

Hier die Farbar Logs:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-08-2014 03
Ran by Patrick (administrator) on KORL on 25-08-2014 02:12:11
Running from C:\Users\Patrick\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
( ) C:\Windows\System32\dlebcoms.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
() C:\Program Files (x86)\Dell P513w\dlebmon.exe
() C:\Program Files (x86)\Dell P513w\ezprint.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Alienware) C:\Program Files\Alienware\Command Center\ThermalController.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\mcuihost.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\HSSCP.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe
(McAfee, Inc.) C:\Program Files\mcafee\virusscan\mcods.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\Core\mchost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6419560 2011-11-21] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-21] (Realtek Semiconductor)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Command Center Controllers] => C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12616 2012-01-10] (Alienware)
HKLM\...\Run: [dlebmon.exe] => C:\Program Files (x86)\Dell P513w\dlebmon.exe [770728 2011-01-23] ()
HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Dell P513w\ezprint.exe [139944 2011-01-23] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe [286720 2011-10-12] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: J - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: L - L:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: M - M:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {150e5073-a655-11e1-8320-848f69f5061f} - L:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa4f25-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa4f31-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa5002-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {56a648b1-d2c0-11e2-a95b-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {72e9ebd9-36c8-11e2-94f1-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {a3d2c3d5-d521-11e2-82b1-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {b440c86f-0331-11e3-9331-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {b440c890-0331-11e3-9331-001e101f2500} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {cd76bc1b-f59b-11e1-b0e8-848f69f5061f} - F:\MMMTest.EXE
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {d11bc3dd-027d-11e3-8792-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {d11bc3ea-027d-11e3-8792-848f69f5061f} - F:\AutoRun.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.at/alienware
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x13474C457668CF01
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{39E523F5-5C41-45B9-8A58-04636E88BE9C}: [NameServer] 213.162.69.1 213.162.69.169
Tcpip\..\Interfaces\{5060D64D-462C-4C95-B2B1-B27E7E1C0731}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @live.heroesandgenerals.com/npretox -> C:\Program Files (x86)\Heroes & Generals\live\npretox-1.0.6.1\npretoxlive-1.0.6.1.dll (Reto-Moto ApS)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-08-25]
FF Extension: Adblock Edge - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-08-10]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2014-07-23]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2012-04-21]

Chrome: 
=======
CHR StartupUrls: "hxxp://www.google.com"
CHR Extension: (Docs) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-25]
CHR Extension: (Google Drive) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-25]
CHR Extension: (YouTube) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-25]
CHR Extension: (Google-Suche) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-25]
CHR Extension: (Google Wallet) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-25]
CHR Extension: (Google Mail) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 dlebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\dlebserv.exe [33448 2009-07-01] ()
R2 dleb_device; C:\Windows\system32\dlebcoms.exe [1052328 2010-05-21] ( )
R2 dleb_device; C:\Windows\SysWOW64\dlebcoms.exe [598696 2010-05-21] ( )
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] ()
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2013-08-28] (Hi-Rez Studios) [File not signed]
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [919040 2014-05-17] (AnchorFree Inc.) [File not signed]
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2014-05-17] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [430344 2014-05-17] ()
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe [7168 2011-10-12] (Intel Corporation) [File not signed]
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2013-08-11] ()
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\mcafee\msc\McAWFwk.exe [224704 2011-03-08] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [603424 2014-06-12] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-06-18] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-08-11] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2013-08-11] (Bytemobile, Inc.) [File not signed]
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2014-05-17] (AnchorFree Inc.)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [23832 2011-10-13] (Intel Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [444720 2014-06-18] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [96592 2014-06-18] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
R3 mio; C:\Windows\System32\DRIVERS\mio.sys [7680 2011-05-04] (Dell/Alienware)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [100352 2011-09-15] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [216064 2011-09-15] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2013-08-11] (Bytemobile, Inc.) [File not signed]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 MFE_RR; \??\C:\Users\Patrick\AppData\Local\Temp\mfe_rr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-25 02:12 - 2014-08-25 02:13 - 00019288 _____ () C:\Users\Patrick\Downloads\FRST.txt
2014-08-25 02:11 - 2014-08-25 02:12 - 00000000 ____D () C:\FRST
2014-08-25 02:11 - 2014-08-25 02:11 - 02103296 _____ (Farbar) C:\Users\Patrick\Downloads\FRST64.exe
2014-08-25 01:59 - 2014-08-25 01:59 - 00033528 _____ () C:\Users\Patrick\Desktop\Malwarebytes.txt
2014-08-25 01:53 - 2014-08-25 01:53 - 00033528 _____ () C:\Malwarebytes.txt
2014-08-25 01:52 - 2014-08-25 01:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-25 01:34 - 2014-08-25 01:34 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-25 01:34 - 2014-08-25 01:34 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-25 01:34 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-25 01:33 - 2014-08-25 01:34 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2014-08-25 01:33 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 01:08 - 2014-08-25 01:08 - 04813544 _____ (Piriform Ltd) C:\Users\Patrick\Downloads\ccsetup416.exe
2014-08-25 00:50 - 2014-08-25 01:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 00:50 - 2014-08-25 00:50 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-25 00:50 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-25 00:50 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-25 00:49 - 2014-08-25 00:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-21 01:15 - 2014-08-21 01:15 - 19890833 _____ () C:\Users\Patrick\Downloads\warframe.2.1.5.gadget
2014-08-15 02:49 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-15 02:49 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-15 02:49 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-15 02:49 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-15 02:49 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-15 02:49 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-15 02:48 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 02:48 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 23:43 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-14 23:43 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-14 23:43 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-14 23:43 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-14 23:43 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-14 23:43 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-14 23:43 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-14 23:43 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-14 23:43 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-14 23:43 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-14 23:43 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-14 23:42 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-14 23:42 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-14 23:42 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-14 23:42 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-14 23:42 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-14 23:42 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-14 23:42 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-14 23:42 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-14 23:42 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-14 23:42 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-14 23:42 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-14 23:42 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-14 23:42 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-14 23:42 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-14 23:42 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-14 23:42 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 11:55 - 2014-08-13 11:55 - 00000000 ____D () C:\Users\Patrick\Desktop\Papa Fotos Automesse
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\Documents\Stronghold Kingdoms
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Firefly Studios
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Geckofx
2014-08-10 19:52 - 2014-08-10 19:52 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00001981 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-08-10 19:45 - 2014-08-10 19:52 - 00000310 _____ () C:\Users\Patrick\Downloads\RootkitRemover_20140810_194541.log
2014-08-10 19:45 - 2014-08-10 19:45 - 00783120 _____ (McAfee, Inc.) C:\Users\Patrick\Downloads\rootkitremover.exe
2014-08-08 13:43 - 2014-08-08 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Targem
2014-08-07 10:39 - 2014-08-08 19:36 - 00000000 ____D () C:\Users\Patrick\Documents\BattleIslands
2014-08-03 15:46 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 15:46 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-03 15:46 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 15:46 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 15:46 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-03 15:46 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 15:46 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-03 15:46 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-03 15:46 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-31 13:01 - 2014-07-31 13:01 - 00000084 _____ () C:\Users\Patrick\Desktop\dsf.txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-25 02:13 - 2014-08-25 02:12 - 00019288 _____ () C:\Users\Patrick\Downloads\FRST.txt
2014-08-25 02:12 - 2014-08-25 02:11 - 00000000 ____D () C:\FRST
2014-08-25 02:11 - 2014-08-25 02:11 - 02103296 _____ (Farbar) C:\Users\Patrick\Downloads\FRST64.exe
2014-08-25 01:59 - 2014-08-25 01:59 - 00033528 _____ () C:\Users\Patrick\Desktop\Malwarebytes.txt
2014-08-25 01:57 - 2009-07-14 06:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-25 01:57 - 2009-07-14 06:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-25 01:55 - 2012-04-21 14:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-25 01:54 - 2010-11-21 08:50 - 03594328 _____ () C:\Windows\system32\perfh007.dat
2014-08-25 01:54 - 2010-11-21 08:50 - 01049190 _____ () C:\Windows\system32\perfc007.dat
2014-08-25 01:54 - 2009-07-14 07:13 - 00006474 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-25 01:53 - 2014-08-25 01:53 - 00033528 _____ () C:\Malwarebytes.txt
2014-08-25 01:53 - 2012-04-21 14:07 - 01711336 _____ () C:\Windows\WindowsUpdate.log
2014-08-25 01:52 - 2014-08-25 01:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-25 01:52 - 2014-08-25 00:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 01:49 - 2012-06-03 21:37 - 00123256 _____ () C:\ProgramData\dlebscan.log
2014-08-25 01:49 - 2010-11-21 05:47 - 00322330 _____ () C:\Windows\PFRO.log
2014-08-25 01:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-25 01:49 - 2009-07-14 06:51 - 00226887 _____ () C:\Windows\setupact.log
2014-08-25 01:34 - 2014-08-25 01:34 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-25 01:34 - 2014-08-25 01:34 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-25 01:34 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-25 01:34 - 2014-08-25 01:33 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2014-08-25 01:34 - 2014-08-25 01:33 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 01:27 - 2014-04-14 12:44 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Warframe
2014-08-25 01:14 - 2012-04-21 21:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-25 01:12 - 2009-07-14 06:45 - 00489048 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 01:08 - 2014-08-25 01:08 - 04813544 _____ (Piriform Ltd) C:\Users\Patrick\Downloads\ccsetup416.exe
2014-08-25 00:50 - 2014-08-25 00:50 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-25 00:49 - 2014-08-25 00:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-25 00:19 - 2013-12-04 21:50 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Battle.net
2014-08-25 00:19 - 2013-10-15 12:11 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Skype
2014-08-24 17:09 - 2013-12-04 21:50 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-24 14:00 - 2013-05-22 11:07 - 00003460 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-08-24 11:49 - 2013-02-12 18:11 - 00000000 ____D () C:\Users\Patrick\Documents\Outlook-Dateien
2014-08-21 01:15 - 2014-08-21 01:15 - 19890833 _____ () C:\Users\Patrick\Downloads\warframe.2.1.5.gadget
2014-08-19 15:48 - 2013-12-04 21:52 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-19 12:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-15 02:48 - 2014-05-07 03:04 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-14 19:49 - 2013-10-15 12:11 - 00000000 ____D () C:\ProgramData\Skype
2014-08-13 11:55 - 2014-08-13 11:55 - 00000000 ____D () C:\Users\Patrick\Desktop\Papa Fotos Automesse
2014-08-13 11:37 - 2012-05-01 09:00 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\PCDr
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\Documents\Stronghold Kingdoms
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Firefly Studios
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Geckofx
2014-08-11 18:44 - 2012-04-27 21:21 - 00281288 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-08-11 18:44 - 2012-04-27 21:21 - 00000000 ____D () C:\Users\Patrick\AppData\Local\PunkBuster
2014-08-11 18:44 - 2012-04-27 16:44 - 00281288 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-08-11 18:42 - 2012-04-27 16:44 - 00281872 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-08-11 18:41 - 2012-04-27 16:44 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-08-11 18:41 - 2012-04-21 14:30 - 00704003 _____ () C:\Windows\DirectX.log
2014-08-10 19:52 - 2014-08-10 19:52 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00001981 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-08-10 19:52 - 2014-08-10 19:45 - 00000310 _____ () C:\Users\Patrick\Downloads\RootkitRemover_20140810_194541.log
2014-08-10 19:52 - 2012-04-21 14:29 - 00000000 ____D () C:\ProgramData\Adobe
2014-08-10 19:45 - 2014-08-10 19:45 - 00783120 _____ (McAfee, Inc.) C:\Users\Patrick\Downloads\rootkitremover.exe
2014-08-09 16:37 - 2012-04-29 17:15 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-08-08 19:36 - 2014-08-07 10:39 - 00000000 ____D () C:\Users\Patrick\Documents\BattleIslands
2014-08-08 13:43 - 2014-08-08 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Targem
2014-08-08 13:43 - 2012-12-31 13:37 - 00000000 ____D () C:\Users\Patrick\Documents\my games
2014-08-07 04:06 - 2014-08-14 23:42 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-14 23:42 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-02 13:33 - 2012-09-29 15:15 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-07-31 13:01 - 2014-07-31 13:01 - 00000084 _____ () C:\Users\Patrick\Desktop\dsf.txt

Files to move or delete:
====================
C:\Users\Patrick\G2ADownloadHelper.exe


Some content of TEMP:
====================
C:\Users\Patrick\AppData\Local\Temp\24D57226C0D842ECBDEE6998183BACD8.exe
C:\Users\Patrick\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Patrick\AppData\Local\Temp\i4jdel0.exe
C:\Users\Patrick\AppData\Local\Temp\installerdll6693020.dll
C:\Users\Patrick\AppData\Local\Temp\installerdll6706607.dll
C:\Users\Patrick\AppData\Local\Temp\installerdll7310612.dll
C:\Users\Patrick\AppData\Local\Temp\jansi-32-1.8.dll
C:\Users\Patrick\AppData\Local\Temp\ResetDevice.exe
C:\Users\Patrick\AppData\Local\Temp\rootsupd.exe
C:\Users\Patrick\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Patrick\AppData\Local\Temp\sdapskill.exe
C:\Users\Patrick\AppData\Local\Temp\sdaspwn.exe
C:\Users\Patrick\AppData\Local\Temp\Setup.exe
C:\Users\Patrick\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Patrick\AppData\Local\Temp\sfextra.dll
C:\Users\Patrick\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Patrick\AppData\Local\Temp\sonarinst.exe
C:\Users\Patrick\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Patrick\AppData\Local\Temp\tmpA445.exe
C:\Users\Patrick\AppData\Local\Temp\tmpB0D4.exe
C:\Users\Patrick\AppData\Local\Temp\tmpB779.exe
C:\Users\Patrick\AppData\Local\Temp\tmpD086.exe
C:\Users\Patrick\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Patrick\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Patrick\AppData\Local\Temp\WindowsInstaller-KB893803-v2-x86.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-19 12:41

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-08-2014 03
Ran by Patrick at 2014-08-25 02:14:40
Running from C:\Users\Patrick\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

A1 Dashboard (HKLM-x32\...\A1 Dashboard) (Version:  - mobilkom austria AG)
A1 Dashboard (x32 Version: 1.8.0.151 - mobilkom austria AG) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version:  - )
AlienAutopsy (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
Alienware Command Center (HKLM-x32\...\InstallShield_{6A7D1CAC-6267-4C71-A759-CB5D9E9FAFAA}) (Version: 2.7.25.0 - Alienware Corp.)
Alienware Command Center (Version: 2.7.25.0 - Alienware Corp.) Hidden
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.10 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Anno 2070 (HKLM-x32\...\Steam App 48240) (Version:  - BlueByte)
APB Reloaded (HKLM-x32\...\Steam App 113400) (Version:  - Reloaded Productions)
Application Profiles (HKLM-x32\...\{63059735-CA97-FDFB-0E7A-3B8D81572EFD}) (Version: 2.0.4888.34279 - Advanced Micro Devices, Inc.)
Application Profiles (HKLM-x32\...\{D9D98127-FC22-6734-079B-F68E15BDCC8F}) (Version: 2.0.4629.34031 - Advanced Micro Devices, Inc.)
Application Profiles (HKLM-x32\...\{FC529949-EECA-2BF6-02AC-8041AD76B4B5}) (Version: 2.0.4602.34575 - Advanced Micro Devices, Inc.)
Baldur's Gate: Enhanced Edition (HKLM-x32\...\Steam App 228280) (Version:  - )
Bastion (HKLM-x32\...\Steam App 107100) (Version:  - Supergiant Games)
Battle Islands (HKLM-x32\...\Steam App 305260) (Version:  - DR Studios)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.0.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 1.118.0 - EA Digital Illusions CE AB)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version:  - Irrational Games)
Blood Bowl: Chaos Edition (HKLM-x32\...\Steam App 216890) (Version:  - Cyanide Studio)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
Chivalry: Medieval Warfare (HKLM-x32\...\Steam App 219640) (Version:  - Torn Banner Studios)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 33.1.0.0 - COMODO)
Company of Heroes (HKLM-x32\...\Steam App 4560) (Version:  - Relic)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version:  - Paradox Development Studio)
Das Testament des Sherlock Holmes (HKLM-x32\...\{38A96559-FF39-4089-A609-BFD76C4A6C07}_is1) (Version: 1.00.0777 - Focus Home Interactive)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version:  - Stunlock Studios)
Dead State (HKLM-x32\...\Steam App 239840) (Version:  - DoubleBear Productions)
Defiance (HKLM-x32\...\Steam App 224600) (Version:  - Trion Worlds, Inc.)
Dell P513w (HKLM\...\Dell P513w) (Version:  - Dell, Inc.)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
Divine Divinity (HKLM-x32\...\Steam App 214170) (Version:  - Larian Studios)
Divinity Original Sin (HKLM-x32\...\Steam App 230230) (Version:  - Larian Studios)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Duel of Champions (HKCU\...\MMDoC-PDCLive) (Version:  - Ubisoft)
Duel of Champions (HKLM-x32\...\MMDoC-PDCLive) (Version:  - Ubisoft)
Earth 2150 Trilogy (HKLM-x32\...\Steam App 253880) (Version:  - Reality Pump Studios)
Earth 2150: Lost Souls (HKLM-x32\...\Steam App 259300) (Version:  - )
Earth 2150: The Moon Project (HKLM-x32\...\Steam App 259280) (Version:  - )
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
EVE Online (HKLM-x32\...\Steam App 8500) (Version:  - CCP)
Expeditions: Conquistador (HKLM-x32\...\Steam App 237430) (Version:  - Logic Artists)
Fallout (HKLM-x32\...\Steam App 38400) (Version:  - Black Isle Studios)
Fallout 2 (HKLM-x32\...\Steam App 38410) (Version:  - Black Isle Studios)
Firefall (HKLM-x32\...\{CFEF8DB5-B45E-4b05-90BE-D02AA6F45354}) (Version:  - Red 5 Studios)
FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version:  - Subset Games)
GameSpy Arcade (HKLM-x32\...\GameSpy Arcade) (Version:  - )
Gnomoria (HKLM-x32\...\Steam App 224500) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Heroes & Generals (HKLM-x32\...\Heroes & Generals) (Version: 1.0.6.1 - Reto-Moto)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Hotspot Shield 3.42 (HKLM-x32\...\HotspotShield) (Version: 3.42 - AnchorFree Inc.)
InfiniteCrisis_410193F41CAE (HKLM-x32\...\InfiniteCrisis_410193F41CAE) (Version:  - Turbine, Inc)
Intel(R) Rapid Storage Technology enterprise (HKLM-x32\...\{8B313BF5-9BD5-42a3-94C1-A28AF3AA51CC}) (Version: 3.0.0.2003 - Intel Corporation)
Internet Manager (HKLM-x32\...\Internet Manager) (Version: 22.001.18.43.55 - Huawei Technologies Co.,Ltd)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee SecurityCenter (HKLM-x32\...\MSC) (Version: 12.8.958 - McAfee, Inc.)
MechWarrior Online (HKLM-x32\...\{73bcb521-8936-42d7-ad00-ec2bb399e26c}) (Version: 1.4.3.0 - Piranha Games Inc.)
MechWarrior Online (x32 Version: 1.4.3.0 - Piranha Games Inc.) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{3bcf8c72-b231-4d28-9f39-3405c22d8b5a}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Might & Magic Heroes VI - Shades of Darkness (HKLM-x32\...\{745D37C2-26F4-4B65-BA13-F9840EBFA75B}) (Version: 2.1.0 - Ubisoft)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Neverwinter (HKLM-x32\...\Neverwinter) (Version:  - Cryptic Studios)
Neverwinter (HKLM-x32\...\Steam App 109600) (Version:  - Cryptic Studios)
NVIDIA PhysX (HKLM-x32\...\{64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}) (Version: 9.12.0613 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 8.5.2.23 - Electronic Arts, Inc.)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Overwolf (HKLM-x32\...\{030F4BB3-F3C3-4A74-905C-44672D1ECB76}) (Version: 0.47.284 - Overwolf)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Path of Exile (HKLM-x32\...\Steam App 238960) (Version:  - Grinding Gear Games)
PFPortChecker 1.0.40 (HKLM-x32\...\PFPortChecker) (Version: 1.0.40 - Portforward.com)
PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
PingPlotter Standard 3.42.3s (HKLM-x32\...\{1C1D0A2C-C8B4-4C2C-9877-884F8FC082B5}) (Version: 3.42.3.6 - Nessoft, LLC)
Plague Inc: Evolved (HKLM-x32\...\Steam App 246620) (Version:  - Ndemic Creations)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
Portal (HKLM-x32\...\Steam App 400) (Version:  - Valve)
Prison Architect (HKLM-x32\...\Steam App 233450) (Version:  - Introversion Software)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Razer Imperator (HKLM-x32\...\{C05905B9-775A-4894-A4DF-B57C15250958}) (Version: 2.02.00 - Razer USA Ltd.)
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.11.3 - Razer Inc.)
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6505 - Realtek Semiconductor Corp.)
RIFT (HKCU\...\RIFT) (Version:  - Trion Worlds, Inc.)
Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden
Roxio BackOnTrack (x32 Version: 1.3.3 - Roxio) Hidden
Roxio Burn (x32 Version: 1.8 - Roxio) Hidden
Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
Roxio Creator Starter (x32 Version: 1.0.439 - Roxio) Hidden
Roxio Creator Starter (x32 Version: 5.0.0 - Roxio) Hidden
Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden
Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
Royal Quest (HKLM-x32\...\Steam App 295550) (Version:  - Katauri)
RPG Maker VX Ace (HKLM-x32\...\Steam App 220700) (Version:  - Enterbrain)
Sam & Max 101: Culture Shock (HKLM-x32\...\Steam App 8200) (Version:  - Telltale Games)
Sam & Max 102: Situation: Comedy (HKLM-x32\...\Steam App 8210) (Version:  - Telltale Games)
Sam & Max 103: The Mole, the Mob and the Meatball (HKLM-x32\...\Steam App 8220) (Version:  - Telltale Games)
Sam & Max 104: Abe Lincoln Must Die! (HKLM-x32\...\Steam App 8230) (Version:  - Telltale Games)
Sang-Froid - Tales of Werewolves (HKLM-x32\...\Steam App 227220) (Version:  - )
Scrolls (HKLM-x32\...\Scrolls 1.0.0) (Version: 1.0.0 - Mojang)
Scrolls (x32 Version: 1.0.0 - Mojang) Hidden
Shadowrun Returns (HKLM-x32\...\Steam App 234650) (Version:  - Harebrained Schemes)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 0.1.1774.1 - Hi-Rez Studios)
Solar 2 (HKLM-x32\...\Steam App 97000) (Version:  - Murudai)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
Space Pirates and Zombies (HKLM-x32\...\Steam App 107200) (Version:  - MinMax Games Ltd.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Star Conflict (HKLM-x32\...\Steam App 212070) (Version:  - Star Gem Inc.)
Starbound (HKLM-x32\...\Steam App 211820) (Version:  - )
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
StealthBot 2.7 (HKLM-x32\...\{C05DEB30-501D-4106-958D-C5E147D2BF7E}) (Version: 2.7.0.0 - StealthBot)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold 3 (HKLM-x32\...\Steam App 47400) (Version:  - FireFly Studios)
Stronghold HD (HKLM-x32\...\Steam App 40950) (Version:  - FireFly Studios)
Stronghold Kingdoms (HKLM-x32\...\Steam App 47410) (Version:  - FireFly Studios)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)
The Banner Saga: Factions (HKLM-x32\...\Steam App 219340) (Version:  - )
The Elder Scrolls Online (HKLM-x32\...\The Elder Scrolls Online) (Version: 1.0.0.0 - Zenimax Online Studios)
The Elder Scrolls Online Beta (HKLM-x32\...\The Elder Scrolls Online Beta_is1) (Version: 0.3.4 - )
The Expendabros (HKLM-x32\...\Steam App 312990) (Version:  - Free Lives)
The Incredible Adventures of Van Helsing (HKLM-x32\...\Steam App 215530) (Version:  - )
The Raven - Legacy of a Master Thief (HKLM-x32\...\Steam App 233370) (Version:  - KING Art)
The Walking Dead (HKLM-x32\...\Steam App 207610) (Version:  - )
The Walking Dead: Season Two (HKLM-x32\...\Steam App 261030) (Version:  - Telltale Games)
Tibia (HKLM-x32\...\Tibia_is1) (Version: 10.32 - CipSoft GmbH)
Titan Quest (HKLM-x32\...\Steam App 4540) (Version:  - Iron Lore Entertainment)
Titan Quest: Immortal Throne (HKLM-x32\...\Steam App 4550) (Version:  - Iron Lore Entertainment)
Torchlight (HKLM-x32\...\Steam App 41500) (Version:  - Runic Games, Inc.)
Torchlight II (HKLM-x32\...\Steam App 200710) (Version:  - )
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version:  - The Creative Assembly)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Wanderlust: Rebirth (HKLM-x32\...\Steam App 211580) (Version:  - Yeti Trunk)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
Warframe (HKLM-x32\...\Steam App 230410) (Version:  - Digital Extremes)
Warhammer® 40,000™: Dawn of War® II - Chaos Rising™ (HKLM-x32\...\Steam App 20570) (Version:  - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II – Retribution™ (HKLM-x32\...\Steam App 56400) (Version:  - Relic Entertainment)
Wasteland 2 (HKLM-x32\...\Steam App 240760) (Version:  - inXile Entertainment)
WildStar (HKLM-x32\...\WildStar) (Version:  - NCSOFT)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)
World of Warplanes (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C813EU}_is1) (Version:  - Wargaming.net)
XCOM: Enemy Unknown (HKLM-x32\...\Steam App 200510) (Version:  - Firaxis Games)
Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

21-08-2014 12:44:11 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-07-15 18:15 - 00000722 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {10A97BDC-8519-4A58-8BDF-43C80683F0D7} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {314B2213-59C8-4A0A-BE9A-991608563B9A} - System32\Tasks\{1A7FB380-0256-4EF6-9232-072331989A0E} => Firefox.exe hxxp://ui.skype.com/ui/0/6.16.0.105/de/abandoninstall?page=tsBing
Task: {54264A92-E61C-489B-B4CB-1F35FB5C9B64} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {7B7FC38D-081E-405B-8F97-56BBADFFA30A} - System32\Tasks\{4AAB5917-90B7-4A96-B6CA-C01F71C3A78D} => Firefox.exe hxxp://ui.skype.com/ui/0/6.16.0.105/de/abandoninstall?page=tsProgressBar
Task: {95B6A2E2-D1B7-414E-A03B-F8666D0E91E0} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\AlienAutopsy\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {D340E894-286B-4427-AFE9-55C0F9651D64} - System32\Tasks\{3FBE2A1A-22AC-4E44-BAA3-AA775A246DAE} => Firefox.exe hxxp://ui.skype.com/ui/0/6.9.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsBing
Task: {E590141D-A139-4665-A1C5-101F46A6B81D} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\AlienAutopsy\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {F77C39CF-76D1-4853-964C-282ADDC2E2EC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-06-03 21:41 - 2009-06-19 09:01 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\dlebdrpp.dll
2014-05-21 12:22 - 2014-05-21 12:22 - 02135232 _____ () C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
2014-05-17 00:34 - 2014-05-17 00:34 - 00430344 _____ () C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2013-08-11 15:04 - 2013-08-11 15:03 - 00224096 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
2012-04-27 16:44 - 2014-08-11 18:41 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2012-06-03 21:54 - 2011-01-23 19:37 - 00770728 _____ () C:\Program Files (x86)\Dell P513w\dlebmon.exe
2012-06-03 21:54 - 2011-01-23 19:37 - 00139944 _____ () C:\Program Files (x86)\Dell P513w\ezprint.exe
2014-05-17 02:11 - 2014-05-17 02:11 - 00908584 _____ () C:\Program Files (x86)\Hotspot Shield\bin\af_proxy.dll
2014-05-17 02:37 - 2014-05-17 02:37 - 00506664 _____ () C:\Program Files (x86)\Hotspot Shield\bin\HssRep.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 02415104 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll
2012-06-03 21:54 - 2009-11-26 03:50 - 00086183 _____ () C:\Program Files (x86)\Dell P513w\dlebcfg.dll
2012-06-03 21:54 - 2010-04-01 12:23 - 00389120 _____ () C:\Program Files (x86)\Dell P513w\dlebscw.dll
2012-06-03 21:54 - 2009-05-27 07:16 - 00192512 _____ () C:\Program Files (x86)\Dell P513w\dlebdatr.dll
2012-06-03 21:54 - 2010-04-01 12:24 - 01159168 _____ () C:\Program Files (x86)\Dell P513w\dlebDRS.dll
2012-06-03 21:54 - 2009-03-10 00:43 - 00155648 _____ () C:\Program Files (x86)\Dell P513w\dlebcaps.dll
2012-06-03 21:54 - 2009-03-05 12:55 - 00059904 _____ () C:\Program Files (x86)\Dell P513w\dlebcnv4.dll
2009-02-12 11:33 - 2009-02-12 11:33 - 00381952 _____ () C:\Windows\system32\dlebsm.dll
2009-04-28 07:57 - 2009-04-28 07:57 - 00032768 _____ () C:\Windows\system32\dlebsmr.dll
2012-06-03 21:54 - 2009-03-30 07:40 - 00708608 _____ () C:\Program Files (x86)\Dell P513w\Epwizard.DLL
2012-06-03 21:54 - 2009-03-30 07:38 - 00159744 _____ () C:\Program Files (x86)\Dell P513w\customui.dll
2012-06-03 21:54 - 2009-03-30 07:38 - 00114688 _____ () C:\Program Files (x86)\Dell P513w\Eputil.DLL
2012-06-03 21:54 - 2009-03-30 07:37 - 00139264 _____ () C:\Program Files (x86)\Dell P513w\Imagutil.DLL
2012-06-03 21:54 - 2009-03-30 07:38 - 00061440 _____ () C:\Program Files (x86)\Dell P513w\Epfunct.DLL
2012-06-03 21:54 - 2009-06-23 06:11 - 02203648 _____ () C:\Program Files (x86)\Dell P513w\EPWizRes.dll
2012-06-03 21:54 - 2009-06-23 06:13 - 00045056 _____ () C:\Program Files (x86)\Dell P513w\epstring.dll
2012-06-03 21:54 - 2009-06-23 06:13 - 00221184 _____ () C:\Program Files (x86)\Dell P513w\EPOEMDll.dll
2012-06-03 21:54 - 2009-04-07 14:25 - 00409600 _____ () C:\Program Files (x86)\Dell P513w\iptk.dll
2012-06-03 21:54 - 2009-03-02 09:25 - 00151552 _____ () C:\Program Files (x86)\Dell P513w\dlebptp.dll
2014-07-23 01:21 - 2014-07-23 01:21 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-08-15 16:11 - 2014-08-15 16:11 - 00019968 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\PSIClient\c91f320f0076e92d919ff16ce35c2ae3\PSIClient.ni.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Desktop Disc Tool => "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
MSCONFIG\startupreg: Overwolf => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
MSCONFIG\startupreg: RadioRage EPM Support => "C:\PROGRA~2\RADIOR~1\bar\1.bin\4jmedint.exe" T8EPMSUP.DLL,S
MSCONFIG\startupreg: RadioRage Search Scope Monitor => "C:\PROGRA~2\RADIOR~1\bar\1.bin\4jsrchmn.exe" /m=2 /w /h
MSCONFIG\startupreg: Razer Imperator Driver => C:\Program Files (x86)\Razer\Imperator\RazerImperatorSysTray.exe
MSCONFIG\startupreg: Razer Synapse => "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
MSCONFIG\startupreg: RoxWatchTray => "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/25/2014 01:54:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (08/25/2014 01:54:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/25/2014 01:54:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/25/2014 01:50:22 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2014 01:30:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: hsswd.exe, Version: 0.0.0.0, Zeitstempel: 0x51087583
Name des fehlerhaften Moduls: hsswd.exe, Version: 0.0.0.0, Zeitstempel: 0x51087583
Ausnahmecode: 0x40000015
Fehleroffset: 0x0002e394
ID des fehlerhaften Prozesses: 0x814
Startzeit der fehlerhaften Anwendung: 0xhsswd.exe0
Pfad der fehlerhaften Anwendung: hsswd.exe1
Pfad des fehlerhaften Moduls: hsswd.exe2
Berichtskennung: hsswd.exe3

Error: (08/25/2014 01:17:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (08/25/2014 01:17:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/25/2014 01:17:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/25/2014 01:12:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2014 00:44:25 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm McUICnt.exe, Version 5.9.2.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 18c4

Startzeit: 01cfbfecd3536af3

Endzeit: 0

Anwendungspfad: C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe

Berichts-ID: 2e3256b1-2be0-11e4-b819-848f69f5061f


System errors:
=============
Error: (08/25/2014 01:49:51 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 01:49:51 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (08/25/2014 01:49:45 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "dlebCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 01:49:45 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst dlebCATSCustConnectService erreicht.

Error: (08/25/2014 01:30:47 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hotspot Shield Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/25/2014 01:12:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 01:12:03 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (08/25/2014 01:12:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "dlebCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 01:12:00 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst dlebCATSCustConnectService erreicht.

Error: (08/25/2014 00:30:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053


Microsoft Office Sessions:
=========================
Error: (08/25/2014 01:54:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (08/25/2014 01:54:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/25/2014 01:54:10 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/25/2014 01:50:22 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2014 01:30:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: hsswd.exe0.0.0.051087583hsswd.exe0.0.0.051087583400000150002e39481401cfbff0cfbc4659C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exeC:\Program Files (x86)\Hotspot Shield\bin\hsswd.exeac838705-2be6-11e4-a087-848f69f5061f

Error: (08/25/2014 01:17:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (08/25/2014 01:17:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/25/2014 01:17:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/25/2014 01:12:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2014 00:44:25 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: McUICnt.exe5.9.2.018c401cfbfecd3536af30C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe2e3256b1-2be0-11e4-b819-848f69f5061f


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3930K CPU @ 3.20GHz
Percentage of memory in use: 23%
Total physical RAM: 16336.19 MB
Available physical RAM: 12488.92 MB
Total Pagefile: 32670.56 MB
Available Pagefile: 28639.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1861.82 GB) (Free:1111.79 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:0.73 GB) (Free:0.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: C8E558F4)

Partition: GPT Partition Type.

==================== End Of Log ============================

Die Malwarebytes Log hab ich im OP ergänzt.

Zu deinen Fragen: Nein, der PC hat seit ich ihn habe (ca. 2 Jahre) keine Meldung gemacht. (Hab McAfee drauf seit ich ihn besitze).

Das Problem besteht seit: 25.08.2014 00:29:12 (McAfee Entdeckung)

cosinus · 25.08.2014, 01:24

Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Graves · 25.08.2014, 02:04

Einmal:

Code:

ATTFilter

# AdwCleaner v3.308 - Bericht erstellt am 25/08/2014 um 02:33:18
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Patrick - KORL
# Gestartet von : C:\Users\Patrick\Downloads\adwcleaner_3.308.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : hshld
[#] Dienst Gelöscht : hsstrayservice
Dienst Gelöscht : hsswd

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\hotspot shield
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hotspot shield
Ordner Gelöscht : C:\Program Files (x86)\hotspot shield
Ordner Gelöscht : C:\Users\Patrick\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Patrick\AppData\Local\Temp\hotspot shield
Ordner Gelöscht : C:\Users\Patrick\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Patrick\AppData\Roaming\hotspot shield
Datei Gelöscht : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\invalidprefs.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{065C1A21-97F8-45FB-A9F0-861B60FACEC8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3204358F-5904-46A6-841F-D6B5BE3EF4E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3AE67737-0E3E-44AA-AA5E-46A68BF017FF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3EE5B726-044A-48D2-AA7B-049BD9A0F62A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60FBBE03-57FF-49D8-B38E-053D3F489825}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6A5182F1-C0B8-42B8-96CC-7F329CD46913}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6C153418-8E4D-4FAF-AF27-5201E38463A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A26A2F05-AC4D-4A1E-9531-9125F7309B78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5D6240-7DF0-435D-9B9B-F8586A99DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F343045E-E20A-46E1-82D8-9962C43EFC9E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FBB360DC-CB6C-4D6A-808A-2C773151BFFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFD7DDAC-EC28-42A5-8D39-917B9078604B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5E5E0B49-1A81-4ACC-BD6B-FF5F4EFEF01A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}
Schlüssel Gelöscht : HKCU\Software\anchorfree
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\hotspotshield
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\hotspotshield

***** [ Browser ] *****

-\\ Internet Explorer v0.0.0.0


-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\ek4tzecj.default\prefs.js ]


-\\ Google Chrome v

[ Datei : C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [3397 octets] - [25/08/2014 02:31:09]
AdwCleaner[R1].txt - [3457 octets] - [25/08/2014 02:32:47]
AdwCleaner[S0].txt - [3279 octets] - [25/08/2014 02:33:18]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3339 octets] ##########

Zweimal:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Patrick on 25.08.2014 at  2:55:24,38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\hotspot shield"
Successfully deleted: [Folder] "C:\Users\Patrick\appdata\locallow\boost_interprocess"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.08.2014 at  3:00:27,92
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dreimal:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-08-2014 03
Ran by Patrick (administrator) on KORL on 25-08-2014 03:00:51
Running from C:\Users\Patrick\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
( ) C:\Windows\System32\dlebcoms.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Dell P513w\dlebmon.exe
() C:\Program Files (x86)\Dell P513w\ezprint.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6419560 2011-11-21] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-21] (Realtek Semiconductor)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Command Center Controllers] => C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12616 2012-01-10] (Alienware)
HKLM\...\Run: [dlebmon.exe] => C:\Program Files (x86)\Dell P513w\dlebmon.exe [770728 2011-01-23] ()
HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Dell P513w\ezprint.exe [139944 2011-01-23] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe [286720 2011-10-12] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: J - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: L - L:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: M - M:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {150e5073-a655-11e1-8320-848f69f5061f} - L:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa4f25-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa4f31-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa5002-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {56a648b1-d2c0-11e2-a95b-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {72e9ebd9-36c8-11e2-94f1-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {a3d2c3d5-d521-11e2-82b1-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {b440c86f-0331-11e3-9331-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {b440c890-0331-11e3-9331-001e101f2500} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {cd76bc1b-f59b-11e1-b0e8-848f69f5061f} - F:\MMMTest.EXE
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {d11bc3dd-027d-11e3-8792-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {d11bc3ea-027d-11e3-8792-848f69f5061f} - F:\AutoRun.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.at/alienware
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x13474C457668CF01
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{39E523F5-5C41-45B9-8A58-04636E88BE9C}: [NameServer] 213.162.69.1 213.162.69.169
Tcpip\..\Interfaces\{5060D64D-462C-4C95-B2B1-B27E7E1C0731}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\2gmv88bu.default-1408927290564
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @live.heroesandgenerals.com/npretox -> C:\Program Files (x86)\Heroes & Generals\live\npretox-1.0.6.1\npretoxlive-1.0.6.1.dll (Reto-Moto ApS)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2014-07-23]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2012-04-21]

Chrome: 
=======
CHR HomePage: 
CHR StartupUrls: "hxxp://www.google.com"
CHR Extension: (Docs) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-25]
CHR Extension: (Google Drive) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-25]
CHR Extension: (YouTube) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-25]
CHR Extension: (Google-Suche) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-25]
CHR Extension: (Google Wallet) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-25]
CHR Extension: (Google Mail) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 dlebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\dlebserv.exe [33448 2009-07-01] ()
R2 dleb_device; C:\Windows\system32\dlebcoms.exe [1052328 2010-05-21] ( )
R2 dleb_device; C:\Windows\SysWOW64\dlebcoms.exe [598696 2010-05-21] ( )
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] ()
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2013-08-28] (Hi-Rez Studios) [File not signed]
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe [7168 2011-10-12] (Intel Corporation) [File not signed]
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2013-08-11] ()
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\mcafee\msc\McAWFwk.exe [224704 2011-03-08] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [603424 2014-06-12] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-06-18] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-08-11] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2013-08-11] (Bytemobile, Inc.) [File not signed]
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2014-05-17] (AnchorFree Inc.)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [23832 2011-10-13] (Intel Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [444720 2014-06-18] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [96592 2014-06-18] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
R3 mio; C:\Windows\System32\DRIVERS\mio.sys [7680 2011-05-04] (Dell/Alienware)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [100352 2011-09-15] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [216064 2011-09-15] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2013-08-11] (Bytemobile, Inc.) [File not signed]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 MFE_RR; \??\C:\Users\Patrick\AppData\Local\Temp\mfe_rr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-25 03:00 - 2014-08-25 03:00 - 00018311 _____ () C:\Users\Patrick\Desktop\FRST.txt
2014-08-25 03:00 - 2014-08-25 03:00 - 00000982 _____ () C:\Users\Patrick\Desktop\JRT.txt
2014-08-25 02:55 - 2014-08-25 02:55 - 00000000 ____D () C:\Windows\ERUNT
2014-08-25 02:53 - 2014-08-25 02:53 - 01016261 _____ (Thisisu) C:\Users\Patrick\Downloads\JRT.exe
2014-08-25 02:50 - 2014-08-25 02:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-25 02:41 - 2014-08-25 02:41 - 00000000 ____D () C:\Users\Patrick\Desktop\Alte Firefox-Daten
2014-08-25 02:35 - 2014-08-25 02:35 - 00003423 _____ () C:\Users\Patrick\Desktop\AdwCleaner[S0].txt
2014-08-25 02:31 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-25 02:30 - 2014-08-25 02:33 - 00000000 ____D () C:\AdwCleaner
2014-08-25 02:29 - 2014-08-25 02:29 - 01364531 _____ () C:\Users\Patrick\Desktop\adwcleaner_3.308.exe
2014-08-25 02:11 - 2014-08-25 03:00 - 00000000 ____D () C:\FRST
2014-08-25 02:11 - 2014-08-25 02:11 - 02103296 _____ (Farbar) C:\Users\Patrick\Desktop\FRST64.exe
2014-08-25 01:59 - 2014-08-25 01:59 - 00033528 _____ () C:\Users\Patrick\Desktop\Malwarebytes.txt
2014-08-25 01:53 - 2014-08-25 01:53 - 00033528 _____ () C:\Malwarebytes.txt
2014-08-25 01:34 - 2014-08-25 01:34 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-25 01:34 - 2014-08-25 01:34 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-25 01:34 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-25 01:33 - 2014-08-25 01:34 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2014-08-25 01:33 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 01:08 - 2014-08-25 01:08 - 04813544 _____ (Piriform Ltd) C:\Users\Patrick\Downloads\ccsetup416.exe
2014-08-25 00:50 - 2014-08-25 01:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 00:50 - 2014-08-25 00:50 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-25 00:50 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-25 00:50 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-25 00:49 - 2014-08-25 00:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-21 01:15 - 2014-08-21 01:15 - 19890833 _____ () C:\Users\Patrick\Downloads\warframe.2.1.5.gadget
2014-08-15 02:49 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-15 02:49 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-15 02:49 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-15 02:49 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-15 02:49 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-15 02:49 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-15 02:48 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 02:48 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 23:43 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-14 23:43 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-14 23:43 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-14 23:43 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-14 23:43 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-14 23:43 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-14 23:43 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-14 23:43 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-14 23:43 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-14 23:43 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-14 23:43 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-14 23:42 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-14 23:42 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-14 23:42 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-14 23:42 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-14 23:42 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-14 23:42 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-14 23:42 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-14 23:42 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-14 23:42 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-14 23:42 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-14 23:42 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-14 23:42 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-14 23:42 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-14 23:42 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-14 23:42 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-14 23:42 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 11:55 - 2014-08-13 11:55 - 00000000 ____D () C:\Users\Patrick\Desktop\Papa Fotos Automesse
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\Documents\Stronghold Kingdoms
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Firefly Studios
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Geckofx
2014-08-10 19:52 - 2014-08-10 19:52 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00001981 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-08-10 19:45 - 2014-08-10 19:52 - 00000310 _____ () C:\Users\Patrick\Downloads\RootkitRemover_20140810_194541.log
2014-08-10 19:45 - 2014-08-10 19:45 - 00783120 _____ (McAfee, Inc.) C:\Users\Patrick\Downloads\rootkitremover.exe
2014-08-08 13:43 - 2014-08-08 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Targem
2014-08-07 10:39 - 2014-08-08 19:36 - 00000000 ____D () C:\Users\Patrick\Documents\BattleIslands
2014-08-03 15:46 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 15:46 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-03 15:46 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 15:46 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 15:46 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-03 15:46 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 15:46 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-03 15:46 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-03 15:46 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-31 13:01 - 2014-07-31 13:01 - 00000084 _____ () C:\Users\Patrick\Desktop\dsf.txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-25 03:01 - 2014-08-25 03:00 - 00018311 _____ () C:\Users\Patrick\Desktop\FRST.txt
2014-08-25 03:00 - 2014-08-25 03:00 - 00000982 _____ () C:\Users\Patrick\Desktop\JRT.txt
2014-08-25 03:00 - 2014-08-25 02:11 - 00000000 ____D () C:\FRST
2014-08-25 02:55 - 2014-08-25 02:55 - 00000000 ____D () C:\Windows\ERUNT
2014-08-25 02:55 - 2012-04-21 14:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-25 02:54 - 2009-07-14 06:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-25 02:54 - 2009-07-14 06:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-25 02:53 - 2014-08-25 02:53 - 01016261 _____ (Thisisu) C:\Users\Patrick\Downloads\JRT.exe
2014-08-25 02:51 - 2010-11-21 08:50 - 03623412 _____ () C:\Windows\system32\perfh007.dat
2014-08-25 02:51 - 2010-11-21 08:50 - 01058226 _____ () C:\Windows\system32\perfc007.dat
2014-08-25 02:51 - 2009-07-14 07:13 - 00006474 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-25 02:50 - 2014-08-25 02:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-25 02:46 - 2012-06-03 21:37 - 00123476 _____ () C:\ProgramData\dlebscan.log
2014-08-25 02:46 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-25 02:46 - 2009-07-14 06:51 - 00226999 _____ () C:\Windows\setupact.log
2014-08-25 02:45 - 2012-04-21 14:07 - 01724800 _____ () C:\Windows\WindowsUpdate.log
2014-08-25 02:41 - 2014-08-25 02:41 - 00000000 ____D () C:\Users\Patrick\Desktop\Alte Firefox-Daten
2014-08-25 02:40 - 2012-04-21 21:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-25 02:35 - 2014-08-25 02:35 - 00003423 _____ () C:\Users\Patrick\Desktop\AdwCleaner[S0].txt
2014-08-25 02:34 - 2010-11-21 05:47 - 00322640 _____ () C:\Windows\PFRO.log
2014-08-25 02:34 - 2009-07-14 06:45 - 00489048 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 02:33 - 2014-08-25 02:30 - 00000000 ____D () C:\AdwCleaner
2014-08-25 02:29 - 2014-08-25 02:29 - 01364531 _____ () C:\Users\Patrick\Desktop\adwcleaner_3.308.exe
2014-08-25 02:11 - 2014-08-25 02:11 - 02103296 _____ (Farbar) C:\Users\Patrick\Desktop\FRST64.exe
2014-08-25 01:59 - 2014-08-25 01:59 - 00033528 _____ () C:\Users\Patrick\Desktop\Malwarebytes.txt
2014-08-25 01:53 - 2014-08-25 01:53 - 00033528 _____ () C:\Malwarebytes.txt
2014-08-25 01:52 - 2014-08-25 00:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 01:34 - 2014-08-25 01:34 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-25 01:34 - 2014-08-25 01:34 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-25 01:34 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-25 01:34 - 2014-08-25 01:33 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2014-08-25 01:34 - 2014-08-25 01:33 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 01:27 - 2014-04-14 12:44 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Warframe
2014-08-25 01:08 - 2014-08-25 01:08 - 04813544 _____ (Piriform Ltd) C:\Users\Patrick\Downloads\ccsetup416.exe
2014-08-25 00:50 - 2014-08-25 00:50 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-25 00:49 - 2014-08-25 00:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-25 00:19 - 2013-12-04 21:50 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Battle.net
2014-08-25 00:19 - 2013-10-15 12:11 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Skype
2014-08-24 17:09 - 2013-12-04 21:50 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-24 14:00 - 2013-05-22 11:07 - 00003460 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-08-24 11:49 - 2013-02-12 18:11 - 00000000 ____D () C:\Users\Patrick\Documents\Outlook-Dateien
2014-08-21 01:15 - 2014-08-21 01:15 - 19890833 _____ () C:\Users\Patrick\Downloads\warframe.2.1.5.gadget
2014-08-19 15:48 - 2013-12-04 21:52 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-19 12:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-15 02:48 - 2014-05-07 03:04 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-14 19:49 - 2013-10-15 12:11 - 00000000 ____D () C:\ProgramData\Skype
2014-08-13 11:55 - 2014-08-13 11:55 - 00000000 ____D () C:\Users\Patrick\Desktop\Papa Fotos Automesse
2014-08-13 11:37 - 2012-05-01 09:00 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\PCDr
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\Documents\Stronghold Kingdoms
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Firefly Studios
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Geckofx
2014-08-11 18:44 - 2012-04-27 21:21 - 00281288 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-08-11 18:44 - 2012-04-27 21:21 - 00000000 ____D () C:\Users\Patrick\AppData\Local\PunkBuster
2014-08-11 18:44 - 2012-04-27 16:44 - 00281288 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-08-11 18:42 - 2012-04-27 16:44 - 00281872 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-08-11 18:41 - 2012-04-27 16:44 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-08-11 18:41 - 2012-04-21 14:30 - 00704003 _____ () C:\Windows\DirectX.log
2014-08-10 19:52 - 2014-08-10 19:52 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00001981 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-08-10 19:52 - 2014-08-10 19:45 - 00000310 _____ () C:\Users\Patrick\Downloads\RootkitRemover_20140810_194541.log
2014-08-10 19:52 - 2012-04-21 14:29 - 00000000 ____D () C:\ProgramData\Adobe
2014-08-10 19:45 - 2014-08-10 19:45 - 00783120 _____ (McAfee, Inc.) C:\Users\Patrick\Downloads\rootkitremover.exe
2014-08-09 16:37 - 2012-04-29 17:15 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-08-08 19:36 - 2014-08-07 10:39 - 00000000 ____D () C:\Users\Patrick\Documents\BattleIslands
2014-08-08 13:43 - 2014-08-08 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Targem
2014-08-08 13:43 - 2012-12-31 13:37 - 00000000 ____D () C:\Users\Patrick\Documents\my games
2014-08-07 04:06 - 2014-08-14 23:42 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-14 23:42 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-02 13:33 - 2012-09-29 15:15 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-07-31 13:01 - 2014-07-31 13:01 - 00000084 _____ () C:\Users\Patrick\Desktop\dsf.txt

Files to move or delete:
====================
C:\Users\Patrick\G2ADownloadHelper.exe


Some content of TEMP:
====================
C:\Users\Patrick\AppData\Local\Temp\24D57226C0D842ECBDEE6998183BACD8.exe
C:\Users\Patrick\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Patrick\AppData\Local\Temp\i4jdel0.exe
C:\Users\Patrick\AppData\Local\Temp\installerdll6693020.dll
C:\Users\Patrick\AppData\Local\Temp\installerdll6706607.dll
C:\Users\Patrick\AppData\Local\Temp\installerdll7310612.dll
C:\Users\Patrick\AppData\Local\Temp\jansi-32-1.8.dll
C:\Users\Patrick\AppData\Local\Temp\Quarantine.exe
C:\Users\Patrick\AppData\Local\Temp\ResetDevice.exe
C:\Users\Patrick\AppData\Local\Temp\rootsupd.exe
C:\Users\Patrick\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Patrick\AppData\Local\Temp\sdapskill.exe
C:\Users\Patrick\AppData\Local\Temp\sdaspwn.exe
C:\Users\Patrick\AppData\Local\Temp\Setup.exe
C:\Users\Patrick\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Patrick\AppData\Local\Temp\sfextra.dll
C:\Users\Patrick\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Patrick\AppData\Local\Temp\sonarinst.exe
C:\Users\Patrick\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Patrick\AppData\Local\Temp\tmpA445.exe
C:\Users\Patrick\AppData\Local\Temp\tmpB0D4.exe
C:\Users\Patrick\AppData\Local\Temp\tmpB779.exe
C:\Users\Patrick\AppData\Local\Temp\tmpD086.exe
C:\Users\Patrick\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Patrick\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Patrick\AppData\Local\Temp\WindowsInstaller-KB893803-v2-x86.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-19 12:41

==================== End Of Log ============================

--- --- ---

Alles wie gewünscht erledigt.

cosinus · 25.08.2014, 08:50

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

Graves · 25.08.2014, 10:14

Hier ist die neue Addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-08-2014 03
Ran by Patrick at 2014-08-25 11:12:22
Running from C:\Users\Patrick\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

A1 Dashboard (HKLM-x32\...\A1 Dashboard) (Version:  - mobilkom austria AG)
A1 Dashboard (x32 Version: 1.8.0.151 - mobilkom austria AG) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version:  - )
AlienAutopsy (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
Alienware Command Center (HKLM-x32\...\InstallShield_{6A7D1CAC-6267-4C71-A759-CB5D9E9FAFAA}) (Version: 2.7.25.0 - Alienware Corp.)
Alienware Command Center (Version: 2.7.25.0 - Alienware Corp.) Hidden
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.10 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Anno 2070 (HKLM-x32\...\Steam App 48240) (Version:  - BlueByte)
APB Reloaded (HKLM-x32\...\Steam App 113400) (Version:  - Reloaded Productions)
Application Profiles (HKLM-x32\...\{63059735-CA97-FDFB-0E7A-3B8D81572EFD}) (Version: 2.0.4888.34279 - Advanced Micro Devices, Inc.)
Application Profiles (HKLM-x32\...\{D9D98127-FC22-6734-079B-F68E15BDCC8F}) (Version: 2.0.4629.34031 - Advanced Micro Devices, Inc.)
Application Profiles (HKLM-x32\...\{FC529949-EECA-2BF6-02AC-8041AD76B4B5}) (Version: 2.0.4602.34575 - Advanced Micro Devices, Inc.)
Baldur's Gate: Enhanced Edition (HKLM-x32\...\Steam App 228280) (Version:  - )
Bastion (HKLM-x32\...\Steam App 107100) (Version:  - Supergiant Games)
Battle Islands (HKLM-x32\...\Steam App 305260) (Version:  - DR Studios)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.0.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 1.118.0 - EA Digital Illusions CE AB)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version:  - Irrational Games)
Blood Bowl: Chaos Edition (HKLM-x32\...\Steam App 216890) (Version:  - Cyanide Studio)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
Chivalry: Medieval Warfare (HKLM-x32\...\Steam App 219640) (Version:  - Torn Banner Studios)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 33.1.0.0 - COMODO)
Company of Heroes (HKLM-x32\...\Steam App 4560) (Version:  - Relic)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version:  - Paradox Development Studio)
Das Testament des Sherlock Holmes (HKLM-x32\...\{38A96559-FF39-4089-A609-BFD76C4A6C07}_is1) (Version: 1.00.0777 - Focus Home Interactive)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version:  - Stunlock Studios)
Dead State (HKLM-x32\...\Steam App 239840) (Version:  - DoubleBear Productions)
Defiance (HKLM-x32\...\Steam App 224600) (Version:  - Trion Worlds, Inc.)
Dell P513w (HKLM\...\Dell P513w) (Version:  - Dell, Inc.)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
Divine Divinity (HKLM-x32\...\Steam App 214170) (Version:  - Larian Studios)
Divinity Original Sin (HKLM-x32\...\Steam App 230230) (Version:  - Larian Studios)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Duel of Champions (HKCU\...\MMDoC-PDCLive) (Version:  - Ubisoft)
Duel of Champions (HKLM-x32\...\MMDoC-PDCLive) (Version:  - Ubisoft)
Earth 2150 Trilogy (HKLM-x32\...\Steam App 253880) (Version:  - Reality Pump Studios)
Earth 2150: Lost Souls (HKLM-x32\...\Steam App 259300) (Version:  - )
Earth 2150: The Moon Project (HKLM-x32\...\Steam App 259280) (Version:  - )
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
EVE Online (HKLM-x32\...\Steam App 8500) (Version:  - CCP)
Expeditions: Conquistador (HKLM-x32\...\Steam App 237430) (Version:  - Logic Artists)
Fallout (HKLM-x32\...\Steam App 38400) (Version:  - Black Isle Studios)
Fallout 2 (HKLM-x32\...\Steam App 38410) (Version:  - Black Isle Studios)
Firefall (HKLM-x32\...\{CFEF8DB5-B45E-4b05-90BE-D02AA6F45354}) (Version:  - Red 5 Studios)
FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version:  - Subset Games)
GameSpy Arcade (HKLM-x32\...\GameSpy Arcade) (Version:  - )
Gnomoria (HKLM-x32\...\Steam App 224500) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Heroes & Generals (HKLM-x32\...\Heroes & Generals) (Version: 1.0.6.1 - Reto-Moto)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
InfiniteCrisis_410193F41CAE (HKLM-x32\...\InfiniteCrisis_410193F41CAE) (Version:  - Turbine, Inc)
Intel(R) Rapid Storage Technology enterprise (HKLM-x32\...\{8B313BF5-9BD5-42a3-94C1-A28AF3AA51CC}) (Version: 3.0.0.2003 - Intel Corporation)
Internet Manager (HKLM-x32\...\Internet Manager) (Version: 22.001.18.43.55 - Huawei Technologies Co.,Ltd)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee SecurityCenter (HKLM-x32\...\MSC) (Version: 12.8.958 - McAfee, Inc.)
MechWarrior Online (HKLM-x32\...\{73bcb521-8936-42d7-ad00-ec2bb399e26c}) (Version: 1.4.3.0 - Piranha Games Inc.)
MechWarrior Online (x32 Version: 1.4.3.0 - Piranha Games Inc.) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{3bcf8c72-b231-4d28-9f39-3405c22d8b5a}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Might & Magic Heroes VI - Shades of Darkness (HKLM-x32\...\{745D37C2-26F4-4B65-BA13-F9840EBFA75B}) (Version: 2.1.0 - Ubisoft)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Neverwinter (HKLM-x32\...\Neverwinter) (Version:  - Cryptic Studios)
Neverwinter (HKLM-x32\...\Steam App 109600) (Version:  - Cryptic Studios)
NVIDIA PhysX (HKLM-x32\...\{64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}) (Version: 9.12.0613 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 8.5.2.23 - Electronic Arts, Inc.)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Overwolf (HKLM-x32\...\{030F4BB3-F3C3-4A74-905C-44672D1ECB76}) (Version: 0.47.284 - Overwolf)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Path of Exile (HKLM-x32\...\Steam App 238960) (Version:  - Grinding Gear Games)
PFPortChecker 1.0.40 (HKLM-x32\...\PFPortChecker) (Version: 1.0.40 - Portforward.com)
PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
PingPlotter Standard 3.42.3s (HKLM-x32\...\{1C1D0A2C-C8B4-4C2C-9877-884F8FC082B5}) (Version: 3.42.3.6 - Nessoft, LLC)
Plague Inc: Evolved (HKLM-x32\...\Steam App 246620) (Version:  - Ndemic Creations)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
Portal (HKLM-x32\...\Steam App 400) (Version:  - Valve)
Prison Architect (HKLM-x32\...\Steam App 233450) (Version:  - Introversion Software)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Razer Imperator (HKLM-x32\...\{C05905B9-775A-4894-A4DF-B57C15250958}) (Version: 2.02.00 - Razer USA Ltd.)
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.11.3 - Razer Inc.)
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6505 - Realtek Semiconductor Corp.)
RIFT (HKCU\...\RIFT) (Version:  - Trion Worlds, Inc.)
Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden
Roxio BackOnTrack (x32 Version: 1.3.3 - Roxio) Hidden
Roxio Burn (x32 Version: 1.8 - Roxio) Hidden
Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
Roxio Creator Starter (x32 Version: 1.0.439 - Roxio) Hidden
Roxio Creator Starter (x32 Version: 5.0.0 - Roxio) Hidden
Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden
Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
Royal Quest (HKLM-x32\...\Steam App 295550) (Version:  - Katauri)
RPG Maker VX Ace (HKLM-x32\...\Steam App 220700) (Version:  - Enterbrain)
Sam & Max 101: Culture Shock (HKLM-x32\...\Steam App 8200) (Version:  - Telltale Games)
Sam & Max 102: Situation: Comedy (HKLM-x32\...\Steam App 8210) (Version:  - Telltale Games)
Sam & Max 103: The Mole, the Mob and the Meatball (HKLM-x32\...\Steam App 8220) (Version:  - Telltale Games)
Sam & Max 104: Abe Lincoln Must Die! (HKLM-x32\...\Steam App 8230) (Version:  - Telltale Games)
Sang-Froid - Tales of Werewolves (HKLM-x32\...\Steam App 227220) (Version:  - )
Scrolls (HKLM-x32\...\Scrolls 1.0.0) (Version: 1.0.0 - Mojang)
Scrolls (x32 Version: 1.0.0 - Mojang) Hidden
Shadowrun Returns (HKLM-x32\...\Steam App 234650) (Version:  - Harebrained Schemes)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 0.1.1774.1 - Hi-Rez Studios)
Solar 2 (HKLM-x32\...\Steam App 97000) (Version:  - Murudai)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
Space Pirates and Zombies (HKLM-x32\...\Steam App 107200) (Version:  - MinMax Games Ltd.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Star Conflict (HKLM-x32\...\Steam App 212070) (Version:  - Star Gem Inc.)
Starbound (HKLM-x32\...\Steam App 211820) (Version:  - )
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
StealthBot 2.7 (HKLM-x32\...\{C05DEB30-501D-4106-958D-C5E147D2BF7E}) (Version: 2.7.0.0 - StealthBot)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold 3 (HKLM-x32\...\Steam App 47400) (Version:  - FireFly Studios)
Stronghold HD (HKLM-x32\...\Steam App 40950) (Version:  - FireFly Studios)
Stronghold Kingdoms (HKLM-x32\...\Steam App 47410) (Version:  - FireFly Studios)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)
The Banner Saga: Factions (HKLM-x32\...\Steam App 219340) (Version:  - )
The Elder Scrolls Online (HKLM-x32\...\The Elder Scrolls Online) (Version: 1.0.0.0 - Zenimax Online Studios)
The Elder Scrolls Online Beta (HKLM-x32\...\The Elder Scrolls Online Beta_is1) (Version: 0.3.4 - )
The Expendabros (HKLM-x32\...\Steam App 312990) (Version:  - Free Lives)
The Incredible Adventures of Van Helsing (HKLM-x32\...\Steam App 215530) (Version:  - )
The Raven - Legacy of a Master Thief (HKLM-x32\...\Steam App 233370) (Version:  - KING Art)
The Walking Dead (HKLM-x32\...\Steam App 207610) (Version:  - )
The Walking Dead: Season Two (HKLM-x32\...\Steam App 261030) (Version:  - Telltale Games)
Tibia (HKLM-x32\...\Tibia_is1) (Version: 10.32 - CipSoft GmbH)
Titan Quest (HKLM-x32\...\Steam App 4540) (Version:  - Iron Lore Entertainment)
Titan Quest: Immortal Throne (HKLM-x32\...\Steam App 4550) (Version:  - Iron Lore Entertainment)
Torchlight (HKLM-x32\...\Steam App 41500) (Version:  - Runic Games, Inc.)
Torchlight II (HKLM-x32\...\Steam App 200710) (Version:  - )
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version:  - The Creative Assembly)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Wanderlust: Rebirth (HKLM-x32\...\Steam App 211580) (Version:  - Yeti Trunk)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
Warframe (HKLM-x32\...\Steam App 230410) (Version:  - Digital Extremes)
Warhammer® 40,000™: Dawn of War® II - Chaos Rising™ (HKLM-x32\...\Steam App 20570) (Version:  - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II – Retribution™ (HKLM-x32\...\Steam App 56400) (Version:  - Relic Entertainment)
Wasteland 2 (HKLM-x32\...\Steam App 240760) (Version:  - inXile Entertainment)
WildStar (HKLM-x32\...\WildStar) (Version:  - NCSOFT)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)
World of Warplanes (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C813EU}_is1) (Version:  - Wargaming.net)
XCOM: Enemy Unknown (HKLM-x32\...\Steam App 200510) (Version:  - Firaxis Games)
Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

21-08-2014 12:44:11 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-07-15 18:15 - 00000722 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {10A97BDC-8519-4A58-8BDF-43C80683F0D7} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {314B2213-59C8-4A0A-BE9A-991608563B9A} - System32\Tasks\{1A7FB380-0256-4EF6-9232-072331989A0E} => Firefox.exe hxxp://ui.skype.com/ui/0/6.16.0.105/de/abandoninstall?page=tsBing
Task: {54264A92-E61C-489B-B4CB-1F35FB5C9B64} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {7B7FC38D-081E-405B-8F97-56BBADFFA30A} - System32\Tasks\{4AAB5917-90B7-4A96-B6CA-C01F71C3A78D} => Firefox.exe hxxp://ui.skype.com/ui/0/6.16.0.105/de/abandoninstall?page=tsProgressBar
Task: {95B6A2E2-D1B7-414E-A03B-F8666D0E91E0} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\AlienAutopsy\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {D340E894-286B-4427-AFE9-55C0F9651D64} - System32\Tasks\{3FBE2A1A-22AC-4E44-BAA3-AA775A246DAE} => Firefox.exe hxxp://ui.skype.com/ui/0/6.9.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsBing
Task: {E590141D-A139-4665-A1C5-101F46A6B81D} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\AlienAutopsy\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {F77C39CF-76D1-4853-964C-282ADDC2E2EC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-06-03 21:41 - 2009-06-19 09:01 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\dlebdrpp.dll
2014-05-21 12:22 - 2014-05-21 12:22 - 02135232 _____ () C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2013-08-11 15:04 - 2013-08-11 15:03 - 00224096 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
2012-04-27 16:44 - 2014-08-11 18:41 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2012-06-03 21:54 - 2011-01-23 19:37 - 00770728 _____ () C:\Program Files (x86)\Dell P513w\dlebmon.exe
2012-06-03 21:54 - 2011-01-23 19:37 - 00139944 _____ () C:\Program Files (x86)\Dell P513w\ezprint.exe
2013-08-11 15:04 - 2013-08-11 15:03 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 02415104 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll
2012-06-03 21:54 - 2009-11-26 03:50 - 00086183 _____ () C:\Program Files (x86)\Dell P513w\dlebcfg.dll
2012-06-03 21:54 - 2010-04-01 12:23 - 00389120 _____ () C:\Program Files (x86)\Dell P513w\dlebscw.dll
2012-06-03 21:54 - 2009-05-27 07:16 - 00192512 _____ () C:\Program Files (x86)\Dell P513w\dlebdatr.dll
2012-06-03 21:54 - 2010-04-01 12:24 - 01159168 _____ () C:\Program Files (x86)\Dell P513w\dlebDRS.dll
2012-06-03 21:54 - 2009-03-10 00:43 - 00155648 _____ () C:\Program Files (x86)\Dell P513w\dlebcaps.dll
2012-06-03 21:54 - 2009-03-05 12:55 - 00059904 _____ () C:\Program Files (x86)\Dell P513w\dlebcnv4.dll
2009-02-12 11:33 - 2009-02-12 11:33 - 00381952 _____ () C:\Windows\system32\dlebsm.dll
2009-04-28 07:57 - 2009-04-28 07:57 - 00032768 _____ () C:\Windows\system32\dlebsmr.dll
2012-06-03 21:54 - 2009-03-30 07:40 - 00708608 _____ () C:\Program Files (x86)\Dell P513w\Epwizard.DLL
2012-06-03 21:54 - 2009-03-30 07:38 - 00159744 _____ () C:\Program Files (x86)\Dell P513w\customui.dll
2012-06-03 21:54 - 2009-03-30 07:38 - 00114688 _____ () C:\Program Files (x86)\Dell P513w\Eputil.DLL
2012-06-03 21:54 - 2009-03-30 07:37 - 00139264 _____ () C:\Program Files (x86)\Dell P513w\Imagutil.DLL
2012-06-03 21:54 - 2009-03-30 07:38 - 00061440 _____ () C:\Program Files (x86)\Dell P513w\Epfunct.DLL
2012-06-03 21:54 - 2009-06-23 06:11 - 02203648 _____ () C:\Program Files (x86)\Dell P513w\EPWizRes.dll
2012-06-03 21:54 - 2009-06-23 06:13 - 00045056 _____ () C:\Program Files (x86)\Dell P513w\epstring.dll
2012-06-03 21:54 - 2009-06-23 06:13 - 00221184 _____ () C:\Program Files (x86)\Dell P513w\EPOEMDll.dll
2012-06-03 21:54 - 2009-04-07 14:25 - 00409600 _____ () C:\Program Files (x86)\Dell P513w\iptk.dll
2012-06-03 21:54 - 2009-03-02 09:25 - 00151552 _____ () C:\Program Files (x86)\Dell P513w\dlebptp.dll
2014-07-23 01:21 - 2014-07-23 01:21 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-08-15 16:11 - 2014-08-15 16:11 - 00019968 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\PSIClient\c91f320f0076e92d919ff16ce35c2ae3\PSIClient.ni.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Desktop Disc Tool => "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
MSCONFIG\startupreg: Overwolf => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
MSCONFIG\startupreg: RadioRage EPM Support => "C:\PROGRA~2\RADIOR~1\bar\1.bin\4jmedint.exe" T8EPMSUP.DLL,S
MSCONFIG\startupreg: RadioRage Search Scope Monitor => "C:\PROGRA~2\RADIOR~1\bar\1.bin\4jsrchmn.exe" /m=2 /w /h
MSCONFIG\startupreg: Razer Imperator Driver => C:\Program Files (x86)\Razer\Imperator\RazerImperatorSysTray.exe
MSCONFIG\startupreg: Razer Synapse => "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
MSCONFIG\startupreg: RoxWatchTray => "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/25/2014 11:09:48 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/25/2014 11:08:24 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 11:08:24 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (08/25/2014 11:08:20 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "dlebCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 11:08:20 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst dlebCATSCustConnectService erreicht.


Microsoft Office Sessions:
=========================
Error: (08/25/2014 11:09:48 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3930K CPU @ 3.20GHz
Percentage of memory in use: 19%
Total physical RAM: 16336.19 MB
Available physical RAM: 13088.62 MB
Total Pagefile: 32670.56 MB
Available Pagefile: 29183.24 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1861.82 GB) (Free:1111.59 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:0.73 GB) (Free:0.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: C8E558F4)

Partition: GPT Partition Type.

==================== End Of Log ============================

cosinus · 25.08.2014, 10:25

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
FF NetworkProxy: "type", 4
FF Plugin: @microsoft.com/GENUINE -> disabled No File
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 MFE_RR; \??\C:\Users\Patrick\AppData\Local\Temp\mfe_rr.sys [X]
C:\Users\Patrick\G2ADownloadHelper.exe
C:\Users\Patrick\AppData\Local\Temp\24D57226C0D842ECBDEE6998183BACD8.exe
C:\Users\Patrick\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Patrick\AppData\Local\Temp\i4jdel0.exe
C:\Users\Patrick\AppData\Local\Temp\installerdll6693020.dll
C:\Users\Patrick\AppData\Local\Temp\installerdll6706607.dll
C:\Users\Patrick\AppData\Local\Temp\installerdll7310612.dll
C:\Users\Patrick\AppData\Local\Temp\jansi-32-1.8.dll
C:\Users\Patrick\AppData\Local\Temp\Quarantine.exe
C:\Users\Patrick\AppData\Local\Temp\ResetDevice.exe
C:\Users\Patrick\AppData\Local\Temp\rootsupd.exe
C:\Users\Patrick\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Patrick\AppData\Local\Temp\sdapskill.exe
C:\Users\Patrick\AppData\Local\Temp\sdaspwn.exe
C:\Users\Patrick\AppData\Local\Temp\Setup.exe
C:\Users\Patrick\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Patrick\AppData\Local\Temp\sfextra.dll
C:\Users\Patrick\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Patrick\AppData\Local\Temp\sonarinst.exe
C:\Users\Patrick\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Patrick\AppData\Local\Temp\tmpA445.exe
C:\Users\Patrick\AppData\Local\Temp\tmpB0D4.exe
C:\Users\Patrick\AppData\Local\Temp\tmpB779.exe
C:\Users\Patrick\AppData\Local\Temp\tmpD086.exe
C:\Users\Patrick\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Patrick\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Patrick\AppData\Local\Temp\WindowsInstaller-KB893803-v2-x86.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Graves · 25.08.2014, 10:33

Hier die Fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-08-2014 03
Ran by Patrick at 2014-08-25 11:31:25 Run:1
Running from C:\Users\Patrick\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
FF NetworkProxy: "type", 4
FF Plugin: @microsoft.com/GENUINE -> disabled No File
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 MFE_RR; \??\C:\Users\Patrick\AppData\Local\Temp\mfe_rr.sys [X]
C:\Users\Patrick\G2ADownloadHelper.exe
C:\Users\Patrick\AppData\Local\Temp\24D57226C0D842ECBDEE6998183BACD8.exe
C:\Users\Patrick\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Patrick\AppData\Local\Temp\i4jdel0.exe
C:\Users\Patrick\AppData\Local\Temp\installerdll6693020.dll
C:\Users\Patrick\AppData\Local\Temp\installerdll6706607.dll
C:\Users\Patrick\AppData\Local\Temp\installerdll7310612.dll
C:\Users\Patrick\AppData\Local\Temp\jansi-32-1.8.dll
C:\Users\Patrick\AppData\Local\Temp\Quarantine.exe
C:\Users\Patrick\AppData\Local\Temp\ResetDevice.exe
C:\Users\Patrick\AppData\Local\Temp\rootsupd.exe
C:\Users\Patrick\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Patrick\AppData\Local\Temp\sdapskill.exe
C:\Users\Patrick\AppData\Local\Temp\sdaspwn.exe
C:\Users\Patrick\AppData\Local\Temp\Setup.exe
C:\Users\Patrick\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Patrick\AppData\Local\Temp\sfextra.dll
C:\Users\Patrick\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Patrick\AppData\Local\Temp\sonarinst.exe
C:\Users\Patrick\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Patrick\AppData\Local\Temp\tmpA445.exe
C:\Users\Patrick\AppData\Local\Temp\tmpB0D4.exe
C:\Users\Patrick\AppData\Local\Temp\tmpB779.exe
C:\Users\Patrick\AppData\Local\Temp\tmpD086.exe
C:\Users\Patrick\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Patrick\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Patrick\AppData\Local\Temp\WindowsInstaller-KB893803-v2-x86.exe
         
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
Firefox Proxy settings were reset.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
ewusbnet => Service deleted successfully.
hwusbdev => Service deleted successfully.
MFE_RR => Service deleted successfully.
C:\Users\Patrick\G2ADownloadHelper.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\24D57226C0D842ECBDEE6998183BACD8.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\DataCard_Setup64.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\i4jdel0.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\installerdll6693020.dll => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\installerdll6706607.dll => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\installerdll7310612.dll => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\jansi-32-1.8.dll => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\ResetDevice.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\rootsupd.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\sdanircmdc.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\sdapskill.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\sdaspwn.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\Setup.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\sfamcc00001.dll => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\sfextra.dll => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\sonarinst.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\swt-win32-3349.dll => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\tmpA445.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\tmpB0D4.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\tmpB779.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\tmpD086.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\vcredist_x64.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\vcredist_x86.exe => Moved successfully.
C:\Users\Patrick\AppData\Local\Temp\WindowsInstaller-KB893803-v2-x86.exe => Moved successfully.

==== End of Fixlog ====

cosinus · 25.08.2014, 10:34

Gut, Windows rebooten und frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken

Graves · 25.08.2014, 10:41

So, hab rebootet und neue Logs gemacht:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-08-2014 03
Ran by Patrick (administrator) on KORL on 25-08-2014 11:38:32
Running from C:\Users\Patrick\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
( ) C:\Windows\System32\dlebcoms.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Dell P513w\dlebmon.exe
() C:\Program Files (x86)\Dell P513w\ezprint.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Alienware) C:\Program Files\Alienware\Command Center\ThermalController.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6419560 2011-11-21] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-21] (Realtek Semiconductor)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Command Center Controllers] => C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12616 2012-01-10] (Alienware)
HKLM\...\Run: [dlebmon.exe] => C:\Program Files (x86)\Dell P513w\dlebmon.exe [770728 2011-01-23] ()
HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Dell P513w\ezprint.exe [139944 2011-01-23] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe [286720 2011-10-12] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: J - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: L - L:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: M - M:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {150e5073-a655-11e1-8320-848f69f5061f} - L:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa4f25-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa4f31-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {2cfa5002-906a-11e1-ae2b-848f69f5061f} - J:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {56a648b1-d2c0-11e2-a95b-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {72e9ebd9-36c8-11e2-94f1-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {a3d2c3d5-d521-11e2-82b1-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {b440c86f-0331-11e3-9331-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {b440c890-0331-11e3-9331-001e101f2500} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {cd76bc1b-f59b-11e1-b0e8-848f69f5061f} - F:\MMMTest.EXE
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {d11bc3dd-027d-11e3-8792-848f69f5061f} - F:\AutoRun.exe
HKU\S-1-5-21-2761505586-3091770874-1174253457-1000\...\MountPoints2: {d11bc3ea-027d-11e3-8792-848f69f5061f} - F:\AutoRun.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.at/alienware
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x13474C457668CF01
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{39E523F5-5C41-45B9-8A58-04636E88BE9C}: [NameServer] 213.162.69.1 213.162.69.169
Tcpip\..\Interfaces\{5060D64D-462C-4C95-B2B1-B27E7E1C0731}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\2gmv88bu.default-1408927290564
FF Homepage: google.at
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @live.heroesandgenerals.com/npretox -> C:\Program Files (x86)\Heroes & Generals\live\npretox-1.0.6.1\npretoxlive-1.0.6.1.dll (Reto-Moto ApS)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Edge - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\2gmv88bu.default-1408927290564\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-08-25]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2014-07-23]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2012-04-21]

Chrome: 
=======
CHR HomePage: 
CHR StartupUrls: "hxxp://www.google.com"
CHR Extension: (Docs) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-25]
CHR Extension: (Google Drive) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-25]
CHR Extension: (YouTube) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-25]
CHR Extension: (Google-Suche) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-25]
CHR Extension: (Google Wallet) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-25]
CHR Extension: (Google Mail) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 dlebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\dlebserv.exe [33448 2009-07-01] ()
R2 dleb_device; C:\Windows\system32\dlebcoms.exe [1052328 2010-05-21] ( )
R2 dleb_device; C:\Windows\SysWOW64\dlebcoms.exe [598696 2010-05-21] ( )
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] ()
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2013-08-28] (Hi-Rez Studios) [File not signed]
S2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe [7168 2011-10-12] (Intel Corporation) [File not signed]
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2013-08-11] ()
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\mcafee\msc\McAWFwk.exe [224704 2011-03-08] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [603424 2014-06-12] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-06-18] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-08-11] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2013-08-11] (Bytemobile, Inc.) [File not signed]
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2014-05-17] (AnchorFree Inc.)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [23832 2011-10-13] (Intel Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [444720 2014-06-18] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [96592 2014-06-18] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
R3 mio; C:\Windows\System32\DRIVERS\mio.sys [7680 2011-05-04] (Dell/Alienware)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [100352 2011-09-15] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [216064 2011-09-15] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2013-08-11] (Bytemobile, Inc.) [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-25 11:38 - 2014-08-25 11:39 - 00018061 _____ () C:\Users\Patrick\Desktop\FRST.txt
2014-08-25 11:13 - 2014-08-25 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-25 02:55 - 2014-08-25 02:55 - 00000000 ____D () C:\Windows\ERUNT
2014-08-25 02:53 - 2014-08-25 02:53 - 01016261 _____ (Thisisu) C:\Users\Patrick\Downloads\JRT.exe
2014-08-25 02:41 - 2014-08-25 02:41 - 00000000 ____D () C:\Users\Patrick\Desktop\Alte Firefox-Daten
2014-08-25 02:31 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-25 02:30 - 2014-08-25 02:33 - 00000000 ____D () C:\AdwCleaner
2014-08-25 02:29 - 2014-08-25 02:29 - 01364531 _____ () C:\Users\Patrick\Desktop\adwcleaner_3.308.exe
2014-08-25 02:11 - 2014-08-25 11:38 - 00000000 ____D () C:\FRST
2014-08-25 02:11 - 2014-08-25 02:11 - 02103296 _____ (Farbar) C:\Users\Patrick\Desktop\FRST64.exe
2014-08-25 01:53 - 2014-08-25 01:53 - 00033528 _____ () C:\Malwarebytes.txt
2014-08-25 01:34 - 2014-08-25 01:34 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-25 01:34 - 2014-08-25 01:34 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-25 01:34 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-25 01:33 - 2014-08-25 01:34 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2014-08-25 01:33 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 01:08 - 2014-08-25 01:08 - 04813544 _____ (Piriform Ltd) C:\Users\Patrick\Downloads\ccsetup416.exe
2014-08-25 00:50 - 2014-08-25 01:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 00:50 - 2014-08-25 00:50 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-25 00:50 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-25 00:50 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-25 00:49 - 2014-08-25 00:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-21 01:15 - 2014-08-21 01:15 - 19890833 _____ () C:\Users\Patrick\Downloads\warframe.2.1.5.gadget
2014-08-15 02:49 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-15 02:49 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-15 02:49 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-15 02:49 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-15 02:49 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-15 02:49 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-15 02:48 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 02:48 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 23:43 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-14 23:43 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-14 23:43 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-14 23:43 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-14 23:43 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-14 23:43 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-14 23:43 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-14 23:43 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-14 23:43 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-14 23:43 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-14 23:43 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-14 23:43 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-14 23:43 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-14 23:43 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-14 23:43 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-14 23:42 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-14 23:42 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-14 23:42 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-14 23:42 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-14 23:42 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-14 23:42 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-14 23:42 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-14 23:42 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-14 23:42 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-14 23:42 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-14 23:42 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-14 23:42 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-14 23:42 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-14 23:42 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-14 23:42 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-14 23:42 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-14 23:42 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 11:55 - 2014-08-13 11:55 - 00000000 ____D () C:\Users\Patrick\Desktop\Papa Fotos Automesse
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\Documents\Stronghold Kingdoms
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Firefly Studios
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Geckofx
2014-08-10 19:52 - 2014-08-10 19:52 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00001981 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-08-10 19:45 - 2014-08-10 19:52 - 00000310 _____ () C:\Users\Patrick\Downloads\RootkitRemover_20140810_194541.log
2014-08-10 19:45 - 2014-08-10 19:45 - 00783120 _____ (McAfee, Inc.) C:\Users\Patrick\Downloads\rootkitremover.exe
2014-08-08 13:43 - 2014-08-08 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Targem
2014-08-07 10:39 - 2014-08-08 19:36 - 00000000 ____D () C:\Users\Patrick\Documents\BattleIslands
2014-08-03 15:46 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 15:46 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 15:46 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-03 15:46 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 15:46 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 15:46 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-03 15:46 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 15:46 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-03 15:46 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-03 15:46 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-31 13:01 - 2014-07-31 13:01 - 00000084 _____ () C:\Users\Patrick\Desktop\dsf.txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-25 11:39 - 2014-08-25 11:38 - 00018061 _____ () C:\Users\Patrick\Desktop\FRST.txt
2014-08-25 11:38 - 2014-08-25 02:11 - 00000000 ____D () C:\FRST
2014-08-25 11:37 - 2012-06-03 21:37 - 00123696 _____ () C:\ProgramData\dlebscan.log
2014-08-25 11:37 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-25 11:37 - 2009-07-14 06:51 - 00227111 _____ () C:\Windows\setupact.log
2014-08-25 11:36 - 2012-04-21 14:07 - 01765619 _____ () C:\Windows\WindowsUpdate.log
2014-08-25 11:31 - 2012-04-27 15:11 - 00000000 ____D () C:\Users\Patrick
2014-08-25 11:16 - 2009-07-14 06:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-25 11:16 - 2009-07-14 06:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-25 11:13 - 2014-08-25 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-25 11:13 - 2010-11-21 08:50 - 03637954 _____ () C:\Windows\system32\perfh007.dat
2014-08-25 11:13 - 2010-11-21 08:50 - 01062744 _____ () C:\Windows\system32\perfc007.dat
2014-08-25 11:13 - 2009-07-14 07:13 - 00006474 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-25 11:08 - 2009-07-14 06:45 - 00489048 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 02:55 - 2014-08-25 02:55 - 00000000 ____D () C:\Windows\ERUNT
2014-08-25 02:55 - 2012-04-21 14:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-25 02:53 - 2014-08-25 02:53 - 01016261 _____ (Thisisu) C:\Users\Patrick\Downloads\JRT.exe
2014-08-25 02:41 - 2014-08-25 02:41 - 00000000 ____D () C:\Users\Patrick\Desktop\Alte Firefox-Daten
2014-08-25 02:40 - 2012-04-21 21:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-25 02:34 - 2010-11-21 05:47 - 00322640 _____ () C:\Windows\PFRO.log
2014-08-25 02:33 - 2014-08-25 02:30 - 00000000 ____D () C:\AdwCleaner
2014-08-25 02:29 - 2014-08-25 02:29 - 01364531 _____ () C:\Users\Patrick\Desktop\adwcleaner_3.308.exe
2014-08-25 02:11 - 2014-08-25 02:11 - 02103296 _____ (Farbar) C:\Users\Patrick\Desktop\FRST64.exe
2014-08-25 01:53 - 2014-08-25 01:53 - 00033528 _____ () C:\Malwarebytes.txt
2014-08-25 01:52 - 2014-08-25 00:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 01:34 - 2014-08-25 01:34 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-08-25 01:34 - 2014-08-25 01:34 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-25 01:34 - 2014-08-25 01:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-25 01:34 - 2014-08-25 01:33 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2014-08-25 01:34 - 2014-08-25 01:33 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 01:27 - 2014-04-14 12:44 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Warframe
2014-08-25 01:08 - 2014-08-25 01:08 - 04813544 _____ (Piriform Ltd) C:\Users\Patrick\Downloads\ccsetup416.exe
2014-08-25 00:50 - 2014-08-25 00:50 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-25 00:50 - 2014-08-25 00:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-25 00:49 - 2014-08-25 00:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-25 00:19 - 2013-12-04 21:50 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Battle.net
2014-08-25 00:19 - 2013-10-15 12:11 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Skype
2014-08-24 17:09 - 2013-12-04 21:50 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-24 14:00 - 2013-05-22 11:07 - 00003460 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-08-24 11:49 - 2013-02-12 18:11 - 00000000 ____D () C:\Users\Patrick\Documents\Outlook-Dateien
2014-08-21 01:15 - 2014-08-21 01:15 - 19890833 _____ () C:\Users\Patrick\Downloads\warframe.2.1.5.gadget
2014-08-19 15:48 - 2013-12-04 21:52 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-19 12:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-15 02:48 - 2014-05-07 03:04 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-14 19:49 - 2013-10-15 12:11 - 00000000 ____D () C:\ProgramData\Skype
2014-08-13 11:55 - 2014-08-13 11:55 - 00000000 ____D () C:\Users\Patrick\Desktop\Papa Fotos Automesse
2014-08-13 11:37 - 2012-05-01 09:00 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\PCDr
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\Documents\Stronghold Kingdoms
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Firefly Studios
2014-08-11 22:27 - 2014-08-11 22:27 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Geckofx
2014-08-11 18:44 - 2012-04-27 21:21 - 00281288 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-08-11 18:44 - 2012-04-27 21:21 - 00000000 ____D () C:\Users\Patrick\AppData\Local\PunkBuster
2014-08-11 18:44 - 2012-04-27 16:44 - 00281288 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-08-11 18:42 - 2012-04-27 16:44 - 00281872 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-08-11 18:41 - 2012-04-27 16:44 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-08-11 18:41 - 2012-04-21 14:30 - 00704003 _____ () C:\Windows\DirectX.log
2014-08-10 19:52 - 2014-08-10 19:52 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00001981 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-08-10 19:52 - 2014-08-10 19:52 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-08-10 19:52 - 2014-08-10 19:45 - 00000310 _____ () C:\Users\Patrick\Downloads\RootkitRemover_20140810_194541.log
2014-08-10 19:52 - 2012-04-21 14:29 - 00000000 ____D () C:\ProgramData\Adobe
2014-08-10 19:45 - 2014-08-10 19:45 - 00783120 _____ (McAfee, Inc.) C:\Users\Patrick\Downloads\rootkitremover.exe
2014-08-09 16:37 - 2012-04-29 17:15 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-08-08 19:36 - 2014-08-07 10:39 - 00000000 ____D () C:\Users\Patrick\Documents\BattleIslands
2014-08-08 13:43 - 2014-08-08 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Targem
2014-08-08 13:43 - 2012-12-31 13:37 - 00000000 ____D () C:\Users\Patrick\Documents\my games
2014-08-07 04:06 - 2014-08-14 23:42 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-14 23:42 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-02 13:33 - 2012-09-29 15:15 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-07-31 13:01 - 2014-07-31 13:01 - 00000084 _____ () C:\Users\Patrick\Desktop\dsf.txt

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-19 12:41

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-08-2014 03
Ran by Patrick at 2014-08-25 11:40:15
Running from C:\Users\Patrick\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

A1 Dashboard (HKLM-x32\...\A1 Dashboard) (Version:  - mobilkom austria AG)
A1 Dashboard (x32 Version: 1.8.0.151 - mobilkom austria AG) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version:  - )
AlienAutopsy (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
Alienware Command Center (HKLM-x32\...\InstallShield_{6A7D1CAC-6267-4C71-A759-CB5D9E9FAFAA}) (Version: 2.7.25.0 - Alienware Corp.)
Alienware Command Center (Version: 2.7.25.0 - Alienware Corp.) Hidden
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.10 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Anno 2070 (HKLM-x32\...\Steam App 48240) (Version:  - BlueByte)
APB Reloaded (HKLM-x32\...\Steam App 113400) (Version:  - Reloaded Productions)
Application Profiles (HKLM-x32\...\{63059735-CA97-FDFB-0E7A-3B8D81572EFD}) (Version: 2.0.4888.34279 - Advanced Micro Devices, Inc.)
Application Profiles (HKLM-x32\...\{D9D98127-FC22-6734-079B-F68E15BDCC8F}) (Version: 2.0.4629.34031 - Advanced Micro Devices, Inc.)
Application Profiles (HKLM-x32\...\{FC529949-EECA-2BF6-02AC-8041AD76B4B5}) (Version: 2.0.4602.34575 - Advanced Micro Devices, Inc.)
Baldur's Gate: Enhanced Edition (HKLM-x32\...\Steam App 228280) (Version:  - )
Bastion (HKLM-x32\...\Steam App 107100) (Version:  - Supergiant Games)
Battle Islands (HKLM-x32\...\Steam App 305260) (Version:  - DR Studios)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.0.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 1.118.0 - EA Digital Illusions CE AB)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version:  - Irrational Games)
Blood Bowl: Chaos Edition (HKLM-x32\...\Steam App 216890) (Version:  - Cyanide Studio)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
Chivalry: Medieval Warfare (HKLM-x32\...\Steam App 219640) (Version:  - Torn Banner Studios)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 33.1.0.0 - COMODO)
Company of Heroes (HKLM-x32\...\Steam App 4560) (Version:  - Relic)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version:  - Paradox Development Studio)
Das Testament des Sherlock Holmes (HKLM-x32\...\{38A96559-FF39-4089-A609-BFD76C4A6C07}_is1) (Version: 1.00.0777 - Focus Home Interactive)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version:  - Stunlock Studios)
Dead State (HKLM-x32\...\Steam App 239840) (Version:  - DoubleBear Productions)
Defiance (HKLM-x32\...\Steam App 224600) (Version:  - Trion Worlds, Inc.)
Dell P513w (HKLM\...\Dell P513w) (Version:  - Dell, Inc.)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
Divine Divinity (HKLM-x32\...\Steam App 214170) (Version:  - Larian Studios)
Divinity Original Sin (HKLM-x32\...\Steam App 230230) (Version:  - Larian Studios)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Duel of Champions (HKCU\...\MMDoC-PDCLive) (Version:  - Ubisoft)
Duel of Champions (HKLM-x32\...\MMDoC-PDCLive) (Version:  - Ubisoft)
Earth 2150 Trilogy (HKLM-x32\...\Steam App 253880) (Version:  - Reality Pump Studios)
Earth 2150: Lost Souls (HKLM-x32\...\Steam App 259300) (Version:  - )
Earth 2150: The Moon Project (HKLM-x32\...\Steam App 259280) (Version:  - )
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
EVE Online (HKLM-x32\...\Steam App 8500) (Version:  - CCP)
Expeditions: Conquistador (HKLM-x32\...\Steam App 237430) (Version:  - Logic Artists)
Fallout (HKLM-x32\...\Steam App 38400) (Version:  - Black Isle Studios)
Fallout 2 (HKLM-x32\...\Steam App 38410) (Version:  - Black Isle Studios)
Firefall (HKLM-x32\...\{CFEF8DB5-B45E-4b05-90BE-D02AA6F45354}) (Version:  - Red 5 Studios)
FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version:  - Subset Games)
GameSpy Arcade (HKLM-x32\...\GameSpy Arcade) (Version:  - )
Gnomoria (HKLM-x32\...\Steam App 224500) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Heroes & Generals (HKLM-x32\...\Heroes & Generals) (Version: 1.0.6.1 - Reto-Moto)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
InfiniteCrisis_410193F41CAE (HKLM-x32\...\InfiniteCrisis_410193F41CAE) (Version:  - Turbine, Inc)
Intel(R) Rapid Storage Technology enterprise (HKLM-x32\...\{8B313BF5-9BD5-42a3-94C1-A28AF3AA51CC}) (Version: 3.0.0.2003 - Intel Corporation)
Internet Manager (HKLM-x32\...\Internet Manager) (Version: 22.001.18.43.55 - Huawei Technologies Co.,Ltd)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee SecurityCenter (HKLM-x32\...\MSC) (Version: 12.8.958 - McAfee, Inc.)
MechWarrior Online (HKLM-x32\...\{73bcb521-8936-42d7-ad00-ec2bb399e26c}) (Version: 1.4.3.0 - Piranha Games Inc.)
MechWarrior Online (x32 Version: 1.4.3.0 - Piranha Games Inc.) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{3bcf8c72-b231-4d28-9f39-3405c22d8b5a}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Might & Magic Heroes VI - Shades of Darkness (HKLM-x32\...\{745D37C2-26F4-4B65-BA13-F9840EBFA75B}) (Version: 2.1.0 - Ubisoft)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Neverwinter (HKLM-x32\...\Neverwinter) (Version:  - Cryptic Studios)
Neverwinter (HKLM-x32\...\Steam App 109600) (Version:  - Cryptic Studios)
NVIDIA PhysX (HKLM-x32\...\{64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}) (Version: 9.12.0613 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 8.5.2.23 - Electronic Arts, Inc.)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Overwolf (HKLM-x32\...\{030F4BB3-F3C3-4A74-905C-44672D1ECB76}) (Version: 0.47.284 - Overwolf)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Path of Exile (HKLM-x32\...\Steam App 238960) (Version:  - Grinding Gear Games)
PFPortChecker 1.0.40 (HKLM-x32\...\PFPortChecker) (Version: 1.0.40 - Portforward.com)
PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
PingPlotter Standard 3.42.3s (HKLM-x32\...\{1C1D0A2C-C8B4-4C2C-9877-884F8FC082B5}) (Version: 3.42.3.6 - Nessoft, LLC)
Plague Inc: Evolved (HKLM-x32\...\Steam App 246620) (Version:  - Ndemic Creations)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
Portal (HKLM-x32\...\Steam App 400) (Version:  - Valve)
Prison Architect (HKLM-x32\...\Steam App 233450) (Version:  - Introversion Software)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Razer Imperator (HKLM-x32\...\{C05905B9-775A-4894-A4DF-B57C15250958}) (Version: 2.02.00 - Razer USA Ltd.)
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.11.3 - Razer Inc.)
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6505 - Realtek Semiconductor Corp.)
RIFT (HKCU\...\RIFT) (Version:  - Trion Worlds, Inc.)
Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden
Roxio BackOnTrack (x32 Version: 1.3.3 - Roxio) Hidden
Roxio Burn (x32 Version: 1.8 - Roxio) Hidden
Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
Roxio Creator Starter (x32 Version: 1.0.439 - Roxio) Hidden
Roxio Creator Starter (x32 Version: 5.0.0 - Roxio) Hidden
Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden
Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
Royal Quest (HKLM-x32\...\Steam App 295550) (Version:  - Katauri)
RPG Maker VX Ace (HKLM-x32\...\Steam App 220700) (Version:  - Enterbrain)
Sam & Max 101: Culture Shock (HKLM-x32\...\Steam App 8200) (Version:  - Telltale Games)
Sam & Max 102: Situation: Comedy (HKLM-x32\...\Steam App 8210) (Version:  - Telltale Games)
Sam & Max 103: The Mole, the Mob and the Meatball (HKLM-x32\...\Steam App 8220) (Version:  - Telltale Games)
Sam & Max 104: Abe Lincoln Must Die! (HKLM-x32\...\Steam App 8230) (Version:  - Telltale Games)
Sang-Froid - Tales of Werewolves (HKLM-x32\...\Steam App 227220) (Version:  - )
Scrolls (HKLM-x32\...\Scrolls 1.0.0) (Version: 1.0.0 - Mojang)
Scrolls (x32 Version: 1.0.0 - Mojang) Hidden
Shadowrun Returns (HKLM-x32\...\Steam App 234650) (Version:  - Harebrained Schemes)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 0.1.1774.1 - Hi-Rez Studios)
Solar 2 (HKLM-x32\...\Steam App 97000) (Version:  - Murudai)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
Space Pirates and Zombies (HKLM-x32\...\Steam App 107200) (Version:  - MinMax Games Ltd.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Star Conflict (HKLM-x32\...\Steam App 212070) (Version:  - Star Gem Inc.)
Starbound (HKLM-x32\...\Steam App 211820) (Version:  - )
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
StealthBot 2.7 (HKLM-x32\...\{C05DEB30-501D-4106-958D-C5E147D2BF7E}) (Version: 2.7.0.0 - StealthBot)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold 3 (HKLM-x32\...\Steam App 47400) (Version:  - FireFly Studios)
Stronghold HD (HKLM-x32\...\Steam App 40950) (Version:  - FireFly Studios)
Stronghold Kingdoms (HKLM-x32\...\Steam App 47410) (Version:  - FireFly Studios)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)
The Banner Saga: Factions (HKLM-x32\...\Steam App 219340) (Version:  - )
The Elder Scrolls Online (HKLM-x32\...\The Elder Scrolls Online) (Version: 1.0.0.0 - Zenimax Online Studios)
The Elder Scrolls Online Beta (HKLM-x32\...\The Elder Scrolls Online Beta_is1) (Version: 0.3.4 - )
The Expendabros (HKLM-x32\...\Steam App 312990) (Version:  - Free Lives)
The Incredible Adventures of Van Helsing (HKLM-x32\...\Steam App 215530) (Version:  - )
The Raven - Legacy of a Master Thief (HKLM-x32\...\Steam App 233370) (Version:  - KING Art)
The Walking Dead (HKLM-x32\...\Steam App 207610) (Version:  - )
The Walking Dead: Season Two (HKLM-x32\...\Steam App 261030) (Version:  - Telltale Games)
Tibia (HKLM-x32\...\Tibia_is1) (Version: 10.32 - CipSoft GmbH)
Titan Quest (HKLM-x32\...\Steam App 4540) (Version:  - Iron Lore Entertainment)
Titan Quest: Immortal Throne (HKLM-x32\...\Steam App 4550) (Version:  - Iron Lore Entertainment)
Torchlight (HKLM-x32\...\Steam App 41500) (Version:  - Runic Games, Inc.)
Torchlight II (HKLM-x32\...\Steam App 200710) (Version:  - )
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version:  - The Creative Assembly)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Wanderlust: Rebirth (HKLM-x32\...\Steam App 211580) (Version:  - Yeti Trunk)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
Warframe (HKLM-x32\...\Steam App 230410) (Version:  - Digital Extremes)
Warhammer® 40,000™: Dawn of War® II - Chaos Rising™ (HKLM-x32\...\Steam App 20570) (Version:  - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II – Retribution™ (HKLM-x32\...\Steam App 56400) (Version:  - Relic Entertainment)
Wasteland 2 (HKLM-x32\...\Steam App 240760) (Version:  - inXile Entertainment)
WildStar (HKLM-x32\...\WildStar) (Version:  - NCSOFT)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)
World of Warplanes (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C813EU}_is1) (Version:  - Wargaming.net)
XCOM: Enemy Unknown (HKLM-x32\...\Steam App 200510) (Version:  - Firaxis Games)
Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

21-08-2014 12:44:11 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-07-15 18:15 - 00000722 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {10A97BDC-8519-4A58-8BDF-43C80683F0D7} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {314B2213-59C8-4A0A-BE9A-991608563B9A} - System32\Tasks\{1A7FB380-0256-4EF6-9232-072331989A0E} => Firefox.exe hxxp://ui.skype.com/ui/0/6.16.0.105/de/abandoninstall?page=tsBing
Task: {54264A92-E61C-489B-B4CB-1F35FB5C9B64} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {7B7FC38D-081E-405B-8F97-56BBADFFA30A} - System32\Tasks\{4AAB5917-90B7-4A96-B6CA-C01F71C3A78D} => Firefox.exe hxxp://ui.skype.com/ui/0/6.16.0.105/de/abandoninstall?page=tsProgressBar
Task: {95B6A2E2-D1B7-414E-A03B-F8666D0E91E0} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\AlienAutopsy\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {D340E894-286B-4427-AFE9-55C0F9651D64} - System32\Tasks\{3FBE2A1A-22AC-4E44-BAA3-AA775A246DAE} => Firefox.exe hxxp://ui.skype.com/ui/0/6.9.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsBing
Task: {E590141D-A139-4665-A1C5-101F46A6B81D} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\AlienAutopsy\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {F77C39CF-76D1-4853-964C-282ADDC2E2EC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-06-03 21:41 - 2009-06-19 09:01 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\dlebdrpp.dll
2014-05-21 12:22 - 2014-05-21 12:22 - 02135232 _____ () C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2012-06-03 21:54 - 2011-01-23 19:37 - 00770728 _____ () C:\Program Files (x86)\Dell P513w\dlebmon.exe
2012-06-03 21:54 - 2011-01-23 19:37 - 00139944 _____ () C:\Program Files (x86)\Dell P513w\ezprint.exe
2013-08-11 15:04 - 2013-08-11 15:03 - 00224096 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
2012-04-27 16:44 - 2014-08-11 18:41 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2012-06-03 21:54 - 2009-11-26 03:50 - 00086183 _____ () C:\Program Files (x86)\Dell P513w\dlebcfg.dll
2012-06-03 21:54 - 2010-04-01 12:23 - 00389120 _____ () C:\Program Files (x86)\Dell P513w\dlebscw.dll
2012-06-03 21:54 - 2009-05-27 07:16 - 00192512 _____ () C:\Program Files (x86)\Dell P513w\dlebdatr.dll
2012-06-03 21:54 - 2010-04-01 12:24 - 01159168 _____ () C:\Program Files (x86)\Dell P513w\dlebDRS.dll
2012-06-03 21:54 - 2009-03-10 00:43 - 00155648 _____ () C:\Program Files (x86)\Dell P513w\dlebcaps.dll
2012-06-03 21:54 - 2009-03-05 12:55 - 00059904 _____ () C:\Program Files (x86)\Dell P513w\dlebcnv4.dll
2009-02-12 11:33 - 2009-02-12 11:33 - 00381952 _____ () C:\Windows\system32\dlebsm.dll
2009-04-28 07:57 - 2009-04-28 07:57 - 00032768 _____ () C:\Windows\system32\dlebsmr.dll
2012-06-03 21:54 - 2009-03-30 07:40 - 00708608 _____ () C:\Program Files (x86)\Dell P513w\Epwizard.DLL
2012-06-03 21:54 - 2009-03-30 07:38 - 00159744 _____ () C:\Program Files (x86)\Dell P513w\customui.dll
2012-06-03 21:54 - 2009-03-30 07:38 - 00114688 _____ () C:\Program Files (x86)\Dell P513w\Eputil.DLL
2012-06-03 21:54 - 2009-03-30 07:37 - 00139264 _____ () C:\Program Files (x86)\Dell P513w\Imagutil.DLL
2012-06-03 21:54 - 2009-03-30 07:38 - 00061440 _____ () C:\Program Files (x86)\Dell P513w\Epfunct.DLL
2012-06-03 21:54 - 2009-06-23 06:11 - 02203648 _____ () C:\Program Files (x86)\Dell P513w\EPWizRes.dll
2012-06-03 21:54 - 2009-06-23 06:13 - 00045056 _____ () C:\Program Files (x86)\Dell P513w\epstring.dll
2012-06-03 21:54 - 2009-06-23 06:13 - 00221184 _____ () C:\Program Files (x86)\Dell P513w\EPOEMDll.dll
2012-06-03 21:54 - 2009-04-07 14:25 - 00409600 _____ () C:\Program Files (x86)\Dell P513w\iptk.dll
2012-06-03 21:54 - 2009-03-02 09:25 - 00151552 _____ () C:\Program Files (x86)\Dell P513w\dlebptp.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 02415104 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll
2013-08-11 15:04 - 2013-08-11 15:03 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll
2014-07-23 01:21 - 2014-07-23 01:21 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-08-15 16:11 - 2014-08-15 16:11 - 00019968 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\PSIClient\c91f320f0076e92d919ff16ce35c2ae3\PSIClient.ni.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Desktop Disc Tool => "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
MSCONFIG\startupreg: Overwolf => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
MSCONFIG\startupreg: RadioRage EPM Support => "C:\PROGRA~2\RADIOR~1\bar\1.bin\4jmedint.exe" T8EPMSUP.DLL,S
MSCONFIG\startupreg: RadioRage Search Scope Monitor => "C:\PROGRA~2\RADIOR~1\bar\1.bin\4jsrchmn.exe" /m=2 /w /h
MSCONFIG\startupreg: Razer Imperator Driver => C:\Program Files (x86)\Razer\Imperator\RazerImperatorSysTray.exe
MSCONFIG\startupreg: Razer Synapse => "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
MSCONFIG\startupreg: RoxWatchTray => "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/25/2014 11:38:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2014 11:13:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (08/25/2014 11:13:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/25/2014 11:13:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/25/2014 11:09:48 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/25/2014 11:37:33 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 11:37:32 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (08/25/2014 11:37:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "dlebCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 11:37:17 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst dlebCATSCustConnectService erreicht.

Error: (08/25/2014 11:08:24 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 11:08:24 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (08/25/2014 11:08:20 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "dlebCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/25/2014 11:08:20 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst dlebCATSCustConnectService erreicht.


Microsoft Office Sessions:
=========================
Error: (08/25/2014 11:38:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2014 11:13:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (08/25/2014 11:13:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/25/2014 11:13:01 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/25/2014 11:09:48 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3930K CPU @ 3.20GHz
Percentage of memory in use: 17%
Total physical RAM: 16336.19 MB
Available physical RAM: 13515.78 MB
Total Pagefile: 32670.56 MB
Available Pagefile: 29475.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1861.82 GB) (Free:1111.56 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:0.73 GB) (Free:0.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: C8E558F4)

Partition: GPT Partition Type.

==================== End Of Log ============================

cosinus · 25.08.2014, 11:00

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Graves · 25.08.2014, 16:17

ESET hängt seit 45min.+ an einem Installer für ein Spiel fest.

Hier schonmal der Malwarebytes Log:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 25.08.2014
Scan Time: 12:04:55
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.25.02
Rootkit Database: v2014.08.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Patrick

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 313238
Time Elapsed: 13 min, 5 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

So, den ersten Scan hab ich abgebrochen weil er sich fast 2 Stunden kein Stück gerührt hat. (wollte einen Installer checken für ein Spiel)

Danach habe ich den Installer händisch gelöscht und den Scan neu gestartet.

Hier das Log:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=bdff4ef76e13b94ba048ef64f5ad1b36
# engine=19826
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-25 11:54:30
# local_time=2014-08-25 01:54:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 33368360 160597520 0 0
# scanned=15382
# found=3
# cleaned=0
# scan_time=5248
sh=D7D0AD2C1D1B02EB4189F885315942352661AB7F ft=1 fh=bd78ea9313887d8e vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-2761505586-3091770874-1174253457-1000\$R8UD8LJ.exe"
sh=905BC19D01420D983A85086BB01390C46D00B3D2 ft=1 fh=b523a1ddfb8d9841 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-2761505586-3091770874-1174253457-1000\$RDGQNAX.exe"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Patrick\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=bdff4ef76e13b94ba048ef64f5ad1b36
# engine=19826
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-25 03:13:18
# local_time=2014-08-25 05:13:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 33380288 160609448 0 0
# scanned=536519
# found=3
# cleaned=0
# scan_time=11845
sh=D7D0AD2C1D1B02EB4189F885315942352661AB7F ft=1 fh=bd78ea9313887d8e vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-2761505586-3091770874-1174253457-1000\$R8UD8LJ.exe"
sh=905BC19D01420D983A85086BB01390C46D00B3D2 ft=1 fh=b523a1ddfb8d9841 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-2761505586-3091770874-1174253457-1000\$RDGQNAX.exe"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Patrick\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"

cosinus · 25.08.2014, 22:00

Nur Reste.

TFC - Temp File Cleaner

Lade dir

TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

Öffne die TFC.exe.
Vista und Win 7 User mit Rechtsklick "als Administrator starten".
Schließe alle anderen Programme.
Drücke auf den Button Start.
Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Graves · 25.08.2014, 22:53

So, hab den Temp File Cleaner jetzt auch ausgeführt.

Ich sag dann schonmal danke für die schnelle und effektive Hilfe.

Zu den Cookies: Ich hab das Speichern schon immer deaktiviert gehabt. Ich hab kein Problem damit meine Daten immer neu einzugeben.

Sonst gibts keine Probleme. Mir kommts so vor als würde der Computer jetzt insgesamt schneller booten, warum auch immer (:

Letztendlich ist es mir zum Verhängnis gefallen das mein VHS Recorder nicht mehr funktioniert hat, ich mir damit "Gremlings" nicht mehr anschauen konnte, meine Lieblingsstreamingseiten den Film nicht angeboten haben und ich auf eine Seite ausweichen musste von der ich dachte sie wäre sauber. Kaum eine Sekunde nachdem ich auf der Seite war (hab nichts angeklickt) hat McAfee schon rumgeheult.

Jedenfalls danke nochmal, ich bin keiner der gerne und oft sein Betriebssystem neu aufsetzt und somit hast du mir viel Ärger und Zeitaufwand erspart.

25.08.2014, 08:50	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojaner Artemis!29760C4C151F eingefangen Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. __________________ --> Trojaner Artemis!29760C4C151F eingefangen

25.08.2014, 10:34	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojaner Artemis!29760C4C151F eingefangen Gut, Windows rebooten und frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken __________________ Logfiles bitte immer in CODE-Tags posten

Trojaner Artemis!29760C4C151F eingefangen

Plagegeister aller Art und deren Bekämpfung: Trojaner Artemis!29760C4C151F eingefangen