Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Plagegeister aller Art und deren Bekämpfung: Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 02.09.2014, 03:09   #1
ChicoMarx
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Hey, ich bin mir ziemlich sicher, dass ich über n Torrent n Virus gefangen habe.
Zumindest hat ESET die Datei so eingestuft und zudem noch 2 "SafeClicker"-Dateien, die ich vorher nicht hatte.

Viele Symptome gibts nich außer, dass ich jetzt enorm viele mir unbekannte Dateien finde.
Außerdem ist mein Windows Explorer teilweise abgestürzt als ich versucht habe was zu löschen (aus dem Papierkorb).
Ich bin übrigens nicht besonders PC-bewandert, also Hilfe für Doofies wäre nett

Danke schon einmal

MfG ChicoMarx


€: Und es kommt externe Werbung (z.B. auf Amazon) trotz AddBlocker

Alt 02.09.2014, 06:28   #2
Bootsektor
Ruhe in Frieden
† 2019
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe




Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
  • Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
  • Poste die Logfiles direkt in deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:
  • Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
  • Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
  • Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________
Alt 02.09.2014, 09:55   #3
ChicoMarx
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Hi
Hier der erste Schritt.
(ESET scheint ein Problem mit dem Kernel zu haben, deshalb ist es disabelt o.O )

FRST:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran by Pascal (administrator) on PASCAL-PC on 02-09-2014 10:48:16
Running from C:\Users\Pascal\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
() C:\Users\Pascal\AppData\Roaming\InetStat\inetstat.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Bandoo Media, inc) C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2013-03-04] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2013-03-04] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5618456 2013-09-12] (ESET)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [MGSysCtrl] => C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2011-06-29] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2013-03-04] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [DATAMNGR] => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe [1683456 2013-02-14] (Bandoo Media, inc)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [807696 2013-12-20] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [LOLReplay Recorder] => C:\Program Files (x86)\LOLReplay\LOLRecorder.exe [494592 2014-03-21] (LOL Replay)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [Google Update] => "C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe" /c
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [InetStat] => C:\Users\Pascal\AppData\Roaming\InetStat\inetstat.exe [750094 2014-09-02] ()
AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL => C:\ProgramData\Wincert\win64cert.dll [8704 2013-02-07] ()
AppInit_DLLs:  C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll [2018680 2013-02-14] (Bandoo Media, inc)
AppInit_DLLs:  C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll [1531256 2013-02-14] (Bandoo Media, inc)
AppInit_DLLs:  C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\progra~3\wincert\win32c~1.dll => c:\ProgramData\Wincert\win32cert.dll [7168 2013-02-07] ()
AppInit_DLLs-x32:  c:\progra~2\search~1\datamngr\datamngr.dll => c:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngr.dll [1540096 2013-02-14] (Bandoo Media, inc)
AppInit_DLLs-x32:  c:\progra~2\search~1\datamngr\iebho.dll => c:\Program Files (x86)\Searchqu Toolbar\Datamngr\IEBHO.dll [1189240 2013-02-14] (Bandoo Media, inc)
AppInit_DLLs-x32:  c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32:  ,C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Qualcomm Atheros Killer Network Manager.lnk
ShortcutTarget: Qualcomm Atheros Killer Network Manager.lnk -> C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe ()
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/413
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=1243419007314614&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=1243419007314614&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=1243419007314614&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=1243419007314614&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=1243419007314614&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=1243419007314614&q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc)
BHO-x32: Search-Results Toolbar -> {3ec1a45c-8bc3-4bfe-b226-4051c5d3d068} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
Toolbar: HKLM-x32 - Search-Results Toolbar - {3ec1a45c-8bc3-4bfe-b226-4051c5d3d068} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 02 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 03 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 04 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 05 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 06 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 17 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 01 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 02 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 03 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 04 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 05 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 06 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 17 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default
FF SearchEngineOrder.1: Search Results
FF Homepage: about:home
FF Keyword.URL: hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&apn_uid=1243419007314614&o=APN10649&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: @eximion.com/KalydoPlayer -> C:\Users\Pascal\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Pascal\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Pascal\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Pascal\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Users\Pascal\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Pascal\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: SaveClicker - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org [2014-09-02]
FF Extension: YouTube Unblocker - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-21]
FF Extension: Search-Results Toolbar - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{3ec1a45c-8bc3-4bfe-b226-4051c5d3d068} [2013-08-20]
FF Extension: ArchiveFacebook - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{53A03D43-5363-4669-8190-99061B2DEBA6} [2013-10-29]
FF Extension: DownloadHelper - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-12]
FF Extension: YouTube HD - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\jid0-HbNL9qqBkuuKRhJ9ncTonCky1HU@jetpack.xpi [2013-10-10]
FF Extension: Reddit Enhancement Suite - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi [2014-02-20]
FF Extension: Personas Plus - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\personas@christopher.beard.xpi [2013-09-26]
FF Extension: Search By Image (by Google) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{ce7e73df-6a44-4028-8079-5927a588c948}.xpi [2014-07-15]
FF Extension: HTMLPlugin - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{cebded91-c3d7-4bfd-9715-e4d365081986}.xpi [2014-05-30]
FF Extension: Adblock Plus - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-14]
FF Extension: {e0a2a72e-d3e5-46bf-8206-863d31912e68} - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{e0a2a72e-d3e5-46bf-8206-863d31912e68}.xpi [2014-05-26]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-01-22]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

Chrome: 
=======
CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-19]
CHR Extension: (Google Drive) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-19]
CHR Extension: (YouTube) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-19]
CHR Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-08-26]
CHR Extension: (Google-Suche) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-19]
CHR Extension: (SaveClicker) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda [2014-09-02]
CHR Extension: (AS Magic Player) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim [2014-07-04]
CHR Extension: (Google Wallet) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-19]
CHR Extension: (Google Mail) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-19]
CHR Extension: (SaveClicker) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1 [2014-09-02]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [402192 2013-12-20] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2013-12-20] (BlueStack Systems, Inc.)
S2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1337752 2013-09-12] (ESET)
R2 Micro Star SCM; C:\Program Files (x86)\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [37176 2013-08-22] (The OpenVPN Project)
R2 Qualcomm Atheros Killer Service; C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [490496 2012-09-24] () [File not signed]
R2 RzOvlMon; C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe [32960 2013-11-21] (Razer, Inc.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
S2 be0fb33b; "C:\Windows\system32\rundll32.exe" "c:\progra~2\suppor~1\SupporterSvc.dll",service
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [66928 2012-09-24] (Qualcomm Atheros, Inc.)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [114448 2013-12-20] (BlueStack Systems)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)
R3 L1C; C:\Windows\System32\DRIVERS\e22w7x64.sys [157552 2012-09-24] (Qualcomm Atheros, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 RzDxgk; C:\Windows\system32\drivers\RzDxgk.sys [129472 2013-11-21] (Razer, Inc.)
R0 RzFilter; C:\Windows\System32\drivers\RzFilter.sys [74432 2013-11-21] (Razer, Inc.)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 ALSysIO; \??\C:\Users\Pascal\AppData\Local\Temp\ALSysIO64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-02 10:48 - 2014-09-02 10:48 - 00026053 _____ () C:\Users\Pascal\Downloads\FRST.txt
2014-09-02 10:48 - 2014-09-02 10:48 - 00000000 ____D () C:\FRST
2014-09-02 10:47 - 2014-09-02 10:47 - 02104832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe
2014-09-02 04:01 - 2014-09-02 04:08 - 00046755 _____ () C:\Users\Pascal\Desktop\ESET_Logs.zip
2014-09-02 03:53 - 2014-09-02 03:53 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-09-02 03:52 - 2014-09-02 03:52 - 05314560 _____ () C:\Users\Pascal\Downloads\msxmlger.msi
2014-09-02 03:36 - 2014-09-02 03:49 - 00345553 _____ () C:\Users\Pascal\Desktop\Log_ESET.xml
2014-09-02 02:49 - 2014-09-02 04:25 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
2014-09-02 02:49 - 2014-09-02 03:31 - 00000000 ____D () C:\ProgramData\SaveClicker
2014-09-02 02:49 - 2014-09-02 02:49 - 00002604 _____ () C:\Windows\System32\Tasks\couponsupport-S-649636217
2014-09-02 02:49 - 2014-09-02 02:49 - 00000358 ____H () C:\Windows\Tasks\couponsupport-S-649636217.job
2014-09-02 02:49 - 2014-09-02 02:49 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\InetStat
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Torch
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Packages
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Comodo
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Chromatic Browser
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\ProgramData\46ec6306412c2933
2014-09-02 02:48 - 2014-09-02 04:26 - 00000000 ____D () C:\Program Files (x86)\GetPrivate
2014-09-02 02:48 - 2014-09-02 04:25 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\GetPrivate
2014-09-02 02:48 - 2014-09-02 02:48 - 00003260 _____ () C:\Windows\System32\Tasks\GPUP
2014-08-29 17:00 - 2014-08-29 17:00 - 00295816 _____ () C:\Windows\Minidump\082914-23197-01.dmp
2014-08-28 10:50 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 10:50 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 10:50 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 18:47 - 2014-09-02 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-08-27 18:47 - 2014-08-27 18:47 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-08-27 18:46 - 2014-08-27 18:46 - 00270848 _____ (Secure By Design Inc.) C:\Users\Pascal\Downloads\Ninite Firefox VLC Installer.exe
2014-08-26 16:17 - 2014-08-26 16:17 - 00001351 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-08-26 16:15 - 2014-09-02 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\system32\NV
2014-08-26 16:15 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-26 16:13 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2014-08-26 16:13 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-08-26 16:13 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-08-26 16:13 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-08-26 16:07 - 2014-08-26 16:11 - 274075712 _____ (NVIDIA Corporation) C:\Users\Pascal\Downloads\340.52-notebook-win8-win7-64bit-international-whql.exe
2014-08-25 16:44 - 2014-08-25 16:44 - 00012267 _____ () C:\Users\Pascal\Documents\GEZ.odt
2014-08-24 18:45 - 2014-08-24 18:45 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Adobe
2014-08-22 10:50 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-22 10:50 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-22 10:50 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-22 10:50 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-22 10:50 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-22 10:49 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-22 10:49 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-22 10:49 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-22 10:49 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-19 20:07 - 2014-08-19 20:08 - 00005604 _____ () C:\Windows\system32\lvcoinst.log
2014-08-19 20:07 - 2014-08-19 20:07 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-08-18 21:46 - 2014-08-18 21:47 - 01058200 _____ (Adobe) C:\Users\Pascal\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-16 18:38 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 18:38 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-16 18:38 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 18:38 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 18:38 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-16 18:38 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-16 18:37 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-16 18:37 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 17:10 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-16 17:10 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-16 17:10 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-16 17:10 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-16 17:10 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-16 17:10 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-16 17:10 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-16 17:10 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-16 17:10 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-16 17:10 - 2014-07-24 11:37 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-08-16 17:10 - 2014-07-24 11:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-08-16 16:58 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-16 16:58 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-16 16:58 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-16 16:58 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-16 16:58 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-16 16:58 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-16 16:58 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-16 16:58 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-16 16:58 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 16:58 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-16 16:58 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-16 16:58 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-16 16:58 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-12 18:13 - 2014-08-12 18:13 - 00295728 _____ () C:\Windows\Minidump\081214-27003-01.dmp
2014-08-09 11:10 - 2014-08-09 11:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-09 11:10 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\Program Files\iTunes
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-09 11:09 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-02 10:48 - 2014-09-02 10:48 - 00026053 _____ () C:\Users\Pascal\Downloads\FRST.txt
2014-09-02 10:48 - 2014-09-02 10:48 - 00000000 ____D () C:\FRST
2014-09-02 10:47 - 2014-09-02 10:47 - 02104832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe
2014-09-02 10:41 - 2014-04-11 00:24 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA.job
2014-09-02 10:39 - 2009-07-14 06:45 - 00029120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-02 10:39 - 2009-07-14 06:45 - 00029120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-02 10:38 - 2013-08-13 15:06 - 01289471 _____ () C:\Windows\WindowsUpdate.log
2014-09-02 10:32 - 2014-06-19 22:49 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4.job
2014-09-02 10:32 - 2013-08-13 16:02 - 00000000 ____D () C:\ProgramData\Bigfoot Networks
2014-09-02 10:32 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-02 10:32 - 2009-07-14 06:51 - 00122573 _____ () C:\Windows\setupact.log
2014-09-02 04:26 - 2014-09-02 02:48 - 00000000 ____D () C:\Program Files (x86)\GetPrivate
2014-09-02 04:26 - 2014-08-27 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-09-02 04:26 - 2014-08-26 16:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-02 04:26 - 2014-06-13 19:18 - 00000000 ____D () C:\Program Files (x86)\Browny02
2014-09-02 04:26 - 2014-02-08 16:12 - 00000000 ____D () C:\Program Files (x86)\Everything
2014-09-02 04:25 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
2014-09-02 04:25 - 2014-09-02 02:48 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\GetPrivate
2014-09-02 04:25 - 2013-12-18 20:44 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Battle.net
2014-09-02 04:25 - 2013-09-17 08:07 - 00000000 ____D () C:\Windows\Minidump
2014-09-02 04:25 - 2013-08-20 15:52 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\FreeFLVConverter
2014-09-02 04:25 - 2013-08-20 14:25 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\IrfanView
2014-09-02 04:25 - 2013-08-13 15:12 - 00000000 ____D () C:\Users\Pascal
2014-09-02 04:25 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-09-02 04:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-09-02 04:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-09-02 04:13 - 2009-07-14 06:45 - 00297744 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-02 04:08 - 2014-09-02 04:01 - 00046755 _____ () C:\Users\Pascal\Desktop\ESET_Logs.zip
2014-09-02 03:54 - 2014-06-19 22:49 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7.job
2014-09-02 03:53 - 2014-09-02 03:53 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-09-02 03:52 - 2014-09-02 03:52 - 05314560 _____ () C:\Users\Pascal\Downloads\msxmlger.msi
2014-09-02 03:49 - 2014-09-02 03:36 - 00345553 _____ () C:\Users\Pascal\Desktop\Log_ESET.xml
2014-09-02 03:47 - 2013-08-13 16:32 - 00065592 _____ () C:\Users\Pascal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-02 03:44 - 2013-11-30 02:32 - 00000000 ____D () C:\Users\Pascal\AppData\Local\CrashDumps
2014-09-02 03:40 - 2014-03-08 19:07 - 00000000 ____D () C:\ProgramData\Nuance
2014-09-02 03:40 - 2014-03-08 19:07 - 00000000 ____D () C:\Program Files (x86)\Nuance
2014-09-02 03:38 - 2014-03-08 19:08 - 00000000 ____D () C:\ProgramData\ScanSoft
2014-09-02 03:32 - 2013-08-14 13:39 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Apple Computer
2014-09-02 03:31 - 2014-09-02 02:49 - 00000000 ____D () C:\ProgramData\SaveClicker
2014-09-02 03:26 - 2014-01-21 16:01 - 00000000 ____D () C:\inetpub
2014-09-02 03:24 - 2014-04-08 22:18 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\ACEStream
2014-09-02 03:24 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-02 03:20 - 2013-08-20 15:41 - 00000000 ____D () C:\Users\Pascal\dwhelper
2014-09-02 03:13 - 2013-08-20 13:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-02 02:57 - 2011-04-12 09:43 - 04975880 _____ () C:\Windows\system32\perfh007.dat
2014-09-02 02:57 - 2011-04-12 09:43 - 01525026 _____ () C:\Windows\system32\perfc007.dat
2014-09-02 02:57 - 2009-07-14 07:13 - 00007128 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-02 02:50 - 2010-11-21 05:47 - 00198152 _____ () C:\Windows\PFRO.log
2014-09-02 02:49 - 2014-09-02 02:49 - 00002604 _____ () C:\Windows\System32\Tasks\couponsupport-S-649636217
2014-09-02 02:49 - 2014-09-02 02:49 - 00000358 ____H () C:\Windows\Tasks\couponsupport-S-649636217.job
2014-09-02 02:49 - 2014-09-02 02:49 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\InetStat
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Torch
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Packages
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Comodo
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Chromatic Browser
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\ProgramData\46ec6306412c2933
2014-09-02 02:49 - 2014-06-19 22:42 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-02 02:49 - 2014-04-11 00:23 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Google
2014-09-02 02:48 - 2014-09-02 02:48 - 00003260 _____ () C:\Windows\System32\Tasks\GPUP
2014-09-02 01:44 - 2013-08-14 13:27 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Skype
2014-09-01 23:34 - 2013-08-26 18:40 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\TS3Client
2014-09-01 20:08 - 2013-12-18 20:44 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Battle.net
2014-08-31 21:41 - 2014-04-11 00:23 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core.job
2014-08-29 17:00 - 2014-08-29 17:00 - 00295816 _____ () C:\Windows\Minidump\082914-23197-01.dmp
2014-08-29 17:00 - 2013-09-17 08:07 - 462873505 _____ () C:\Windows\MEMORY.DMP
2014-08-27 18:47 - 2014-08-27 18:47 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-08-27 18:47 - 2013-08-14 13:35 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-08-27 18:46 - 2014-08-27 18:46 - 00270848 _____ (Secure By Design Inc.) C:\Users\Pascal\Downloads\Ninite Firefox VLC Installer.exe
2014-08-27 12:26 - 2013-10-04 22:06 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-08-26 16:17 - 2014-08-26 16:17 - 00001351 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-08-26 16:17 - 2014-05-08 17:51 - 00000000 ____D () C:\Users\Pascal\AppData\Local\NVIDIA Corporation
2014-08-26 16:17 - 2013-11-02 21:57 - 00000000 ____D () C:\Users\Pascal\AppData\Local\NVIDIA
2014-08-26 16:17 - 2013-08-13 16:47 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\system32\NV
2014-08-26 16:15 - 2013-08-13 16:48 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-26 16:15 - 2013-08-13 16:47 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-26 16:15 - 2013-08-13 16:45 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-26 16:11 - 2014-08-26 16:07 - 274075712 _____ (NVIDIA Corporation) C:\Users\Pascal\Downloads\340.52-notebook-win8-win7-64bit-international-whql.exe
2014-08-25 16:44 - 2014-08-25 16:44 - 00012267 _____ () C:\Users\Pascal\Documents\GEZ.odt
2014-08-24 18:45 - 2014-08-24 18:45 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Adobe
2014-08-24 16:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-24 11:08 - 2013-08-20 13:32 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-24 11:08 - 2013-08-20 13:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-24 11:08 - 2013-08-20 13:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-23 04:07 - 2014-08-28 10:50 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 10:50 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 10:50 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 12:42 - 2013-12-18 20:44 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-22 00:30 - 2013-09-09 20:37 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-08-19 20:08 - 2014-08-19 20:07 - 00005604 _____ () C:\Windows\system32\lvcoinst.log
2014-08-19 20:07 - 2014-08-19 20:07 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-08-19 11:16 - 2013-12-18 20:45 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-18 21:56 - 2014-06-19 22:43 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-18 21:47 - 2014-08-18 21:46 - 01058200 _____ (Adobe) C:\Users\Pascal\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-16 18:42 - 2013-09-11 11:51 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-16 18:40 - 2013-09-11 11:51 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-16 18:37 - 2014-05-06 12:01 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 18:13 - 2014-08-12 18:13 - 00295728 _____ () C:\Windows\Minidump\081214-27003-01.dmp
2014-08-09 11:10 - 2014-08-09 11:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-09 11:10 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iTunes
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-09 11:09 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iPod
2014-08-07 20:58 - 2013-08-14 13:27 - 00000000 ____D () C:\ProgramData\Skype
2014-08-07 04:06 - 2014-08-16 16:58 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-16 16:58 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 14:22 - 2013-08-14 13:26 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-08-05 09:20 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\Pascal\AppData\Local\Temp\18be6784_.exe
C:\Users\Pascal\AppData\Local\Temp\294823_.exe
C:\Users\Pascal\AppData\Local\Temp\4ae13d6c_.exe
C:\Users\Pascal\AppData\Local\Temp\bxm3mlzr.srj.exe
C:\Users\Pascal\AppData\Local\Temp\installhelper.dll
C:\Users\Pascal\AppData\Local\Temp\install_flashplayer11x32au_mssa_aaa_aih.exe
C:\Users\Pascal\AppData\Local\Temp\InstHelper.exe
C:\Users\Pascal\AppData\Local\Temp\k4n4zoue.dll
C:\Users\Pascal\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe
C:\Users\Pascal\AppData\Local\Temp\Setup.exe
C:\Users\Pascal\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Pascal\AppData\Local\Temp\sfextra.dll
C:\Users\Pascal\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Pascal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Pascal\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Pascal\AppData\Local\Temp\vybxk5zm.ie0.exe
C:\Users\Pascal\AppData\Local\Temp\wypo53rq.yg1.exe
C:\Users\Pascal\AppData\Local\Temp\_is4164.exe
C:\Users\Pascal\AppData\Local\Temp\_is457B.exe
C:\Users\Pascal\AppData\Local\Temp\_is5BB6.exe
C:\Users\Pascal\AppData\Local\Temp\_is85E3.exe
C:\Users\Pascal\AppData\Local\Temp\_is8DBE.exe
C:\Users\Pascal\AppData\Local\Temp\_isAD62.exe
C:\Users\Pascal\AppData\Local\Temp\_isC2C9.exe
C:\Users\Pascal\AppData\Local\Temp\_isC34E.exe
C:\Users\Pascal\AppData\Local\Temp\_isD96.exe
C:\Users\Pascal\AppData\Local\Temp\_isF4B.exe
C:\Users\Pascal\AppData\Local\Temp\_isF67E.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-30 20:19

==================== End Of Log ============================
--- --- ---



Addition:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2014 02
Ran by Pascal at 2014-09-02 10:49:14
Running from C:\Users\Pascal\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET Smart Security 7.0 (Disabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 7.0 (Disabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personal Firewall (Disabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4Story (HKCU\...\Kalydo App 4Story) (Version: 4.02.01.26 - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.4.3036 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{44181DF6-2751-48C7-B918-72F14508F127}) (Version: 0.8.4.3036 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dolphin x86 (HKLM-x32\...\Dolphin x86) (Version: 4.0.2 - Dolphin Development Team)
ESET Smart Security (HKLM\...\{F5A3E880-A737-48F2-A124-6F5D4CEA6AB4}) (Version: 7.0.302.26 - ESET, spol s r. o.)
Everything 1.2.1.371 (HKLM-x32\...\Everything) (Version:  - )
Flixster (HKLM-x32\...\com.wb.DC2) (Version: 0.1.26 - Warner Bros. Entertainment Inc.)
Flixster (x32 Version: 0.1.26 - Warner Bros. Entertainment Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free FLV Converter V 7.6.0 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.6.0.0 - Koyote Soft)
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{C1E3DFE7-4EAD-3E9E-A826-E06055BA5921}) (Version: 5.4.2.18903 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
HL-2130 (HKLM-x32\...\{E2A97415-BD97-4867-B906-05E39E9EE51F}) (Version: 1.0.7.0 - Brother Industries, Ltd.)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
InetStat (HKCU\...\InetStat) (Version: 0.5b - InetStat)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{BEE86606-EFB5-4353-9F34-29E0C59CDCFA}) (Version: 15.2.0.0284 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{181BBF43-CA17-4E1A-A78D-81E67A57B8A4}) (Version: 15.02.0000.1258 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Kalydo Player 5.08.00 (HKCU\...\KalydoPlayer) (Version: 5.08.00 - Eximion B.V.)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.7 - www.leaguereplays.com)
Mass Effect™ (HKLM-x32\...\{44A570EE-FD93-4086-8997-2C38DFDE0019}) (Version: 1.2.20608.0 - Electronic Arts)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
OpenVPN 2.3.2-I003  (HKLM\...\OpenVPN) (Version: 2.3.2-I003 - )
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Qualcomm Atheros Killer Network Manager (HKLM-x32\...\InstallShield_{DF446558-ADF7-4884-9B2D-281979CCE71F}) (Version: 6.1.0.437 - Qualcomm Atheros)
Qualcomm Atheros Killer Network Manager (Version: 6.1.0.437 - Qualcomm Atheros) Hidden
Razer Comms (HKLM-x32\...\Razer Comms) (Version: 1.81.19 - Razer Inc.)
Razer Core (HKLM-x32\...\Razer Core) (Version: 1.0.1.52 - Razer Inc)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6690 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.28123 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Rust (HKLM-x32\...\Steam App 252490) (Version:  - Facepunch Studios)
Search-Results Toolbar (HKLM-x32\...\koyotesofttoolbarnew) (Version: 1.0.0.12 - APN LLC) <==== ATTENTION
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
ShootMania Storm (HKLM-x32\...\Steam App 229870) (Version:  - Nadeo)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
System Control Manager (HKLM-x32\...\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}) (Version: 2.211.0629.M007.03 - Micro-Star International Co., Ltd.)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
Uninstall LSI (HKLM-x32\...\{62B332E9-239D-4692-BDE2-0CC1CF2833DA}_is1) (Version: 3.0b - Aequus Gaming Ltd.)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
WinRAR 5.10 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F7D4B6AD-AB5F-4fe8-9469-3A4697E41129}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Kalydo\KalydoPlayer\bin2\kalydoplayer64.dll (Eximion B.V.)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points  =========================

28-08-2014 12:15:26 Windows Update
02-09-2014 01:18:26 Revo Uninstaller's restore point - µTorrent
02-09-2014 01:22:20 Revo Uninstaller's restore point - Ace Stream Media 2.2.3-next
02-09-2014 01:29:34 Revo Uninstaller's restore point - Supporter 1.80
02-09-2014 01:30:39 Revo Uninstaller's restore point - SaveClicker
02-09-2014 01:33:50 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser
02-09-2014 01:34:59 Revo Uninstaller's restore point - CouponSupport
02-09-2014 01:36:40 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser (KB2758694)
02-09-2014 01:37:39 Revo Uninstaller's restore point - Nuance PaperPort 12
02-09-2014 01:39:16 Revo Uninstaller's restore point - Nuance PDF Viewer Plus
02-09-2014 01:39:26 Removed Nuance PDF Viewer Plus.
02-09-2014 01:53:05 MSXML 4.0 SP2 Parser und SDK wird installiert
02-09-2014 02:20:41 Wiederherstellungsvorgang
02-09-2014 08:37:14 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2CF4052C-71E0-4D43-A990-F3CB3D3DDF0B} - System32\Tasks\{A823570D-D055-4DA9-AD9A-7F07615B7887} => C:\Program Files (x86)\lol.launcher.exe
Task: {3BADCC6E-94A1-47C2-880F-62C47C2E5CE2} - System32\Tasks\couponsupport-S-649636217 => c:\support\couponsupport.exe <==== ATTENTION
Task: {53776F1A-FF34-4EF6-B0AA-E71F5F68B1C3} - System32\Tasks\GPUP => C:\Program Files (x86)\GetPrivate\gpup.exe [2014-09-02] ()
Task: {7575F5D7-0C11-40C6-9A57-FD989A880E22} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: {7FFD1C43-4C34-45CA-8990-D29F8DC11036} - System32\Tasks\{FDC74762-4EC3-460A-9B4D-7E89D2BFA585} => C:\Program Files (x86)\lol.launcher.exe
Task: {88D199DC-8BB5-4B6D-94D8-84363AEA807E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {9011B2D5-F2A3-454E-81A0-D51AEB86BA29} - System32\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {9F0C3F1E-43B7-4D61-B796-36DEFB1E3687} - System32\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {AD5890ED-3A93-4416-BAF5-E1EE2D7537F7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {B57B4397-EAE7-43AB-9F70-0277316BE5F1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {CE613082-BFD9-4268-911E-D218E252708C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-24] (Adobe Systems Incorporated)
Task: {D3AA22EF-9B71-4BC2-A24E-ADD58D57C333} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {FC3506E6-9E9E-40EB-B730-5A45A57350F5} - System32\Tasks\Core Temp Autostart Pascal => C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe [2013-10-08] () <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\couponsupport-S-649636217.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core.job => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA.job => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 03:36 - 2014-07-02 22:48 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-08-13 16:47 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-08 18:07 - 2013-10-08 13:23 - 00890016 _____ () C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe
2013-08-13 16:37 - 2013-03-04 09:27 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-09-02 02:49 - 2014-09-02 02:49 - 00750094 _____ () C:\Users\Pascal\AppData\Roaming\InetStat\inetstat.exe
2012-09-24 23:08 - 2012-09-24 23:08 - 00553984 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe
2011-05-09 20:46 - 2011-05-09 20:46 - 02760192 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtCore4.dll
2011-05-09 20:56 - 2011-05-09 20:56 - 09856000 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtGui4.dll
2011-05-09 20:48 - 2011-05-09 20:48 - 00990720 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtNetwork4.dll
2011-05-09 20:47 - 2011-05-09 20:47 - 00416256 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtXml4.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00217600 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFCommon.dll
2011-05-10 12:32 - 2011-05-10 12:32 - 00731648 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\qwt5.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00404992 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modApplications.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00036864 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modFeatures.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00025088 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modFraps.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00240128 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modGraph.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00062464 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modlcd.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00291328 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modNetwork.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00184832 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modNpu.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00211456 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modOptions.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00064000 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modOverview.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00317440 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modSystemInfo.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00490496 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00013272 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-03-21 12:38 - 2014-03-21 12:38 - 00378880 _____ () C:\Program Files (x86)\LOLReplay\LOLUtils.dll
2014-06-13 19:18 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-02-14 13:39 - 2014-02-14 13:39 - 00017920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\7fb509dd6887788f670fac03bb2f996d\PSIClient.ni.dll
2014-07-30 01:39 - 2014-07-30 01:39 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-08-24 11:08 - 2014-08-24 11:08 - 17048240 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/02/2014 10:32:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SearchIndexer.exe, Version: 7.0.7601.17610, Zeitstempel: 0x4dc0d019
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000986ea
ID des fehlerhaften Prozesses: 0x131c
Startzeit der fehlerhaften Anwendung: 0xSearchIndexer.exe0
Pfad der fehlerhaften Anwendung: SearchIndexer.exe1
Pfad des fehlerhaften Moduls: SearchIndexer.exe2
Berichtskennung: SearchIndexer.exe3

Error: (09/02/2014 10:32:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 10:32:42 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 04:29:25 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x80070005.

Error: (09/02/2014 04:29:20 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 04:28:54 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 04:16:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mscorsvw.exe, Version: 4.0.30319.18408, Zeitstempel: 0x523104f3
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000986ea
ID des fehlerhaften Prozesses: 0x1aa0
Startzeit der fehlerhaften Anwendung: 0xmscorsvw.exe0
Pfad der fehlerhaften Anwendung: mscorsvw.exe1
Pfad des fehlerhaften Moduls: mscorsvw.exe2
Berichtskennung: mscorsvw.exe3

Error: (09/02/2014 04:15:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: conhost.exe, Version: 6.1.7601.18229, Zeitstempel: 0x51fb06ba
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000986ea
ID des fehlerhaften Prozesses: 0xf78
Startzeit der fehlerhaften Anwendung: 0xconhost.exe0
Pfad der fehlerhaften Anwendung: conhost.exe1
Pfad des fehlerhaften Moduls: conhost.exe2
Berichtskennung: conhost.exe3

Error: (09/02/2014 04:13:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 04:13:53 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)


System errors:
=============
Error: (09/02/2014 10:48:42 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Erkennung interaktiver Dienste" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/02/2014 10:48:42 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Erkennung interaktiver Dienste erreicht.

Error: (09/02/2014 10:47:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Erkennung interaktiver Dienste" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/02/2014 10:47:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Erkennung interaktiver Dienste erreicht.

Error: (09/02/2014 10:46:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Erkennung interaktiver Dienste" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/02/2014 10:46:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Erkennung interaktiver Dienste erreicht.

Error: (09/02/2014 10:45:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Erkennung interaktiver Dienste" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/02/2014 10:45:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Erkennung interaktiver Dienste erreicht.

Error: (09/02/2014 10:44:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Erkennung interaktiver Dienste" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/02/2014 10:44:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Erkennung interaktiver Dienste erreicht.


Microsoft Office Sessions:
=========================
Error: (09/02/2014 10:32:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: SearchIndexer.exe7.0.7601.176104dc0d019ntdll.dll6.1.7601.18247521eaf24c000000500000000000986ea131c01cfc68877fdeadeC:\Windows\system32\SearchIndexer.exeC:\Windows\SYSTEM32\ntdll.dllb77840b4-327b-11e4-856f-6036ddf28671

Error: (09/02/2014 10:32:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 10:32:42 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 04:29:25 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: Windows Update0x80070005

Error: (09/02/2014 04:29:20 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 04:28:54 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 04:16:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: mscorsvw.exe4.0.30319.18408523104f3ntdll.dll6.1.7601.18247521eaf24c000000500000000000986ea1aa001cfc653db04d422C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\SYSTEM32\ntdll.dll19390d72-3247-11e4-8b34-6036ddf28671

Error: (09/02/2014 04:15:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: conhost.exe6.1.7601.1822951fb06bantdll.dll6.1.7601.18247521eaf24c000000500000000000986eaf7801cfc653d210f3c3C:\Windows\system32\conhost.exeC:\Windows\SYSTEM32\ntdll.dll0fc24164-3247-11e4-8b34-6036ddf28671

Error: (09/02/2014 04:13:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 04:13:53 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)


CodeIntegrity Errors:
===================================
  Date: 2014-08-30 00:09:51.176
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-12 18:23:39.179
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-08 12:42:53.481
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-05 20:07:05.414
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-25 21:53:02.701
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-17 23:40:00.116
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-13 23:48:25.069
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:43:47.210
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:39:24.625
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:35:12.530
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz
Percentage of memory in use: 39%
Total physical RAM: 8084.77 MB
Available physical RAM: 4879.14 MB
Total Pagefile: 16167.73 MB
Available Pagefile: 12582.11 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:696.77 GB) (Free:523.89 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (╗§ ║╝À²) (Fixed) (Total:1.86 GB) (Free:1.64 GB) FAT32 ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 18836D0D)
Partition 1: (Not Active) - (Size=1.9 GB) - (Type=0B)
Partition 2: (Active) - (Size=696.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
__________________
Alt 02.09.2014, 10:16   #4
Bootsektor
Ruhe in Frieden
† 2019
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Hallo,


Schritt 1
Bitte deinstalliere folgende Programme (falls vorhanden) :
Search-Results Toolbar


Dazu gehe auf:
den Windowsbutton in der Taskleiste --> Systemsteuerung --> Programme (Unterpunkt Programme deinstallieren) --> Programm auswählen --> entfernen

Falls du ein Programm nicht deinstallieren kannst, lade dir von hier den Revo-uninstaller herunter und deinstalliere es damit, wähle dabei den moderaten Modus.



Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Klicke im Anschluss auf Suchlauf, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf jetzt starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Aktionen anwenden.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Wähle Exportieren auf Textdatei (.txt) und speichere die Datei als mbam.txt auf dem Desktop ab.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 4
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.
Alt 02.09.2014, 11:03   #5
ChicoMarx
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Done.
Erwähnenswert ist vielleichtt, dass das Löschen beim AdwCleaner nicht beim 1. Mal funktioniert hat (Programm reagierte nicht), sondern erst beim 2. Mal.
Aus Firefox wurden dabei 3 Zeilen gelöscht. Seitdem öffnen sich beim Öffnen die gleichen 3 Seiten (2 Firefox (als hätte ich es neu geupdated) + 1 DownloadHelper (ebenfalls)). Mal sehen, ob das so bleibt.

Außerdem möchte Windows beim nächsten Herunterfahren ein Update machen. Soll ich das zulassen?

AdwCleaner:

Code:
ATTFilter
# AdwCleaner v3.308 - Bericht erstellt am 02/09/2014 um 11:29:31
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Pascal - PASCAL-PC
# Gestartet von : C:\Users\Pascal\Downloads\adwcleaner_3.308.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Pascal\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Pascal\AppData\LocalLow\DataMngr
Ordner Gelöscht : C:\Users\Pascal\AppData\LocalLow\searchresultstb
Ordner Gelöscht : C:\Users\Pascal\AppData\Roaming\GetPrivate
Ordner Gelöscht : C:\Users\Pascal\AppData\Roaming\InetStat
Ordner Gelöscht : C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
Ordner Gelöscht : C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org
Ordner Gelöscht : C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda
Datei Gelöscht : C:\Users\Pascal\AppData\Local\Temp\Searchqu.ini
Datei Gelöscht : C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\searchplugins\Search_Results.xml

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [InetStat]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3EC1A45C-8BC3-4BFE-B226-4051C5D3D068}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3EC1A45C-8BC3-4BFE-B226-4051C5D3D068}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3EC1A45C-8BC3-4BFE-B226-4051C5D3D068}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3EC1A45C-8BC3-4BFE-B226-4051C5D3D068}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\RegisteredApplicationsEx
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Schlüssel Gelöscht : HKLM\SOFTWARE\SearchquSRTB
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DataMngr
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.17054

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.order.1", "Search Results");
Zeile gelöscht : user_pref("extensions.D3MEWqw.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumorobo[...]
Zeile gelöscht : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&apn_uid=1243419007314614&o=APN10649&q=");

-\\ Google Chrome v36.0.1985.143

[ Datei : C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Extension] : lnjgabhmdpbmeippbedflhicaifogeda

*************************

AdwCleaner[R0].txt - [5681 octets] - [02/09/2014 11:26:35]
AdwCleaner[R1].txt - [5492 octets] - [02/09/2014 11:29:03]
AdwCleaner[S0].txt - [674 octets] - [02/09/2014 11:28:30]
AdwCleaner[S1].txt - [4945 octets] - [02/09/2014 11:29:31]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5005 octets] ##########
Malwarebytes:

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 02.09.2014
Suchlauf-Zeit: 11:38:38
Logdatei: Malwarebytes_Log.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.02.03
Rootkit Datenbank: v2014.08.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Pascal

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 298792
Verstrichene Zeit: 9 Min, 41 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 9
PUP.Optional.MultiPlug, C:\Users\Pascal\AppData\Local\Temp\bxm3mlzr.srj.exe, In Quarantäne, [3f9c9553d7a4c76f4f83e0d1d72a748c], 
PUP.Optional.Amonetize, C:\Users\Pascal\AppData\Local\Temp\nPMc1fZn.exe.part, In Quarantäne, [fbe023c5f784999db79ad85bf01144bc], 
PUP.Optional.MultiPlug.A, C:\Users\Pascal\AppData\Local\Temp\4ae13d6c_.exe, In Quarantäne, [4497f6f24f2c3cfa8ccc92ada65b758b], 
Trojan.SProtector, C:\Users\Pascal\AppData\Local\Temp\18be6784_.exe, In Quarantäne, [30ab10d8f08b0d294f5cacb118e99b65], 
PUP.Optional.SearchHijacker.A, C:\Users\Pascal\AppData\Local\Temp\wypo53rq.yg1.exe, In Quarantäne, [c41748a08deecb6bb7250c9fce33ef11], 
PUP.Optional.Amonetize, C:\Users\Pascal\AppData\Local\Temp\ycmHsdK5.exe.part, In Quarantäne, [706b32b6f08b2c0a67ea082b5aa77888], 
Trojan.SProtector, C:\Users\Pascal\AppData\Local\Temp\__tmp_354a446b, In Quarantäne, [7c5ff0f82e4d69cda05ef077c33e0af6], 
PUP.Optional.MultiPlug.A, C:\Windows\Tasks\couponsupport-S-649636217.job, In Quarantäne, [20bbebfd0c6f3cfa7845b38ff31123dd], 
PUP.Optional.MultiPlug.A, C:\Windows\System32\Tasks\couponsupport-S-649636217, In Quarantäne, [f8e35a8e463549ed3a4b2830c341db25], 

Physische Sektoren: 0
(No malicious items detected)


(end)
FRST:


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran by Pascal (administrator) on PASCAL-PC on 02-09-2014 11:56:41
Running from C:\Users\Pascal\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2013-03-04] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2013-03-04] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5618456 2013-09-12] (ESET)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [MGSysCtrl] => C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2011-06-29] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2013-03-04] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [807696 2013-12-20] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [LOLReplay Recorder] => C:\Program Files (x86)\LOLReplay\LOLRecorder.exe [494592 2014-03-21] (LOL Replay)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [Google Update] => "C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe" /c
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32: , C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Qualcomm Atheros Killer Network Manager.lnk
ShortcutTarget: Qualcomm Atheros Killer Network Manager.lnk -> C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe ()
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 02 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 03 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 04 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 16 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 01 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 02 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 03 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 04 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 16 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: @eximion.com/KalydoPlayer -> C:\Users\Pascal\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Pascal\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Pascal\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Pascal\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Users\Pascal\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Pascal\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-21]
FF Extension: ArchiveFacebook - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{53A03D43-5363-4669-8190-99061B2DEBA6} [2013-10-29]
FF Extension: DownloadHelper - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-12]
FF Extension: YouTube HD - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\jid0-HbNL9qqBkuuKRhJ9ncTonCky1HU@jetpack.xpi [2013-10-10]
FF Extension: Reddit Enhancement Suite - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi [2014-02-20]
FF Extension: Personas Plus - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\personas@christopher.beard.xpi [2013-09-26]
FF Extension: Search By Image (by Google) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{ce7e73df-6a44-4028-8079-5927a588c948}.xpi [2014-07-15]
FF Extension: HTMLPlugin - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{cebded91-c3d7-4bfd-9715-e4d365081986}.xpi [2014-05-30]
FF Extension: Adblock Plus - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-14]
FF Extension: {e0a2a72e-d3e5-46bf-8206-863d31912e68} - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{e0a2a72e-d3e5-46bf-8206-863d31912e68}.xpi [2014-05-26]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-01-22]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

Chrome: 
=======
CHR HomePage: Default -> 
CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-19]
CHR Extension: (Google Drive) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-19]
CHR Extension: (YouTube) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-19]
CHR Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-08-26]
CHR Extension: (Google-Suche) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-19]
CHR Extension: (No Name) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda [2014-09-02]
CHR Extension: (AS Magic Player) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim [2014-07-04]
CHR Extension: (Google Wallet) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-19]
CHR Extension: (Google Mail) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-19]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [402192 2013-12-20] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2013-12-20] (BlueStack Systems, Inc.)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1337752 2013-09-12] (ESET)
R2 Micro Star SCM; C:\Program Files (x86)\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [37176 2013-08-22] (The OpenVPN Project)
R2 Qualcomm Atheros Killer Service; C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [490496 2012-09-24] () [File not signed]
R2 RzOvlMon; C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe [32960 2013-11-21] (Razer, Inc.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [66928 2012-09-24] (Qualcomm Atheros, Inc.)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [114448 2013-12-20] (BlueStack Systems)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)
R3 L1C; C:\Windows\System32\DRIVERS\e22w7x64.sys [157552 2012-09-24] (Qualcomm Atheros, Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-02] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 RzDxgk; C:\Windows\system32\drivers\RzDxgk.sys [129472 2013-11-21] (Razer, Inc.)
R0 RzFilter; C:\Windows\System32\drivers\RzFilter.sys [74432 2013-11-21] (Razer, Inc.)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 ALSysIO; \??\C:\Users\Pascal\AppData\Local\Temp\ALSysIO64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-02 11:37 - 2014-09-02 11:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-02 11:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-02 11:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-02 11:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-02 11:36 - 2014-09-02 11:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Pascal\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-02 11:31 - 2014-09-02 11:31 - 00005101 _____ () C:\Users\Pascal\Desktop\AdwCleaner[S1].txt
2014-09-02 11:26 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-09-02 11:25 - 2014-09-02 11:29 - 00000000 ____D () C:\AdwCleaner
2014-09-02 11:25 - 2014-09-02 11:25 - 01364531 _____ () C:\Users\Pascal\Downloads\adwcleaner_3.308.exe
2014-09-02 10:49 - 2014-09-02 10:49 - 00038877 _____ () C:\Users\Pascal\Downloads\Addition.txt
2014-09-02 10:48 - 2014-09-02 11:57 - 00021519 _____ () C:\Users\Pascal\Downloads\FRST.txt
2014-09-02 10:48 - 2014-09-02 11:56 - 00000000 ____D () C:\FRST
2014-09-02 10:47 - 2014-09-02 10:47 - 02104832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe
2014-09-02 03:53 - 2014-09-02 03:53 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-09-02 03:52 - 2014-09-02 03:52 - 05314560 _____ () C:\Users\Pascal\Downloads\msxmlger.msi
2014-09-02 02:49 - 2014-09-02 02:49 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Packages
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Comodo
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\ProgramData\46ec6306412c2933
2014-09-02 02:48 - 2014-09-02 02:48 - 00003260 _____ () C:\Windows\System32\Tasks\GPUP
2014-08-29 17:00 - 2014-08-29 17:00 - 00295816 _____ () C:\Windows\Minidump\082914-23197-01.dmp
2014-08-28 10:50 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 10:50 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 10:50 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 18:47 - 2014-09-02 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-08-27 18:47 - 2014-08-27 18:47 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-08-27 18:46 - 2014-08-27 18:46 - 00270848 _____ (Secure By Design Inc.) C:\Users\Pascal\Downloads\Ninite Firefox VLC Installer.exe
2014-08-26 16:17 - 2014-08-26 16:17 - 00001351 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-08-26 16:15 - 2014-09-02 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\system32\NV
2014-08-26 16:15 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-26 16:13 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2014-08-26 16:13 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-08-26 16:13 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-08-26 16:13 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-08-26 16:07 - 2014-08-26 16:11 - 274075712 _____ (NVIDIA Corporation) C:\Users\Pascal\Downloads\340.52-notebook-win8-win7-64bit-international-whql.exe
2014-08-25 16:44 - 2014-08-25 16:44 - 00012267 _____ () C:\Users\Pascal\Documents\GEZ.odt
2014-08-24 18:45 - 2014-08-24 18:45 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Adobe
2014-08-22 10:50 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-22 10:50 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-22 10:50 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-22 10:50 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-22 10:50 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-22 10:49 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-22 10:49 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-22 10:49 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-22 10:49 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-19 20:07 - 2014-08-19 20:08 - 00005604 _____ () C:\Windows\system32\lvcoinst.log
2014-08-19 20:07 - 2014-08-19 20:07 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-08-18 21:46 - 2014-08-18 21:47 - 01058200 _____ (Adobe) C:\Users\Pascal\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-16 18:38 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 18:38 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-16 18:38 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 18:38 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 18:38 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-16 18:38 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-16 18:37 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-16 18:37 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 17:10 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-16 17:10 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-16 17:10 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-16 17:10 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-16 17:10 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-16 17:10 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-16 17:10 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-16 17:10 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-16 17:10 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-16 17:10 - 2014-07-24 11:37 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-08-16 17:10 - 2014-07-24 11:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-08-16 16:58 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-16 16:58 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-16 16:58 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-16 16:58 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-16 16:58 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-16 16:58 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-16 16:58 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-16 16:58 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-16 16:58 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 16:58 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-16 16:58 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-16 16:58 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-16 16:58 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-12 18:13 - 2014-08-12 18:13 - 00295728 _____ () C:\Windows\Minidump\081214-27003-01.dmp
2014-08-09 11:10 - 2014-08-09 11:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-09 11:10 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\Program Files\iTunes
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-09 11:09 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-02 11:57 - 2014-09-02 10:48 - 00021519 _____ () C:\Users\Pascal\Downloads\FRST.txt
2014-09-02 11:56 - 2014-09-02 10:48 - 00000000 ____D () C:\FRST
2014-09-02 11:54 - 2014-09-02 11:37 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-02 11:54 - 2014-06-19 22:49 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7.job
2014-09-02 11:52 - 2013-08-13 16:02 - 00000000 ____D () C:\ProgramData\Bigfoot Networks
2014-09-02 11:51 - 2014-06-19 22:49 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4.job
2014-09-02 11:51 - 2009-07-14 06:51 - 00122909 _____ () C:\Windows\setupact.log
2014-09-02 11:50 - 2010-11-21 05:47 - 00201174 _____ () C:\Windows\PFRO.log
2014-09-02 11:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-02 11:49 - 2013-08-13 15:06 - 01318816 _____ () C:\Windows\WindowsUpdate.log
2014-09-02 11:41 - 2014-04-11 00:24 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA.job
2014-09-02 11:38 - 2009-07-14 06:45 - 00029120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-02 11:38 - 2009-07-14 06:45 - 00029120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-02 11:37 - 2011-04-12 09:43 - 04990672 _____ () C:\Windows\system32\perfh007.dat
2014-09-02 11:37 - 2011-04-12 09:43 - 01529762 _____ () C:\Windows\system32\perfc007.dat
2014-09-02 11:37 - 2009-07-14 07:13 - 00007128 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-02 11:36 - 2014-09-02 11:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Pascal\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-02 11:31 - 2014-09-02 11:31 - 00005101 _____ () C:\Users\Pascal\Desktop\AdwCleaner[S1].txt
2014-09-02 11:29 - 2014-09-02 11:25 - 00000000 ____D () C:\AdwCleaner
2014-09-02 11:28 - 2013-11-30 02:32 - 00000000 ____D () C:\Users\Pascal\AppData\Local\CrashDumps
2014-09-02 11:25 - 2014-09-02 11:25 - 01364531 _____ () C:\Users\Pascal\Downloads\adwcleaner_3.308.exe
2014-09-02 11:13 - 2013-08-20 13:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-02 10:49 - 2014-09-02 10:49 - 00038877 _____ () C:\Users\Pascal\Downloads\Addition.txt
2014-09-02 10:47 - 2014-09-02 10:47 - 02104832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe
2014-09-02 04:26 - 2014-08-27 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-09-02 04:26 - 2014-08-26 16:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-02 04:26 - 2014-06-13 19:18 - 00000000 ____D () C:\Program Files (x86)\Browny02
2014-09-02 04:26 - 2014-02-08 16:12 - 00000000 ____D () C:\Program Files (x86)\Everything
2014-09-02 04:25 - 2013-12-18 20:44 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Battle.net
2014-09-02 04:25 - 2013-09-17 08:07 - 00000000 ____D () C:\Windows\Minidump
2014-09-02 04:25 - 2013-08-20 15:52 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\FreeFLVConverter
2014-09-02 04:25 - 2013-08-20 14:25 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\IrfanView
2014-09-02 04:25 - 2013-08-13 15:12 - 00000000 ____D () C:\Users\Pascal
2014-09-02 04:25 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-09-02 04:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-09-02 04:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-09-02 04:13 - 2009-07-14 06:45 - 00297744 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-02 03:53 - 2014-09-02 03:53 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-09-02 03:52 - 2014-09-02 03:52 - 05314560 _____ () C:\Users\Pascal\Downloads\msxmlger.msi
2014-09-02 03:47 - 2013-08-13 16:32 - 00065592 _____ () C:\Users\Pascal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-02 03:40 - 2014-03-08 19:07 - 00000000 ____D () C:\ProgramData\Nuance
2014-09-02 03:40 - 2014-03-08 19:07 - 00000000 ____D () C:\Program Files (x86)\Nuance
2014-09-02 03:38 - 2014-03-08 19:08 - 00000000 ____D () C:\ProgramData\ScanSoft
2014-09-02 03:32 - 2013-08-14 13:39 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Apple Computer
2014-09-02 03:26 - 2014-01-21 16:01 - 00000000 ____D () C:\inetpub
2014-09-02 03:24 - 2014-04-08 22:18 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\ACEStream
2014-09-02 03:24 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-02 03:20 - 2013-08-20 15:41 - 00000000 ____D () C:\Users\Pascal\dwhelper
2014-09-02 02:49 - 2014-09-02 02:49 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Packages
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Comodo
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\ProgramData\46ec6306412c2933
2014-09-02 02:49 - 2014-06-19 22:42 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-02 02:49 - 2014-04-11 00:23 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Google
2014-09-02 02:48 - 2014-09-02 02:48 - 00003260 _____ () C:\Windows\System32\Tasks\GPUP
2014-09-02 01:44 - 2013-08-14 13:27 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Skype
2014-09-01 23:34 - 2013-08-26 18:40 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\TS3Client
2014-09-01 20:08 - 2013-12-18 20:44 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Battle.net
2014-08-31 21:41 - 2014-04-11 00:23 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core.job
2014-08-29 17:00 - 2014-08-29 17:00 - 00295816 _____ () C:\Windows\Minidump\082914-23197-01.dmp
2014-08-29 17:00 - 2013-09-17 08:07 - 462873505 _____ () C:\Windows\MEMORY.DMP
2014-08-27 18:47 - 2014-08-27 18:47 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-08-27 18:47 - 2013-08-14 13:35 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-08-27 18:46 - 2014-08-27 18:46 - 00270848 _____ (Secure By Design Inc.) C:\Users\Pascal\Downloads\Ninite Firefox VLC Installer.exe
2014-08-27 12:26 - 2013-10-04 22:06 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-08-26 16:17 - 2014-08-26 16:17 - 00001351 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-08-26 16:17 - 2014-05-08 17:51 - 00000000 ____D () C:\Users\Pascal\AppData\Local\NVIDIA Corporation
2014-08-26 16:17 - 2013-11-02 21:57 - 00000000 ____D () C:\Users\Pascal\AppData\Local\NVIDIA
2014-08-26 16:17 - 2013-08-13 16:47 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\system32\NV
2014-08-26 16:15 - 2013-08-13 16:48 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-26 16:15 - 2013-08-13 16:47 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-26 16:15 - 2013-08-13 16:45 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-26 16:11 - 2014-08-26 16:07 - 274075712 _____ (NVIDIA Corporation) C:\Users\Pascal\Downloads\340.52-notebook-win8-win7-64bit-international-whql.exe
2014-08-25 16:44 - 2014-08-25 16:44 - 00012267 _____ () C:\Users\Pascal\Documents\GEZ.odt
2014-08-24 18:45 - 2014-08-24 18:45 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Adobe
2014-08-24 16:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-24 11:08 - 2013-08-20 13:32 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-24 11:08 - 2013-08-20 13:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-24 11:08 - 2013-08-20 13:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-23 04:07 - 2014-08-28 10:50 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 10:50 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 10:50 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 12:42 - 2013-12-18 20:44 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-22 00:30 - 2013-09-09 20:37 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-08-19 20:08 - 2014-08-19 20:07 - 00005604 _____ () C:\Windows\system32\lvcoinst.log
2014-08-19 20:07 - 2014-08-19 20:07 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-08-19 11:16 - 2013-12-18 20:45 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-18 21:56 - 2014-06-19 22:43 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-18 21:47 - 2014-08-18 21:46 - 01058200 _____ (Adobe) C:\Users\Pascal\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-16 18:42 - 2013-09-11 11:51 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-16 18:40 - 2013-09-11 11:51 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-16 18:37 - 2014-05-06 12:01 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 18:13 - 2014-08-12 18:13 - 00295728 _____ () C:\Windows\Minidump\081214-27003-01.dmp
2014-08-09 11:10 - 2014-08-09 11:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-09 11:10 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iTunes
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-09 11:09 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iPod
2014-08-07 20:58 - 2013-08-14 13:27 - 00000000 ____D () C:\ProgramData\Skype
2014-08-07 04:06 - 2014-08-16 16:58 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-16 16:58 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 14:22 - 2013-08-14 13:26 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-08-05 09:20 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\Pascal\AppData\Local\Temp\294823_.exe
C:\Users\Pascal\AppData\Local\Temp\installhelper.dll
C:\Users\Pascal\AppData\Local\Temp\install_flashplayer11x32au_mssa_aaa_aih.exe
C:\Users\Pascal\AppData\Local\Temp\InstHelper.exe
C:\Users\Pascal\AppData\Local\Temp\k4n4zoue.dll
C:\Users\Pascal\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe
C:\Users\Pascal\AppData\Local\Temp\Quarantine.exe
C:\Users\Pascal\AppData\Local\Temp\Setup.exe
C:\Users\Pascal\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Pascal\AppData\Local\Temp\sfextra.dll
C:\Users\Pascal\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Pascal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Pascal\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Pascal\AppData\Local\Temp\vybxk5zm.ie0.exe
C:\Users\Pascal\AppData\Local\Temp\_is4164.exe
C:\Users\Pascal\AppData\Local\Temp\_is457B.exe
C:\Users\Pascal\AppData\Local\Temp\_is5BB6.exe
C:\Users\Pascal\AppData\Local\Temp\_is85E3.exe
C:\Users\Pascal\AppData\Local\Temp\_is8DBE.exe
C:\Users\Pascal\AppData\Local\Temp\_isAD62.exe
C:\Users\Pascal\AppData\Local\Temp\_isC2C9.exe
C:\Users\Pascal\AppData\Local\Temp\_isC34E.exe
C:\Users\Pascal\AppData\Local\Temp\_isD96.exe
C:\Users\Pascal\AppData\Local\Temp\_isF4B.exe
C:\Users\Pascal\AppData\Local\Temp\_isF67E.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-30 20:19

==================== End Of Log ============================
--- --- ---


Addition:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2014 02
Ran by Pascal at 2014-09-02 11:57:58
Running from C:\Users\Pascal\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET Smart Security 7.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 7.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personal Firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4Story (HKCU\...\Kalydo App 4Story) (Version: 4.02.01.26 - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.4.3036 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{44181DF6-2751-48C7-B918-72F14508F127}) (Version: 0.8.4.3036 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dolphin x86 (HKLM-x32\...\Dolphin x86) (Version: 4.0.2 - Dolphin Development Team)
ESET Smart Security (HKLM\...\{F5A3E880-A737-48F2-A124-6F5D4CEA6AB4}) (Version: 7.0.302.26 - ESET, spol s r. o.)
Everything 1.2.1.371 (HKLM-x32\...\Everything) (Version:  - )
Flixster (HKLM-x32\...\com.wb.DC2) (Version: 0.1.26 - Warner Bros. Entertainment Inc.)
Flixster (x32 Version: 0.1.26 - Warner Bros. Entertainment Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free FLV Converter V 7.6.0 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.6.0.0 - Koyote Soft)
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{C1E3DFE7-4EAD-3E9E-A826-E06055BA5921}) (Version: 5.4.2.18903 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
HL-2130 (HKLM-x32\...\{E2A97415-BD97-4867-B906-05E39E9EE51F}) (Version: 1.0.7.0 - Brother Industries, Ltd.)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
InetStat (HKCU\...\InetStat) (Version: 0.5b - InetStat)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{BEE86606-EFB5-4353-9F34-29E0C59CDCFA}) (Version: 15.2.0.0284 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{181BBF43-CA17-4E1A-A78D-81E67A57B8A4}) (Version: 15.02.0000.1258 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Kalydo Player 5.08.00 (HKCU\...\KalydoPlayer) (Version: 5.08.00 - Eximion B.V.)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.7 - www.leaguereplays.com)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mass Effect™ (HKLM-x32\...\{44A570EE-FD93-4086-8997-2C38DFDE0019}) (Version: 1.2.20608.0 - Electronic Arts)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
OpenVPN 2.3.2-I003  (HKLM\...\OpenVPN) (Version: 2.3.2-I003 - )
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Qualcomm Atheros Killer Network Manager (HKLM-x32\...\InstallShield_{DF446558-ADF7-4884-9B2D-281979CCE71F}) (Version: 6.1.0.437 - Qualcomm Atheros)
Qualcomm Atheros Killer Network Manager (Version: 6.1.0.437 - Qualcomm Atheros) Hidden
Razer Comms (HKLM-x32\...\Razer Comms) (Version: 1.81.19 - Razer Inc.)
Razer Core (HKLM-x32\...\Razer Core) (Version: 1.0.1.52 - Razer Inc)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6690 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.28123 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Rust (HKLM-x32\...\Steam App 252490) (Version:  - Facepunch Studios)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
ShootMania Storm (HKLM-x32\...\Steam App 229870) (Version:  - Nadeo)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
System Control Manager (HKLM-x32\...\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}) (Version: 2.211.0629.M007.03 - Micro-Star International Co., Ltd.)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
Uninstall LSI (HKLM-x32\...\{62B332E9-239D-4692-BDE2-0CC1CF2833DA}_is1) (Version: 3.0b - Aequus Gaming Ltd.)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
WinRAR 5.10 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F7D4B6AD-AB5F-4fe8-9469-3A4697E41129}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Kalydo\KalydoPlayer\bin2\kalydoplayer64.dll (Eximion B.V.)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points  =========================

28-08-2014 12:15:26 Windows Update
02-09-2014 01:18:26 Revo Uninstaller's restore point - µTorrent
02-09-2014 01:22:20 Revo Uninstaller's restore point - Ace Stream Media 2.2.3-next
02-09-2014 01:29:34 Revo Uninstaller's restore point - Supporter 1.80
02-09-2014 01:30:39 Revo Uninstaller's restore point - SaveClicker
02-09-2014 01:33:50 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser
02-09-2014 01:34:59 Revo Uninstaller's restore point - CouponSupport
02-09-2014 01:36:40 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser (KB2758694)
02-09-2014 01:37:39 Revo Uninstaller's restore point - Nuance PaperPort 12
02-09-2014 01:39:16 Revo Uninstaller's restore point - Nuance PDF Viewer Plus
02-09-2014 01:39:26 Removed Nuance PDF Viewer Plus.
02-09-2014 01:53:05 MSXML 4.0 SP2 Parser und SDK wird installiert
02-09-2014 02:20:41 Wiederherstellungsvorgang
02-09-2014 08:37:14 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2CF4052C-71E0-4D43-A990-F3CB3D3DDF0B} - System32\Tasks\{A823570D-D055-4DA9-AD9A-7F07615B7887} => C:\Program Files (x86)\lol.launcher.exe
Task: {53776F1A-FF34-4EF6-B0AA-E71F5F68B1C3} - System32\Tasks\GPUP => C:\Program Files (x86)\GetPrivate\gpup.exe
Task: {7575F5D7-0C11-40C6-9A57-FD989A880E22} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: {7FFD1C43-4C34-45CA-8990-D29F8DC11036} - System32\Tasks\{FDC74762-4EC3-460A-9B4D-7E89D2BFA585} => C:\Program Files (x86)\lol.launcher.exe
Task: {88D199DC-8BB5-4B6D-94D8-84363AEA807E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {9011B2D5-F2A3-454E-81A0-D51AEB86BA29} - System32\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {9F0C3F1E-43B7-4D61-B796-36DEFB1E3687} - System32\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {AD5890ED-3A93-4416-BAF5-E1EE2D7537F7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {B57B4397-EAE7-43AB-9F70-0277316BE5F1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {CE613082-BFD9-4268-911E-D218E252708C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-24] (Adobe Systems Incorporated)
Task: {D3AA22EF-9B71-4BC2-A24E-ADD58D57C333} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {FC3506E6-9E9E-40EB-B730-5A45A57350F5} - System32\Tasks\Core Temp Autostart Pascal => C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe [2013-10-08] () <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core.job => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA.job => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 03:36 - 2014-07-02 22:48 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-08-13 16:47 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-08 18:07 - 2013-10-08 13:23 - 00890016 _____ () C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe
2012-09-24 23:08 - 2012-09-24 23:08 - 00490496 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe
2011-05-09 20:46 - 2011-05-09 20:46 - 02760192 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtCore4.dll
2011-05-09 20:56 - 2011-05-09 20:56 - 09856000 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtGui4.dll
2011-05-09 20:47 - 2011-05-09 20:47 - 00416256 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtXml4.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00217600 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFCommon.dll
2011-05-10 12:32 - 2011-05-10 12:32 - 00731648 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\qwt5.dll
2011-05-09 20:48 - 2011-05-09 20:48 - 00990720 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtNetwork4.dll
2013-08-13 16:37 - 2013-03-04 09:27 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00553984 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe
2012-09-24 23:08 - 2012-09-24 23:08 - 00404992 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modApplications.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00036864 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modFeatures.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00025088 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modFraps.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00240128 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modGraph.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00062464 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modlcd.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00291328 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modNetwork.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00184832 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modNpu.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00211456 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modOptions.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00064000 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modOverview.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00317440 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modSystemInfo.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00013272 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-03-21 12:38 - 2014-03-21 12:38 - 00378880 _____ () C:\Program Files (x86)\LOLReplay\LOLUtils.dll
2014-06-13 19:18 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-07-30 01:39 - 2014-07-30 01:39 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-14 13:39 - 2014-02-14 13:39 - 00017920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\7fb509dd6887788f670fac03bb2f996d\PSIClient.ni.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/02/2014 11:51:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 11:51:19 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 11:37:07 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (09/02/2014 11:37:07 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (09/02/2014 11:37:06 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (09/02/2014 11:31:02 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 11:31:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 11:28:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.308.exe, Version: 3.3.0.8, Zeitstempel: 0x4f25baec
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00066fbb
ID des fehlerhaften Prozesses: 0x1324
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.308.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.308.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.308.exe2
Berichtskennung: adwcleaner_3.308.exe3

Error: (09/02/2014 10:32:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SearchIndexer.exe, Version: 7.0.7601.17610, Zeitstempel: 0x4dc0d019
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000986ea
ID des fehlerhaften Prozesses: 0x131c
Startzeit der fehlerhaften Anwendung: 0xSearchIndexer.exe0
Pfad der fehlerhaften Anwendung: SearchIndexer.exe1
Pfad des fehlerhaften Moduls: SearchIndexer.exe2
Berichtskennung: SearchIndexer.exe3

Error: (09/02/2014 10:32:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (09/02/2014 11:53:27 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/02/2014 11:51:19 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 
%%1064

Error: (09/02/2014 11:51:11 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PDFProFiltSrvPP" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/02/2014 11:50:59 AM) (Source: APPHOSTSVC) (EventID: 9010) (User: )
Description: Fehler im Anwendungshost-Hilfsdienst beim Zugriff auf das Verlaufsstammverzeichnis "C:\inetpub\history". Das Verzeichnis ist nicht vorhanden, oder die Berechtigungen für das Verzeichnis lassen den Zugriff des Verzeichnisdiensts auf das Verzeichnis nicht zu. Das Konfigurationsverlaufsfeature wird deaktiviert und erneut aktiviert, nachdem das Problem behoben wurde. Stellen Sie zum Beheben des Problems sicher, dass das Verzeichnis vorhanden ist und dass die Gruppe "Administratoren" über Lese- und Schreibzugriff auf das Verzeichnis verfügt. Das Datenfeld enthält die Fehlernummer.

Error: (09/02/2014 11:33:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/02/2014 11:31:02 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 
%%1064

Error: (09/02/2014 11:30:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PDFProFiltSrvPP" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/02/2014 11:30:47 AM) (Source: APPHOSTSVC) (EventID: 9010) (User: )
Description: Fehler im Anwendungshost-Hilfsdienst beim Zugriff auf das Verlaufsstammverzeichnis "C:\inetpub\history". Das Verzeichnis ist nicht vorhanden, oder die Berechtigungen für das Verzeichnis lassen den Zugriff des Verzeichnisdiensts auf das Verzeichnis nicht zu. Das Konfigurationsverlaufsfeature wird deaktiviert und erneut aktiviert, nachdem das Problem behoben wurde. Stellen Sie zum Beheben des Problems sicher, dass das Verzeichnis vorhanden ist und dass die Gruppe "Administratoren" über Lese- und Schreibzugriff auf das Verzeichnis verfügt. Das Datenfeld enthält die Fehlernummer.

Error: (09/02/2014 11:29:42 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Erkennung interaktiver Dienste" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/02/2014 11:29:42 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Erkennung interaktiver Dienste erreicht.


Microsoft Office Sessions:
=========================
Error: (09/02/2014 11:51:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 11:51:19 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 11:37:07 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (09/02/2014 11:37:07 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (09/02/2014 11:37:06 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (09/02/2014 11:31:02 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 11:31:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 11:28:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: adwcleaner_3.308.exe3.3.0.84f25baecntdll.dll6.1.7601.18247521ea8e7c000000500066fbb132401cfc68fdf0ff7ddC:\Users\Pascal\Downloads\adwcleaner_3.308.exeC:\Windows\SysWOW64\ntdll.dll82215fbc-3283-11e4-856f-6036ddf28671

Error: (09/02/2014 10:32:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: SearchIndexer.exe7.0.7601.176104dc0d019ntdll.dll6.1.7601.18247521eaf24c000000500000000000986ea131c01cfc68877fdeadeC:\Windows\system32\SearchIndexer.exeC:\Windows\SYSTEM32\ntdll.dllb77840b4-327b-11e4-856f-6036ddf28671

Error: (09/02/2014 10:32:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2014-08-30 00:09:51.176
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-12 18:23:39.179
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-08 12:42:53.481
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-05 20:07:05.414
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-25 21:53:02.701
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-17 23:40:00.116
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-13 23:48:25.069
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:43:47.210
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:39:24.625
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:35:12.530
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz
Percentage of memory in use: 35%
Total physical RAM: 8084.77 MB
Available physical RAM: 5233.04 MB
Total Pagefile: 16167.73 MB
Available Pagefile: 13185.64 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:696.77 GB) (Free:523.2 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (╗§ ║╝À²) (Fixed) (Total:1.86 GB) (Free:1.64 GB) FAT32 ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 18836D0D)
Partition 1: (Not Active) - (Size=1.9 GB) - (Type=0B)
Partition 2: (Active) - (Size=696.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================


Alt 02.09.2014, 11:25   #6
Bootsektor
Ruhe in Frieden
† 2019
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Hallo,

Zitat:
Mal sehen, ob das so bleibt.
Na, das hoffe ich doch nicht, dass das so bleibt

Hast du core temp auf dem Rechner installiert?

Wie sieht es nach diesen Schritten aus?

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
FF Extension: DownloadHelper - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-12]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 2
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.
__________________
--> Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe

Alt 02.09.2014, 11:51   #7
ChicoMarx
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Ja, Core Temp habe (hatte ich schon vorher) installiert.

€: Ich habe immer noch das Problem, dass Firefox nicht die gespeicherten (letzten) Tabs öffnet, sondern jetzt nur noch die 2 Firefoxstartseiten. Außerdem ist irgend n seltsames Persona installiert...
Soll ich Firefox neuinstallieren?
Außerdem hat ESET vorhin gemeckert, dass einiges geupdated werden müsste, nur kommt die Meldung jetzt nicht mehr. Vllt sind das aber auch die, die Windows sowieso machen will.
+ da ist noch ein Ordner unter C: -> inetpub den ich nicht löschen kann, weil Teile davon immer benutzt werden (und der vor dem Virus nicht da war). Was soll ich mit dem anfangen? Oder ist der harmlos?

Fixlog:

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-08-2014 02
Ran by Pascal at 2014-09-02 12:39:16 Run:1
Running from C:\Users\Pascal\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
FF Extension: DownloadHelper - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-12]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
         
*****************

C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}" => File/Directory not found.


The system needed a reboot. 

==== End of Fixlog ====

FRST:


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran by Pascal (administrator) on PASCAL-PC on 02-09-2014 12:45:09
Running from C:\Users\Pascal\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2013-03-04] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2013-03-04] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5618456 2013-09-12] (ESET)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [MGSysCtrl] => C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2011-06-29] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2013-03-04] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [807696 2013-12-20] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [LOLReplay Recorder] => C:\Program Files (x86)\LOLReplay\LOLRecorder.exe [494592 2014-03-21] (LOL Replay)
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\...\Run: [Google Update] => "C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe" /c
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
AppInit_DLLs-x32: , C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Qualcomm Atheros Killer Network Manager.lnk
ShortcutTarget: Qualcomm Atheros Killer Network Manager.lnk -> C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe ()
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 02 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 03 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 04 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9 16 C:\Windows\SysWOW64\BfLLR.dll [196096] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 01 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 02 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 03 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 04 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Winsock: Catalog9-x64 16 %SYSTEMROOT%\system32\BfLLR.dll [216064] (Bigfoot Networks, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: @eximion.com/KalydoPlayer -> C:\Users\Pascal\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Pascal\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Pascal\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Pascal\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Users\Pascal\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Pascal\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-21]
FF Extension: ArchiveFacebook - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{53A03D43-5363-4669-8190-99061B2DEBA6} [2013-10-29]
FF Extension: YouTube HD - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\jid0-HbNL9qqBkuuKRhJ9ncTonCky1HU@jetpack.xpi [2013-10-10]
FF Extension: Reddit Enhancement Suite - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi [2014-02-20]
FF Extension: Personas Plus - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\personas@christopher.beard.xpi [2013-09-26]
FF Extension: Search By Image (by Google) - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{ce7e73df-6a44-4028-8079-5927a588c948}.xpi [2014-07-15]
FF Extension: HTMLPlugin - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{cebded91-c3d7-4bfd-9715-e4d365081986}.xpi [2014-05-30]
FF Extension: Adblock Plus - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-14]
FF Extension: {e0a2a72e-d3e5-46bf-8206-863d31912e68} - C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\{e0a2a72e-d3e5-46bf-8206-863d31912e68}.xpi [2014-05-26]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-01-22]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

Chrome: 
=======
CHR HomePage: Default -> 
CHR Profile: C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-19]
CHR Extension: (Google Drive) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-19]
CHR Extension: (YouTube) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-19]
CHR Extension: (Adblock Plus) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-08-26]
CHR Extension: (Google-Suche) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-19]
CHR Extension: (No Name) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda [2014-09-02]
CHR Extension: (AS Magic Player) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim [2014-07-04]
CHR Extension: (Google Wallet) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-19]
CHR Extension: (Google Mail) - C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-19]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [402192 2013-12-20] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2013-12-20] (BlueStack Systems, Inc.)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1337752 2013-09-12] (ESET)
R2 Micro Star SCM; C:\Program Files (x86)\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [37176 2013-08-22] (The OpenVPN Project)
R2 Qualcomm Atheros Killer Service; C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [490496 2012-09-24] () [File not signed]
R2 RzOvlMon; C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe [32960 2013-11-21] (Razer, Inc.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [66928 2012-09-24] (Qualcomm Atheros, Inc.)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [114448 2013-12-20] (BlueStack Systems)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)
R3 L1C; C:\Windows\System32\DRIVERS\e22w7x64.sys [157552 2012-09-24] (Qualcomm Atheros, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 RzDxgk; C:\Windows\system32\drivers\RzDxgk.sys [129472 2013-11-21] (Razer, Inc.)
R0 RzFilter; C:\Windows\System32\drivers\RzFilter.sys [74432 2013-11-21] (Razer, Inc.)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 ALSysIO; \??\C:\Users\Pascal\AppData\Local\Temp\ALSysIO64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-02 11:59 - 2014-09-02 11:59 - 00039157 _____ () C:\Users\Pascal\Desktop\Addition_2.txt
2014-09-02 11:58 - 2014-09-02 11:58 - 00052777 _____ () C:\Users\Pascal\Desktop\FRST_2.txt
2014-09-02 11:37 - 2014-09-02 11:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-02 11:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-02 11:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-02 11:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-02 11:36 - 2014-09-02 11:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Pascal\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-02 11:31 - 2014-09-02 11:31 - 00005101 _____ () C:\Users\Pascal\Desktop\AdwCleaner[S1].txt
2014-09-02 11:26 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-09-02 11:25 - 2014-09-02 11:29 - 00000000 ____D () C:\AdwCleaner
2014-09-02 11:25 - 2014-09-02 11:25 - 01364531 _____ () C:\Users\Pascal\Downloads\adwcleaner_3.308.exe
2014-09-02 10:49 - 2014-09-02 11:58 - 00039157 _____ () C:\Users\Pascal\Downloads\Addition.txt
2014-09-02 10:48 - 2014-09-02 12:45 - 00021122 _____ () C:\Users\Pascal\Downloads\FRST.txt
2014-09-02 10:48 - 2014-09-02 12:45 - 00000000 ____D () C:\FRST
2014-09-02 10:47 - 2014-09-02 10:47 - 02104832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe
2014-09-02 03:53 - 2014-09-02 03:53 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-09-02 03:52 - 2014-09-02 03:52 - 05314560 _____ () C:\Users\Pascal\Downloads\msxmlger.msi
2014-09-02 02:49 - 2014-09-02 12:41 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Packages
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Comodo
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\ProgramData\46ec6306412c2933
2014-09-02 02:48 - 2014-09-02 02:48 - 00003260 _____ () C:\Windows\System32\Tasks\GPUP
2014-08-29 17:00 - 2014-08-29 17:00 - 00295816 _____ () C:\Windows\Minidump\082914-23197-01.dmp
2014-08-28 10:50 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 10:50 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 10:50 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 18:47 - 2014-09-02 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-08-27 18:47 - 2014-08-27 18:47 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-08-27 18:46 - 2014-08-27 18:46 - 00270848 _____ (Secure By Design Inc.) C:\Users\Pascal\Downloads\Ninite Firefox VLC Installer.exe
2014-08-26 16:17 - 2014-08-26 16:17 - 00001351 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-08-26 16:15 - 2014-09-02 04:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\system32\NV
2014-08-26 16:15 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-08-26 16:15 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-26 16:13 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2014-08-26 16:13 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-08-26 16:13 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-08-26 16:13 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-08-26 16:07 - 2014-08-26 16:11 - 274075712 _____ (NVIDIA Corporation) C:\Users\Pascal\Downloads\340.52-notebook-win8-win7-64bit-international-whql.exe
2014-08-25 16:44 - 2014-08-25 16:44 - 00012267 _____ () C:\Users\Pascal\Documents\GEZ.odt
2014-08-24 18:45 - 2014-08-24 18:45 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Adobe
2014-08-22 10:50 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-22 10:50 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-22 10:50 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-22 10:50 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-22 10:50 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-22 10:50 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-22 10:49 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-22 10:49 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-22 10:49 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-22 10:49 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-19 20:07 - 2014-08-19 20:08 - 00005604 _____ () C:\Windows\system32\lvcoinst.log
2014-08-19 20:07 - 2014-08-19 20:07 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-08-18 21:46 - 2014-08-18 21:47 - 01058200 _____ (Adobe) C:\Users\Pascal\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-16 18:38 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 18:38 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-16 18:38 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 18:38 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 18:38 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-16 18:38 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-16 18:37 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-16 18:37 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 17:10 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-16 17:10 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-16 17:10 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-16 17:10 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-16 17:10 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-16 17:10 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-16 17:10 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-16 17:10 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-16 17:10 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-16 17:10 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-16 17:10 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-16 17:10 - 2014-07-24 11:37 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-08-16 17:10 - 2014-07-24 11:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-08-16 16:58 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-16 16:58 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-16 16:58 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-16 16:58 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-16 16:58 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-16 16:58 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-16 16:58 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-16 16:58 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-16 16:58 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 16:58 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 16:58 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-16 16:58 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-16 16:58 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-16 16:58 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-12 18:13 - 2014-08-12 18:13 - 00295728 _____ () C:\Windows\Minidump\081214-27003-01.dmp
2014-08-09 11:10 - 2014-08-09 11:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-09 11:10 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\Program Files\iTunes
2014-08-09 11:09 - 2014-08-09 11:10 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-09 11:09 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-02 12:45 - 2014-09-02 10:48 - 00021122 _____ () C:\Users\Pascal\Downloads\FRST.txt
2014-09-02 12:45 - 2014-09-02 10:48 - 00000000 ____D () C:\FRST
2014-09-02 12:41 - 2014-09-02 02:49 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-09-02 12:41 - 2014-04-11 00:24 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA.job
2014-09-02 12:41 - 2013-08-13 16:02 - 00000000 ____D () C:\ProgramData\Bigfoot Networks
2014-09-02 12:41 - 2009-07-14 06:51 - 00123077 _____ () C:\Windows\setupact.log
2014-09-02 12:40 - 2014-06-19 22:49 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4.job
2014-09-02 12:40 - 2010-11-21 05:47 - 00201520 _____ () C:\Windows\PFRO.log
2014-09-02 12:40 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-02 12:39 - 2013-08-13 15:06 - 01342391 _____ () C:\Windows\WindowsUpdate.log
2014-09-02 12:39 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-09-02 12:26 - 2013-08-14 13:39 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Apple Computer
2014-09-02 12:13 - 2013-08-20 13:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-02 11:59 - 2014-09-02 11:59 - 00039157 _____ () C:\Users\Pascal\Desktop\Addition_2.txt
2014-09-02 11:58 - 2014-09-02 11:58 - 00052777 _____ () C:\Users\Pascal\Desktop\FRST_2.txt
2014-09-02 11:58 - 2014-09-02 10:49 - 00039157 _____ () C:\Users\Pascal\Downloads\Addition.txt
2014-09-02 11:58 - 2009-07-14 06:45 - 00029120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-02 11:58 - 2009-07-14 06:45 - 00029120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-02 11:54 - 2014-09-02 11:37 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-02 11:54 - 2014-06-19 22:49 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7.job
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-02 11:37 - 2014-09-02 11:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-02 11:37 - 2011-04-12 09:43 - 04990672 _____ () C:\Windows\system32\perfh007.dat
2014-09-02 11:37 - 2011-04-12 09:43 - 01529762 _____ () C:\Windows\system32\perfc007.dat
2014-09-02 11:37 - 2009-07-14 07:13 - 00007128 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-02 11:36 - 2014-09-02 11:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Pascal\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-02 11:31 - 2014-09-02 11:31 - 00005101 _____ () C:\Users\Pascal\Desktop\AdwCleaner[S1].txt
2014-09-02 11:29 - 2014-09-02 11:25 - 00000000 ____D () C:\AdwCleaner
2014-09-02 11:28 - 2013-11-30 02:32 - 00000000 ____D () C:\Users\Pascal\AppData\Local\CrashDumps
2014-09-02 11:25 - 2014-09-02 11:25 - 01364531 _____ () C:\Users\Pascal\Downloads\adwcleaner_3.308.exe
2014-09-02 10:47 - 2014-09-02 10:47 - 02104832 _____ (Farbar) C:\Users\Pascal\Downloads\FRST64.exe
2014-09-02 04:26 - 2014-08-27 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-09-02 04:26 - 2014-08-26 16:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-09-02 04:26 - 2014-06-13 19:18 - 00000000 ____D () C:\Program Files (x86)\Browny02
2014-09-02 04:26 - 2014-02-08 16:12 - 00000000 ____D () C:\Program Files (x86)\Everything
2014-09-02 04:25 - 2013-12-18 20:44 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Battle.net
2014-09-02 04:25 - 2013-09-17 08:07 - 00000000 ____D () C:\Windows\Minidump
2014-09-02 04:25 - 2013-08-20 15:52 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\FreeFLVConverter
2014-09-02 04:25 - 2013-08-20 14:25 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\IrfanView
2014-09-02 04:25 - 2013-08-13 15:12 - 00000000 ____D () C:\Users\Pascal
2014-09-02 04:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-09-02 04:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-09-02 04:13 - 2009-07-14 06:45 - 00297744 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-02 03:53 - 2014-09-02 03:53 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-09-02 03:52 - 2014-09-02 03:52 - 05314560 _____ () C:\Users\Pascal\Downloads\msxmlger.msi
2014-09-02 03:47 - 2013-08-13 16:32 - 00065592 _____ () C:\Users\Pascal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-02 03:40 - 2014-03-08 19:07 - 00000000 ____D () C:\ProgramData\Nuance
2014-09-02 03:40 - 2014-03-08 19:07 - 00000000 ____D () C:\Program Files (x86)\Nuance
2014-09-02 03:38 - 2014-03-08 19:08 - 00000000 ____D () C:\ProgramData\ScanSoft
2014-09-02 03:26 - 2014-01-21 16:01 - 00000000 ____D () C:\inetpub
2014-09-02 03:24 - 2014-04-08 22:18 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\ACEStream
2014-09-02 03:24 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-02 03:20 - 2013-08-20 15:41 - 00000000 ____D () C:\Users\Pascal\dwhelper
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Packages
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Comodo
2014-09-02 02:49 - 2014-09-02 02:49 - 00000000 ____D () C:\ProgramData\46ec6306412c2933
2014-09-02 02:49 - 2014-06-19 22:42 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-02 02:49 - 2014-04-11 00:23 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Google
2014-09-02 02:48 - 2014-09-02 02:48 - 00003260 _____ () C:\Windows\System32\Tasks\GPUP
2014-09-02 01:44 - 2013-08-14 13:27 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\Skype
2014-09-01 23:34 - 2013-08-26 18:40 - 00000000 ____D () C:\Users\Pascal\AppData\Roaming\TS3Client
2014-09-01 20:08 - 2013-12-18 20:44 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Battle.net
2014-08-31 21:41 - 2014-04-11 00:23 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core.job
2014-08-29 17:00 - 2014-08-29 17:00 - 00295816 _____ () C:\Windows\Minidump\082914-23197-01.dmp
2014-08-29 17:00 - 2013-09-17 08:07 - 462873505 _____ () C:\Windows\MEMORY.DMP
2014-08-27 18:47 - 2014-08-27 18:47 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-08-27 18:47 - 2013-08-14 13:35 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-08-27 18:46 - 2014-08-27 18:46 - 00270848 _____ (Secure By Design Inc.) C:\Users\Pascal\Downloads\Ninite Firefox VLC Installer.exe
2014-08-27 12:26 - 2013-10-04 22:06 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-08-26 16:17 - 2014-08-26 16:17 - 00001351 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-08-26 16:17 - 2014-05-08 17:51 - 00000000 ____D () C:\Users\Pascal\AppData\Local\NVIDIA Corporation
2014-08-26 16:17 - 2013-11-02 21:57 - 00000000 ____D () C:\Users\Pascal\AppData\Local\NVIDIA
2014-08-26 16:17 - 2013-08-13 16:47 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-08-26 16:15 - 2014-08-26 16:15 - 00000000 ____D () C:\Windows\system32\NV
2014-08-26 16:15 - 2013-08-13 16:48 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-26 16:15 - 2013-08-13 16:47 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-26 16:15 - 2013-08-13 16:45 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-26 16:11 - 2014-08-26 16:07 - 274075712 _____ (NVIDIA Corporation) C:\Users\Pascal\Downloads\340.52-notebook-win8-win7-64bit-international-whql.exe
2014-08-25 16:44 - 2014-08-25 16:44 - 00012267 _____ () C:\Users\Pascal\Documents\GEZ.odt
2014-08-24 18:45 - 2014-08-24 18:45 - 00000000 ____D () C:\Users\Pascal\AppData\Local\Adobe
2014-08-24 16:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-24 11:08 - 2013-08-20 13:32 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-24 11:08 - 2013-08-20 13:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-24 11:08 - 2013-08-20 13:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-23 04:07 - 2014-08-28 10:50 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 10:50 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 10:50 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 12:42 - 2013-12-18 20:44 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-22 00:30 - 2013-09-09 20:37 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-08-19 20:08 - 2014-08-19 20:07 - 00005604 _____ () C:\Windows\system32\lvcoinst.log
2014-08-19 20:07 - 2014-08-19 20:07 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-08-19 11:16 - 2013-12-18 20:45 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-18 21:56 - 2014-06-19 22:43 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-18 21:47 - 2014-08-18 21:46 - 01058200 _____ (Adobe) C:\Users\Pascal\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-16 18:42 - 2013-09-11 11:51 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-16 18:40 - 2013-09-11 11:51 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-16 18:37 - 2014-05-06 12:01 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 18:13 - 2014-08-12 18:13 - 00295728 _____ () C:\Windows\Minidump\081214-27003-01.dmp
2014-08-09 11:10 - 2014-08-09 11:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-09 11:10 - 2014-08-09 11:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iTunes
2014-08-09 11:10 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-09 11:09 - 2014-08-09 11:09 - 00000000 ____D () C:\Program Files\iPod
2014-08-07 20:58 - 2013-08-14 13:27 - 00000000 ____D () C:\ProgramData\Skype
2014-08-07 04:06 - 2014-08-16 16:58 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-16 16:58 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 14:22 - 2013-08-14 13:26 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-08-05 09:20 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\Pascal\AppData\Local\Temp\294823_.exe
C:\Users\Pascal\AppData\Local\Temp\installhelper.dll
C:\Users\Pascal\AppData\Local\Temp\install_flashplayer11x32au_mssa_aaa_aih.exe
C:\Users\Pascal\AppData\Local\Temp\InstHelper.exe
C:\Users\Pascal\AppData\Local\Temp\k4n4zoue.dll
C:\Users\Pascal\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe
C:\Users\Pascal\AppData\Local\Temp\Quarantine.exe
C:\Users\Pascal\AppData\Local\Temp\Setup.exe
C:\Users\Pascal\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Pascal\AppData\Local\Temp\sfextra.dll
C:\Users\Pascal\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Pascal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Pascal\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Pascal\AppData\Local\Temp\vybxk5zm.ie0.exe
C:\Users\Pascal\AppData\Local\Temp\_is4164.exe
C:\Users\Pascal\AppData\Local\Temp\_is457B.exe
C:\Users\Pascal\AppData\Local\Temp\_is5BB6.exe
C:\Users\Pascal\AppData\Local\Temp\_is85E3.exe
C:\Users\Pascal\AppData\Local\Temp\_is8DBE.exe
C:\Users\Pascal\AppData\Local\Temp\_isAD62.exe
C:\Users\Pascal\AppData\Local\Temp\_isC2C9.exe
C:\Users\Pascal\AppData\Local\Temp\_isC34E.exe
C:\Users\Pascal\AppData\Local\Temp\_isD96.exe
C:\Users\Pascal\AppData\Local\Temp\_isF4B.exe
C:\Users\Pascal\AppData\Local\Temp\_isF67E.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-30 20:19

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Addition:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2014 02
Ran by Pascal at 2014-09-02 12:46:30
Running from C:\Users\Pascal\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET Smart Security 7.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 7.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personal Firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4Story (HKCU\...\Kalydo App 4Story) (Version: 4.02.01.26 - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.4.3036 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{44181DF6-2751-48C7-B918-72F14508F127}) (Version: 0.8.4.3036 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dolphin x86 (HKLM-x32\...\Dolphin x86) (Version: 4.0.2 - Dolphin Development Team)
ESET Smart Security (HKLM\...\{F5A3E880-A737-48F2-A124-6F5D4CEA6AB4}) (Version: 7.0.302.26 - ESET, spol s r. o.)
Everything 1.2.1.371 (HKLM-x32\...\Everything) (Version:  - )
Flixster (HKLM-x32\...\com.wb.DC2) (Version: 0.1.26 - Warner Bros. Entertainment Inc.)
Flixster (x32 Version: 0.1.26 - Warner Bros. Entertainment Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free FLV Converter V 7.6.0 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.6.0.0 - Koyote Soft)
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{C1E3DFE7-4EAD-3E9E-A826-E06055BA5921}) (Version: 5.4.2.18903 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
HL-2130 (HKLM-x32\...\{E2A97415-BD97-4867-B906-05E39E9EE51F}) (Version: 1.0.7.0 - Brother Industries, Ltd.)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
InetStat (HKCU\...\InetStat) (Version: 0.5b - InetStat)
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{BEE86606-EFB5-4353-9F34-29E0C59CDCFA}) (Version: 15.2.0.0284 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{181BBF43-CA17-4E1A-A78D-81E67A57B8A4}) (Version: 15.02.0000.1258 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Kalydo Player 5.08.00 (HKCU\...\KalydoPlayer) (Version: 5.08.00 - Eximion B.V.)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.7 - www.leaguereplays.com)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mass Effect™ (HKLM-x32\...\{44A570EE-FD93-4086-8997-2C38DFDE0019}) (Version: 1.2.20608.0 - Electronic Arts)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
OpenVPN 2.3.2-I003  (HKLM\...\OpenVPN) (Version: 2.3.2-I003 - )
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Qualcomm Atheros Killer Network Manager (HKLM-x32\...\InstallShield_{DF446558-ADF7-4884-9B2D-281979CCE71F}) (Version: 6.1.0.437 - Qualcomm Atheros)
Qualcomm Atheros Killer Network Manager (Version: 6.1.0.437 - Qualcomm Atheros) Hidden
Razer Comms (HKLM-x32\...\Razer Comms) (Version: 1.81.19 - Razer Inc.)
Razer Core (HKLM-x32\...\Razer Core) (Version: 1.0.1.52 - Razer Inc)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6690 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.28123 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Rust (HKLM-x32\...\Steam App 252490) (Version:  - Facepunch Studios)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
ShootMania Storm (HKLM-x32\...\Steam App 229870) (Version:  - Nadeo)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
System Control Manager (HKLM-x32\...\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}) (Version: 2.211.0629.M007.03 - Micro-Star International Co., Ltd.)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
Uninstall LSI (HKLM-x32\...\{62B332E9-239D-4692-BDE2-0CC1CF2833DA}_is1) (Version: 3.0b - Aequus Gaming Ltd.)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
WinRAR 5.10 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F7D4B6AD-AB5F-4fe8-9469-3A4697E41129}\InprocServer32 -> C:\Users\Pascal\AppData\Roaming\Kalydo\KalydoPlayer\bin2\kalydoplayer64.dll (Eximion B.V.)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1786790872-1424119505-3387820452-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Pascal\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points  =========================

28-08-2014 12:15:26 Windows Update
02-09-2014 01:18:26 Revo Uninstaller's restore point - µTorrent
02-09-2014 01:22:20 Revo Uninstaller's restore point - Ace Stream Media 2.2.3-next
02-09-2014 01:29:34 Revo Uninstaller's restore point - Supporter 1.80
02-09-2014 01:30:39 Revo Uninstaller's restore point - SaveClicker
02-09-2014 01:33:50 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser
02-09-2014 01:34:59 Revo Uninstaller's restore point - CouponSupport
02-09-2014 01:36:40 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser (KB2758694)
02-09-2014 01:37:39 Revo Uninstaller's restore point - Nuance PaperPort 12
02-09-2014 01:39:16 Revo Uninstaller's restore point - Nuance PDF Viewer Plus
02-09-2014 01:39:26 Removed Nuance PDF Viewer Plus.
02-09-2014 01:53:05 MSXML 4.0 SP2 Parser und SDK wird installiert
02-09-2014 02:20:41 Wiederherstellungsvorgang
02-09-2014 08:37:14 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2CF4052C-71E0-4D43-A990-F3CB3D3DDF0B} - System32\Tasks\{A823570D-D055-4DA9-AD9A-7F07615B7887} => C:\Program Files (x86)\lol.launcher.exe
Task: {53776F1A-FF34-4EF6-B0AA-E71F5F68B1C3} - System32\Tasks\GPUP => C:\Program Files (x86)\GetPrivate\gpup.exe
Task: {7575F5D7-0C11-40C6-9A57-FD989A880E22} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: {7FFD1C43-4C34-45CA-8990-D29F8DC11036} - System32\Tasks\{FDC74762-4EC3-460A-9B4D-7E89D2BFA585} => C:\Program Files (x86)\lol.launcher.exe
Task: {88D199DC-8BB5-4B6D-94D8-84363AEA807E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {9011B2D5-F2A3-454E-81A0-D51AEB86BA29} - System32\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {9F0C3F1E-43B7-4D61-B796-36DEFB1E3687} - System32\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {AD5890ED-3A93-4416-BAF5-E1EE2D7537F7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {B57B4397-EAE7-43AB-9F70-0277316BE5F1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {CE613082-BFD9-4268-911E-D218E252708C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-24] (Adobe Systems Incorporated)
Task: {D3AA22EF-9B71-4BC2-A24E-ADD58D57C333} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {FC3506E6-9E9E-40EB-B730-5A45A57350F5} - System32\Tasks\Core Temp Autostart Pascal => C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe [2013-10-08] () <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8bfff25990a4.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8bfff3deafb7.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000Core.job => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1786790872-1424119505-3387820452-1000UA.job => C:\Users\Pascal\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 03:36 - 2014-07-02 22:48 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-08-13 16:47 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-08 18:07 - 2013-10-08 13:23 - 00890016 _____ () C:\Users\Pascal\AppData\Local\Temp\Rar$EXa0.939\Core Temp.exe
2013-08-13 16:37 - 2013-03-04 09:27 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00553984 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe
2011-05-09 20:46 - 2011-05-09 20:46 - 02760192 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtCore4.dll
2011-05-09 20:56 - 2011-05-09 20:56 - 09856000 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtGui4.dll
2011-05-09 20:48 - 2011-05-09 20:48 - 00990720 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtNetwork4.dll
2011-05-09 20:47 - 2011-05-09 20:47 - 00416256 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\QtXml4.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00217600 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFCommon.dll
2011-05-10 12:32 - 2011-05-10 12:32 - 00731648 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\qwt5.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00404992 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modApplications.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00036864 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modFeatures.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00025088 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modFraps.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00240128 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modGraph.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00062464 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modlcd.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00291328 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modNetwork.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00184832 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modNpu.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00211456 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modOptions.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00064000 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modOverview.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00317440 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\plugins\modSystemInfo.dll
2012-09-24 23:08 - 2012-09-24 23:08 - 00490496 _____ () C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-08-26 16:13 - 2014-07-02 22:48 - 00013272 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-03-21 12:38 - 2014-03-21 12:38 - 00378880 _____ () C:\Program Files (x86)\LOLReplay\LOLUtils.dll
2014-06-13 19:18 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-07-30 01:39 - 2014-07-30 01:39 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-14 13:39 - 2014-02-14 13:39 - 00017920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\7fb509dd6887788f670fac03bb2f996d\PSIClient.ni.dll
2014-08-24 11:08 - 2014-08-24 11:08 - 17048240 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/02/2014 00:41:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.2.0.3, Zeitstempel: 0x4fe8ea02
Name des fehlerhaften Moduls: MurocApi.dll, Version: 15.2.0.1, Zeitstempel: 0x4fe8e921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002089b
ID des fehlerhaften Prozesses: 0x690
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3

Error: (09/02/2014 00:41:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 00:41:08 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 00:39:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 31.0.0.5310, Zeitstempel: 0x53c75e91
Name des fehlerhaften Moduls: mozalloc.dll, Version: 31.0.0.5310, Zeitstempel: 0x53c72e91
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x19cc
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (09/02/2014 11:51:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 11:51:19 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 11:37:07 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (09/02/2014 11:37:07 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (09/02/2014 11:37:06 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (09/02/2014 11:31:02 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)


System errors:
=============
Error: (09/02/2014 00:43:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/02/2014 00:42:05 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (09/02/2014 00:41:08 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 
%%1064

Error: (09/02/2014 00:41:01 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PDFProFiltSrvPP" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/02/2014 00:40:40 PM) (Source: APPHOSTSVC) (EventID: 9010) (User: )
Description: Fehler im Anwendungshost-Hilfsdienst beim Zugriff auf das Verlaufsstammverzeichnis "C:\inetpub\history". Das Verzeichnis ist nicht vorhanden, oder die Berechtigungen für das Verzeichnis lassen den Zugriff des Verzeichnisdiensts auf das Verzeichnis nicht zu. Das Konfigurationsverlaufsfeature wird deaktiviert und erneut aktiviert, nachdem das Problem behoben wurde. Stellen Sie zum Beheben des Problems sicher, dass das Verzeichnis vorhanden ist und dass die Gruppe "Administratoren" über Lese- und Schreibzugriff auf das Verzeichnis verfügt. Das Datenfeld enthält die Fehlernummer.

Error: (09/02/2014 11:53:27 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/02/2014 11:51:19 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 
%%1064

Error: (09/02/2014 11:51:11 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PDFProFiltSrvPP" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/02/2014 11:50:59 AM) (Source: APPHOSTSVC) (EventID: 9010) (User: )
Description: Fehler im Anwendungshost-Hilfsdienst beim Zugriff auf das Verlaufsstammverzeichnis "C:\inetpub\history". Das Verzeichnis ist nicht vorhanden, oder die Berechtigungen für das Verzeichnis lassen den Zugriff des Verzeichnisdiensts auf das Verzeichnis nicht zu. Das Konfigurationsverlaufsfeature wird deaktiviert und erneut aktiviert, nachdem das Problem behoben wurde. Stellen Sie zum Beheben des Problems sicher, dass das Verzeichnis vorhanden ist und dass die Gruppe "Administratoren" über Lese- und Schreibzugriff auf das Verzeichnis verfügt. Das Datenfeld enthält die Fehlernummer.

Error: (09/02/2014 11:33:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (09/02/2014 00:41:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ZeroConfigService.exe15.2.0.34fe8ea02MurocApi.dll15.2.0.14fe8e921c0000005000000000002089b69001cfc69a65e934a6C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Program Files\Intel\WiFi\bin\MurocApi.dllba83c0ea-328d-11e4-a35e-6036ddf28671

Error: (09/02/2014 00:41:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 00:41:08 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 00:39:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe31.0.0.531053c75e91mozalloc.dll31.0.0.531053c72e91800000030000141b19cc01cfc6966da23708C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll646b5c3a-328d-11e4-b85d-6036ddf28671

Error: (09/02/2014 11:51:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2014 11:51:19 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (09/02/2014 11:37:07 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (09/02/2014 11:37:07 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (09/02/2014 11:37:06 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (09/02/2014 11:31:02 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)


CodeIntegrity Errors:
===================================
  Date: 2014-08-30 00:09:51.176
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-12 18:23:39.179
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-08 12:42:53.481
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-05 20:07:05.414
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-25 21:53:02.701
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-17 23:40:00.116
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-13 23:48:25.069
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:43:47.210
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:39:24.625
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-10 02:35:12.530
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz
Percentage of memory in use: 37%
Total physical RAM: 8084.77 MB
Available physical RAM: 5067.75 MB
Total Pagefile: 16167.73 MB
Available Pagefile: 12919.69 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:696.77 GB) (Free:523.62 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (╗§ ║╝À²) (Fixed) (Total:1.86 GB) (Free:1.64 GB) FAT32 ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 18836D0D)
Partition 1: (Not Active) - (Size=1.9 GB) - (Type=0B)
Partition 2: (Active) - (Size=696.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Geändert von ChicoMarx (02.09.2014 um 11:57 Uhr)

Alt 08.09.2014, 21:58   #8
Bootsektor
Ruhe in Frieden
† 2019
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Entschuldige,

du bist mir irgendwie verloren gegangen
Zitat:
€: Ich habe immer noch das Problem, dass Firefox nicht die gespeicherten (letzten) Tabs öffnet,
Du meinst beim Start vom FF?
Gehe mal auf Extras-> Einstellungen -> Allgemein und schau dort, ob unter Start Fenster und Tabs der letzten Sitzung anzeigen steht, wenn nicht ändere das und teste erneut.

Zitat:
Außerdem ist irgend n seltsames Persona installiert...
Personas ist eigentlich ne legitime Erweiterung im FF, wenn du die nicht willst kann ich die gerne löschen.
Du kannst sie aber auch selbst unter Erweiterungen im FF löschen, dazu drücke im geöffneten, aktiven FF die Tastenkombination Strg-Umschalt-Alt und suche unter Erweiterungen Personas Plus, deinstalliere das dann.

Zitat:
Außerdem hat ESET vorhin gemeckert, dass einiges geupdated werden müsste, nur kommt die Meldung jetzt nicht mehr. Vllt sind das aber auch die, die Windows sowieso machen will.
Nein, wahrscheinlich wollte es die Datenbank aktualisieren
Zitat:
+ da ist noch ein Ordner unter C: -> inetpub den ich nicht löschen kann, weil Teile davon immer benutzt werden (und der vor dem Virus nicht da war). Was soll ich mit dem anfangen? Oder ist der harmlos?
Dieser Ordner wurde am 02/09 modifiziert, entstanden ist er schon vorher und ist Teil der Internetinformationsdienste unter Windows, also eigentlich eine Windowskomponente, du hast nicht zufälligerweise einen Server am laufen oder benötigst IIS?

Ich würd gern einen Kontrollscan mit HitmanPro machen
Schritt 1
Downloade Dir HitmanPro
HitmanPro - 32 Bit
HitmanPro - 64 Bit
  • Starte die HitmanPro.exe
  • Klicke unten auf der Button-Leiste auf Einstellungen
  • Belasse die Standardeinstellungen und wähle nur bei "Nach potentiell unerwünschten Programmen suchen" als "Standardaktion" Löschen aus und bestätige mit Ok.
  • Wähle "Nein, ich möchte nur einen Einmalscan zur Überprüfung dieses Computers ausführen" aus
  • Klicke auf "Kostenlose Lizenz aktivieren" und gib deine E-Mailadresse ein.
  • Klicke auf Weiter und akzeptiere die Lizenzbedingungen.
    Nach dem Suchlauf:
  • Wähle bei etwaigen Funden Ignorieren aus wähle im nächsten Fenster Logdatei speichern und speichere die Logdatei auf deinem Desktop.
  • Wähle unten links auf der Button-Leiste Logdatei speichern und speichere die Logdatei auf Deinem Desktop.
  • Schließe HitmanPro.
  • poste mir die Logdatei
Alt 09.09.2014, 09:33   #9
ChicoMarx
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Firefox etc ist kein Problem mehr, funktioniert alles wieder.

Eig benötige ich kein IIS und hab auch keinen Server am laufen. Könnte Torrent IIS benötigt haben?

Hitman:
Code:
ATTFilter
HitmanPro 3.7.9.225
www.hitmanpro.com

   Computer name . . . . : PASCAL-PC
   Windows . . . . . . . : 6.1.1.7601.X64/8
   User name . . . . . . : Pascal-PC\Pascal
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (30 days left)

   Scan date . . . . . . : 2014-09-09 10:22:03
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 6m 26s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 2
   Traces  . . . . . . . : 95

   Objects scanned . . . : 1.854.970
   Files scanned . . . . : 58.631
   Remnants scanned  . . : 511.622 files / 1.284.717 keys

Malware _____________________________________________________________________

   C:\Users\Pascal\AppData\Local\Temp\294823_.exe
      Size . . . . . . . : 2.907.648 bytes
      Age  . . . . . . . : 7.3 days (2014-09-02 02:49:13)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 9522C6523E3338EA9CADED36E04008C149B0F8B08EB15DC58AD44D84F562FE51
    > Bitdefender  . . . : Gen:Variant.Adware.MultiPlug.1
    > Kaspersky  . . . . : not-a-virus:HEUR:AdWare.Win32.MultiPlug.heur
      Fuzzy  . . . . . . : 115.0
      Forensic Cluster
         -4.0s C:\Users\Pascal\AppData\Local\Temp\vybxk5zm.ie0.exe
         -1.2s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\InetStat\inetstat.exe.vir
         -1.2s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\InetStat\inetstat.exe.vir
         -1.2s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat\InetStat.lnk.vir
          0.0s C:\Users\Pascal\AppData\Local\Temp\294823_.exe
          2.8s C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\
          2.8s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\lsdb.js.vir
          2.8s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json.vir
          2.8s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json.vir
          2.9s C:\Users\Pascal\AppData\Local\Comodo\
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\background.html
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\KuNh.js
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\lsdb.js
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json
          2.9s C:\Users\Pascal\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\background.html
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\content.js
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\KuNh.js
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json
          3.0s C:\Users\Pascal\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json
          3.1s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\torch\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\background.html.vir
          3.1s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\torch\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\content.js.vir
          3.1s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\torch\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\KuNh.js.vir
          3.1s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\torch\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\lsdb.js.vir
          3.1s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\torch\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json.vir
          3.1s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\torch\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json.vir
          3.1s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Local\torch\User Data\Default\Extensions\lnjgabhmdpbmeippbedflhicaifogeda\2.1\manifest.json.vir
          3.4s C:\Windows\SysWOW64\GroupPolicy\gpt.ini
          3.5s C:\FRST\Quarantine\C\Windows\system32\GroupPolicy\Machine\
          3.5s C:\Windows\System32\GroupPolicy\User\
          3.5s C:\FRST\Quarantine\C\Windows\system32\GroupPolicy\Machine\Registry.pol
          3.5s C:\FRST\Quarantine\C\Windows\system32\GroupPolicy\GPT.ini.xBAD
          3.5s C:\FRST\Quarantine\C\Windows\system32\GroupPolicy\GPT.ini.xBAD
          3.5s C:\FRST\Quarantine\C\Windows\system32\GroupPolicy\GPT.ini.xBAD
          3.5s C:\FRST\Quarantine\C\Windows\system32\GroupPolicy\GPT.ini.xBAD
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\bootstrap.js.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\chrome.manifest.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\chrome.manifest.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\install.rdf.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\install.rdf.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\install.rdf.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\install.rdf.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\install.rdf.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\install.rdf.vir
          3.5s C:\AdwCleaner\Quarantine\C\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\Extensions\oeyyi.gbpo@ean-uakq.org\install.rdf.vir
          3.7s C:\ProgramData\ntuser.pol
          3.7s C:\Users\Pascal\AppData\LocalLow\{49434B8C-9608-4CDF-9BF3-EDD36CD6D51E}\
          3.8s C:\Users\Pascal\AppData\LocalLow\{49434B8C-9608-4CDF-9BF3-EDD36CD6D51E}\SaveClicker.2.9.dat
          4.3s C:\Users\Pascal\AppData\Local\Packages\
          4.3s C:\Users\Pascal\AppData\Local\Packages\windows_ie_ac_001\AC\{49434B8C-9608-4CDF-9BF3-EDD36CD6D51E}\
          4.3s C:\Users\Pascal\AppData\Local\Packages\windows_ie_ac_001\
          4.3s C:\Users\Pascal\AppData\Local\Packages\windows_ie_ac_001\AC\
          4.3s C:\Users\Pascal\AppData\Local\Packages\windows_ie_ac_001\AC\{49434B8C-9608-4CDF-9BF3-EDD36CD6D51E}\SaveClicker.2.9.dat
          4.3s C:\Users\Pascal\AppData\Local\Packages\windows_ie_ac_001\AC\{49434B8C-9608-4CDF-9BF3-EDD36CD6D51E}\SaveClicker.2.9.dat
          4.3s C:\Users\Pascal\AppData\Local\Packages\windows_ie_ac_001\AC\{49434B8C-9608-4CDF-9BF3-EDD36CD6D51E}\SaveClicker.2.9.dat
          4.3s C:\Users\Pascal\AppData\Local\Packages\windows_ie_ac_001\AC\{49434B8C-9608-4CDF-9BF3-EDD36CD6D51E}\SaveClicker.2.9.dat
          4.3s C:\ProgramData\46ec6306412c2933\
          4.3s C:\ProgramData\46ec6306412c2933\{1E092842-7999-DA0B-FC97-9FCE3FB05A56}.20140902024917
          4.3s C:\ProgramData\46ec6306412c2933\{1E092842-7999-DA0B-FC97-9FCE3FB05A56}.20140902024917
          4.3s C:\ProgramData\46ec6306412c2933\{1E092842-7999-DA0B-FC97-9FCE3FB05A56}.20140902024917
          4.3s C:\ProgramData\46ec6306412c2933\{1E092842-7999-DA0B-FC97-9FCE3FB05A56}.20140902024917
          4.3s C:\ProgramData\46ec6306412c2933\{1E092842-7999-DA0B-FC97-9FCE3FB05A56}.20140902024917
          4.7s C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\KC4CLS43.txt
          6.2s C:\Users\Pascal\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_plugin-container_e031143918a53fe2c31062d33d598e227a904d39_33be27a0\
          6.2s C:\Users\Pascal\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_plugin-container_e031143918a53fe2c31062d33d598e227a904d39_33be27a0\Report.wer
          6.2s C:\Users\Pascal\AppData\Local\CrashDumps\plugin-container.exe.7132.dmp
         15.0s C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\VOJQ8FKU.txt
         16.4s C:\Users\Pascal\AppData\Local\Temp\QPCYHL.tmp.app2HTML
         20.1s C:\Users\Pascal\AppData\Local\Temp\etilqs_I7EX3TnehCsHMB9
         20.1s C:\Users\Pascal\AppData\Local\Temp\etilqs_ZC6Hj8Co3egp0Py
         20.1s C:\Users\Pascal\AppData\Local\Temp\etilqs_ZC6Hj8Co3egp0Py
         21.8s C:\Windows\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Operational.evtx
         21.8s C:\Windows\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Admin.evtx
         21.8s C:\Windows\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Admin.evtx

   C:\Users\Pascal\AppData\Local\Temp\is1275519350\582471_stp\wajam_validate.exe
      Size . . . . . . . : 11.264 bytes
      Age  . . . . . . . : 341.0 days (2013-10-03 11:10:46)
      Entropy  . . . . . : 7.3
      SHA-256  . . . . . : 561B6080396BA1218D886E7F4999918B3E85D50B4BFC05772C911CBE5AF7947A
    > Kaspersky  . . . . : not-a-virus:Downloader.NSIS.Agent.ij
      Fuzzy  . . . . . . : 110.0


Suspicious files ____________________________________________________________

   C:\Users\Pascal\Downloads\FRST64.exe
      Size . . . . . . . : 2.104.832 bytes
      Age  . . . . . . . : 7.0 days (2014-09-02 10:47:29)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : B0F53A6B7B2E0E3F72C08762D8264E20D56D07446D4194763929863818CC7193
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.


Potential Unwanted Programs _________________________________________________

   HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\ (PCOptimizerPro)
   HKU\S-1-5-18\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\ (PCOptimizerPro)
   HKU\S-1-5-19\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\ (PCOptimizerPro)
   HKU\S-1-5-20\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\ (PCOptimizerPro)
   HKU\S-1-5-21-1786790872-1424119505-3387820452-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchnu.com\ (SearchQU)

Cookies _____________________________________________________________________

   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.ad-srv.net
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.ibtracking.com
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:de.sitestat.com
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:livejasmin.com
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
   C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\01WFTOZ0.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\0VI348VZ.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\0WVQZCL9.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\1RZB4AEQ.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\2JHMS440.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\6H2Z8QIW.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\8TXIBU2S.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\DB9GCDQR.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\EVOINKU6.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\EWZ8KUHS.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\ITG21YM1.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\KGTZMPB8.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\MU045XZ2.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\OEGIHLG1.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\OOS82PVR.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\PP84CJ5T.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\V301OK19.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\VVEYP7ZI.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\XTRW95A8.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\ZNMYB8DJ.txt
   C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Cookies\ZT3CWDJW.txt
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:2o7.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:3276817.fls.doubleclick.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ad.360yield.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ad.ad-srv.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ad.mlnadvertising.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ad.movad.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ad.zanox.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.ad4game.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.brandwire.tv
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.creative-serving.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.googloapis.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.ibtracking.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.mediade.sk
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.p161.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.pubmatic.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.stickyadstv.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ads.yahoo.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:adtech.de
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:advertising.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:at.atwola.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:atdmt.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:be.sitestat.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:bs.serving-sys.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:casalemedia.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:de.sitestat.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:dkvag.112.2o7.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:doubleclick.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:esportsexpress.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:livejasmin.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:media6degrees.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:mediaplex.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:pornmd.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:premiumtv.122.2o7.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:revsci.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ru4.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:secretsexservice.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:server.cpmstar.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:serving-sys.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:sexad.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:sexyteeniestube.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:smartadserver.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:statcounter.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:statse.webtrendslive.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:timeinc.122.2o7.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:track.adform.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:track.zalando.de
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:tradedoubler.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:warnerbros.112.2o7.net
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:ww251.smartadserver.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:www.camsexexpress.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:www.etracker.de
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:www.googleadservices.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:www.pornmd.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:xiti.com
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:yadro.ru
   C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\2xoz7bqq.default\cookies.sqlite:youporn.com

Alt 09.09.2014, 21:20   #10
Bootsektor
Ruhe in Frieden
† 2019
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Hallo,

Zitat:
Könnte Torrent IIS benötigt haben?
Eher unwahrscheinlich. Du kannst es im abgesicherten Modus löschen.

HitmanPro hat da auch nicht viel neues gefunden. Die Funde kannst du alle löschen, FRST ist ein false positiv

Dann lass uns noch ein wenig aufräumen.

OK
So wie ich es sehe, haben wir damit alles Schadhafte entfernt. Deine Logs sind sauber.
Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir.

Schritt 1

Falls Du Malwarebytes-Antimalware und Hitmanpro nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren.
Ich empfehle Dir aber zumindest Malwarebytes zu behalten, und damit einmal die Woche einen Kontrollscan zu machen.

Schritt 2
Downloade dir bitte delfix auf deinen Desktop.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.
  • DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.
Falls nach Delfix noch Programme aus unserer Bereinigung vorhanden sein sollten, kannst du diese nun bedenkenlos löschen.


Updates / Programme aktualisieren
  • Internetexplorer
    Dein InternetExplorer ist nicht mehr aktuell. Besuche diese Microsoftseite und lade dir von dort den neuesten Internetexplorer für dein Betriebssystem herunter
  • Mozilla Firefox
    Lade dir bitte von hier den aktuellen Firefox herunter.
  • FlashPlayer
Dein FlashPlayer für den InternetExplorer (ActiveX) ist nicht mehr aktuell.
  • deinstalliere die alten Versionen.
  • Öffne mit dem InternetExplorer folgenden Link Adobe - Adobe Flash Player installieren
  • Falls sich dort etwas anderes als der FlashPlayer noch zusätzlich mitinstallieren möchte, entferne den Haken dort
Aktualisierung einstellen
Stelle sicher, dass dein FlashPlayer nach Updates sucht. Den FlashPlayer kann man direkt bei der Installation so konfigurieren, dass er nach Updates automatisch sucht, nachträglich kann man das über folgenden Link machen:
Adobe - Flash Player: Einstellungsmanager - Globale Benachrichtigungseinstellungen


Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems.

Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür
  • verwende für jede Anwendung und jeden Account ein anderes Passwort
  • ändere regelmäßig dein Passwort, vor allem bei Onlinebanking oder deinem Emailpostfach ist dieses sehr wichtig
  • speichere keine Passwörter auf deinem PC, gib diese nicht an dritte weiter
  • ein sicheres Passwort besteht aus mindestens 8 Zeichen und beinhaltet Groß- und Kleinbuchstaben, Zahlen, und Sonderzeichen
  • benutze keine Zahlen- oder Buchstabenkombinationen, ( zB 12345678, qwertzui) auch keine Zahlen oder Buchstabenmuster
  • verwende keine Passwörter die einen Bezug zu dir, deinem Wohnort, Familienmitglied oder Haustier (Geburtsdatum, Postleitzahl, Adresse, Name)



Aktualität des Systems
Es ist extrem wichtig, dass sowohl dein System als auch die darauf installierte sicherheitsrelevante Software (Flash Player, PDF-Reader und besonders Java, sofern vorhanden) aktuell sind.
  • Bitte überprüfe, ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.

Antivirensoftware
  • Gehe sicher immer eine Antiviren Software installiert zu haben und halte diese unbedingt aktuell.

Zusätzlicher Schutz
  • MalwareBytes Anti-Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On-Demand Scantool welches viele aktuelle Malware erkennt und auch entfernt.
    Aktualisiere das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der Internet Explorer, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf einen Banner um diesen zu AdBlockPlus hinzuzufügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Systemleistung
Lösche regelmäßig deine temporären Dateien. Ich empfehle hierzu die Datenträgerbereinigung von Windows.
Windows Vista
  • Klicke unten links auf das Vistasymbol
  • Gehe auf Programme -> Zubehör -> Systemprogramme -> Datenträgerbereinigung
  • Wähle nun Dateien von allen Benutzern des Computers aus und bestätige mit OK
  • Setze den Haken bei den zu löschenden Dateien zusätzlich bei Temporäre Dateien
  • Bestätige mit OK
  • Bestätige dass du die Dateien unwiderruflich löschen möchtest

Windows 7
  • Gehe auf das Windowsstartsymbol
  • Gebe im Suchfeld Datenträgerrereinigung ein
  • Setze den Haken zusätzlich bei Temporäre Dateien
  • Bestätige mit OK

Windows 8
  • Rechtsklicke in die untere linke Ecke deines Bildschirms
  • Klicke auf Suchen
  • Klicke auf Einstellungen
  • Gebe im Suchfeld Datenträgerbereinigung ein
  • Klicke in den Einstellungen auf der linken Seite nun auf Speicherplatz durch Löschen nicht erforderlicher Dateien freigeben
  • Setze den Haken zusätzlich bei Temporäre Dateien
  • Bestätige mit OK
  • Bestätige dass du die Dateien unwiderruflich löschen möchtest

Halte dich fern von jeglichen Registry Cleanern.
Diese schaden deinem System mehr als dass sie es schneller machen.

Verhaltensregeln zum sichereren Surfen
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
  • Achte besonders bei der Installation von Programmen darauf, ob sich weitere Software mitinstallieren möchte, wähle wo immer es geht die benutzerdefinierte Installation und wähle alles ab, was nichts mit dem Programm zu tun hat, welches du dir installieren möchtest.

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind.

Falls Du Lob oder Kritik abgeben möchtest, kannst Du das sehr gerne hier tun.

Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun.

Alt 10.09.2014, 11:00   #11
ChicoMarx
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Alles gemacht und verstanden

Vielen vielen Dank!!!!! Ich werd mir den Thread einrahmen

Alt 10.09.2014, 13:36   #12
Bootsektor
Ruhe in Frieden
† 2019
 
Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Standard

Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


Hallo

Zitat:
Vielen vielen Dank!!!!! Ich werd mir den Thread einrahmen
Nimm lila!

Dieses Thema scheint somit erledigt zu sein. Solltest Du noch Fragen oder Probleme haben, so schicke mir bitte eine PM

Antwort

Themen zu Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe
abges, abgestürzt, bekannte, besonders, eingestuft, explorer, fehlercode 0x80000003, fehlercode 0xc0000005, papierkorb, pup.optional.amonetize, pup.optional.multiplug, pup.optional.multiplug.a, pup.optional.searchhijacker.a, security, smart security, support, teilweise, trojan.sprotector, unbekannte, versuch, windows, windows explorer, ziemlich


« Bildschirm bei Start/Neustart schwarz/blau/weiß | Java may be out of date auf Android & Windows »


Ähnliche Themen: Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe


  1. Panda Internet Security 2016 - SMART ARP ATTACK
    Antiviren-, Firewall- und andere Schutzprogramme - 12.10.2015 (37)
  2. wahrscheinlicher Virus in msdt.exe
    Plagegeister aller Art und deren Bekämpfung - 23.04.2015 (11)
  3. eset smart security funktioniert nicht mehr wegen EKR.exe Fehler
    Log-Analyse und Auswertung - 23.01.2015 (7)
  4. Infektion gefunden unter Eset Smart Security
    Log-Analyse und Auswertung - 03.11.2014 (9)
  5. Verfügt Eset Smart Security 7 über einen wirksamen Echtzeitschutz?
    Antiviren-, Firewall- und andere Schutzprogramme - 03.10.2014 (8)
  6. eset smart security wechseln
    Antiviren-, Firewall- und andere Schutzprogramme - 11.01.2014 (5)
  7. ESET Mobile Security & Antivirus
    Smartphone, Tablet & Handy Security - 10.10.2013 (0)
  8. Smart Security entfernen
    Anleitungen, FAQs & Links - 27.01.2013 (2)
  9. Security Shield eingefangen +LOGS (MB-AM,OTL,ESET)
    Log-Analyse und Auswertung - 27.07.2012 (3)
  10. Smart Fortress 2012 ... ESET läuft schon
    Plagegeister aller Art und deren Bekämpfung - 13.05.2012 (1)
  11. System Smart Security definitiv entfernen
    Plagegeister aller Art und deren Bekämpfung - 06.07.2011 (63)
  12. Nod32 Smart Security 4 sperrt ab und zu mein Internet
    Antiviren-, Firewall- und andere Schutzprogramme - 11.04.2011 (9)
  13. ESET Smart Security oder ESET NOD32 Antivirus?
    Antiviren-, Firewall- und andere Schutzprogramme - 18.10.2010 (1)
  14. SmartSecurity / Smart Security entfernen
    Anleitungen, FAQs & Links - 13.03.2010 (2)
  15. Nod32 Smart Security 3 beenden???
    Antiviren-, Firewall- und andere Schutzprogramme - 17.07.2008 (1)
  16. Port 995 (GMail), Thunderbird & ESET Smart Security
    Antiviren-, Firewall- und andere Schutzprogramme - 26.05.2008 (1)
  17. Smart Security, roter Desktop, Hilfe
    Log-Analyse und Auswertung - 28.03.2005 (2)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe - Hey, ich bin mir ziemlich sicher, dass ich über n Torrent n Virus gefangen habe. Zumindest hat ESET die Datei so eingestuft und zudem noch 2 "SafeClicker"-Dateien, die ich vorher - Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe...
Archiv
Du betrachtest: Wahrscheinlicher Virus ESET Smart Security 7 -> C:\Support\couponsupport.exe auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130