Internetverbindung seit 7 Tagen verschlechtert. Verdacht auf Virus.

clemicool · 14.09.2014, 11:06

Liebe Community,
ich habe ein Problem und bin relativ ratlos wie man es lösen kann.
Ich beschreibe es mal:
Also seit ungefähr 7 Tagen ist das Wlan(bin/kann nur über Wlan rein)schlechter, damit meine ich das es nicht oder kaum nutzbar ist und das Problem tritt nur bei meinem Pc auf.
Mit dem Handy funktioniert alles problemlos und mit den anderen Geräten auch, aber mein Pc ist anscheinend der "Verursacher" des Problems.
Anfangs dachte ich, es sei der Internetbetreiber(Telekom), aber nach einem ausführlichen Gespräch mit denen waren Sie es nicht.
Ich habe auch schon den Wlan Stick gewechselt, aber trotzdem funktioniert es nicht....
Der Router zischt auch ganz leise wenn mein Pc verbunden ist und der Stick/Wlan Lämpchen am Router blinkt wie verrückt.
Ich achte sehr darauf, auf welche Seite ich gehe und was ich downloade.
Der Ping steigt dabei auf 1700ms an und bleibt konstant, aber normal wären so 60ms.

Ich hoffe Ihr könnt mir helfen.

MfG clemicool

M-K-D-B · 14.09.2014, 11:07

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!

Wir schauen mal, ob Malware auf deinem Rechner ist:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

clemicool · 14.09.2014, 11:19

Vielen Dank für deine Hilfe Matthias!

Hier die Log Datein:
FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Clemens (administrator) on CLEMENS-PC on 14-09-2014 12:14:09
Running from C:\Users\Clemens\Desktop
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Gainward Co. Ltd.) C:\Program Files (x86)\EXPERTool\TBPanel.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1937600 2014-09-03] (Valve Corporation)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20924064 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Clemens\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [TBPanel] => C:\Program Files (x86)\EXPERTool\TBPanel.exe [2195240 2014-02-17] (Gainward Co. Ltd.)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [WLAN Optimizer] => C:\Users\Clemens\AppData\Local\Temp\Rar$EXa0.693\WLAN Optimizer.exe <===== ATTENTION
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\MountPoints2: {46059f52-b779-11e3-bea9-60a44c3287ba} - "I:\Startme.exe" 
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\MountPoints2: {f395bf10-ef3e-11e3-becf-60a44c3287ba} - "L:\autorun.exe" 
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\MountPoints2: {f395bf1e-ef3e-11e3-becf-60a44c3287ba} - "M:\Setup.exe" 
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\MountPoints2: {f395bf2e-ef3e-11e3-becf-60a44c3287ba} - "N:\autorun.exe" 
InternetURL: C:\Users\Clemens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFBot.url -> file:///C:\Users\Clemens\Desktop\Neuer Ordner\MFBot-3313-x64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.trovi.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&ISID=M18CEBFDC-E1D6-4F55-A93D-1C20C3016816&SearchSource=55&CUI=&UM=6&UP=SP7A3DCEFA-5B80-459B-8FDB-C5C7F2D6883D&SSPV=
URLSearchHook: HKCU - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
SearchScopes: HKLM - DefaultScope {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=MASBJS
SearchScopes: HKLM - {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=MASBJS
SearchScopes: HKLM-x32 - DefaultScope {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=MASBJS
SearchScopes: HKLM-x32 - {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=MASBJS
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&ISID=M18CEBFDC-E1D6-4F55-A93D-1C20C3016816&SearchSource=58&CUI=&UM=6&UP=SP7A3DCEFA-5B80-459B-8FDB-C5C7F2D6883D&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&ISID=M18CEBFDC-E1D6-4F55-A93D-1C20C3016816&SearchSource=58&CUI=&UM=6&UP=SP7A3DCEFA-5B80-459B-8FDB-C5C7F2D6883D&q={searchTerms}&SSPV=
SearchScopes: HKCU - {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {84FF7BD6-B47F-46F8-9130-01B2696B36CB} ->  No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {00000000-0000-0000-0000-000000000000} -  No File
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler-x32: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\Common Files\Metabar\tdataprotocol.dll (Metabar)
Handler-x32: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\Common Files\Metabar\tdataprotocol.dll (Metabar)
Handler-x32: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\Common Files\Metabar\tdataprotocol.dll (Metabar)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&ISID=M18CEBFDC-E1D6-4F55-A93D-1C20C3016816&SearchSource=55&CUI=&UM=6&UP=SP7A3DCEFA-5B80-459B-8FDB-C5C7F2D6883D&SSPV=
CHR DefaultSearchKeyword: Default -> 7EF8A6062AD9980B04EC38C0140E67D1AB631A9267BA37C8724F777EFDEEF334
CHR DefaultSearchURL: Default -> 02911E6D33CCCCD005F4E8B049980B7B98E1F67E99FEB43A910A249FFDBF0500
CHR Profile: C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-01-24]
CHR Extension: (Google Docs) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-07]
CHR Extension: (Google Drive) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-07]
CHR Extension: (Adblock Plus) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-16]
CHR Extension: (Google-Suche) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-07]
CHR Extension: (Google Play Music) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi [2014-05-16]
CHR Extension: (Heroes & Generals) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbophcdhblbipoaacgchllkobdaolpge [2014-07-20]
CHR Extension: (AdBlock) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-12-16]
CHR Extension: (Google Wallet) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-07]
CHR Extension: (Google Mail) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-07]
CHR Extension: (Extutil) - C:\Users\Clemens\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-04-17]
CHR Extension: (Managera) - C:\Users\Clemens\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-04-17]
CHR Profile: C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Profile 1

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-23] ()
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Apowersoft_AudioDevice; C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
R3 AU8168; C:\Windows\system32\DRIVERS\au630x64.sys [792648 2013-09-23] (Realtek                                            )
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-06-08] (Disc Soft Ltd)
S3 GameKB; C:\Windows\system32\drivers\GameKB.sys [27648 2012-05-11] () [File not signed]
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 RTL8187B; C:\Windows\system32\DRIVERS\RTL8187B.sys [458384 2012-05-31] (Realtek Semiconductor Corporation                           )
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-09-17] (Realtek Semiconductor Corporation                           )
S3 taphss6; C:\Windows\system32\DRIVERS\taphss6.sys [42184 2014-01-15] (Anchorfree Inc.)
S3 XFDriver64; C:\Program Files (x86)\Xfire2\XFDriver64.sys [17160 2013-03-14] (XFire)
S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
S3 wolfkr; \??\C:\AeriaGames\WolfTeam-DE\avital\wolfk64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-14 12:14 - 2014-09-14 12:14 - 00015749 _____ () C:\Users\Clemens\Desktop\FRST.txt
2014-09-14 12:13 - 2014-09-14 12:14 - 00000000 ___DC () C:\FRST
2014-09-14 12:13 - 2014-09-14 12:13 - 02105856 _____ (Farbar) C:\Users\Clemens\Desktop\FRST64.exe
2014-09-14 12:11 - 2014-09-14 12:13 - 02105856 _____ (Farbar) C:\Users\Clemens\Downloads\FRST64.exe
2014-09-14 12:10 - 2014-09-14 12:10 - 00000000 ____D () C:\Windows\LastGood
2014-09-11 17:13 - 2014-08-16 11:34 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-11 17:13 - 2014-08-16 11:34 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-11 17:13 - 2014-08-16 11:34 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-09-11 17:13 - 2014-08-16 11:34 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-11 17:13 - 2014-08-16 11:33 - 19280384 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-11 17:13 - 2014-08-16 11:33 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-11 17:13 - 2014-08-16 11:33 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-11 17:13 - 2014-08-16 11:32 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-11 17:13 - 2014-08-16 09:37 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-11 17:13 - 2014-08-16 09:37 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 14369280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-11 17:13 - 2014-08-16 09:35 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-11 17:13 - 2014-03-07 02:47 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-11 17:13 - 2013-05-16 00:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-09-11 17:13 - 2013-05-16 00:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-09-11 17:13 - 2013-05-14 15:14 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-11 17:13 - 2013-05-14 11:23 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-11 17:13 - 2013-02-21 12:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-09-11 17:13 - 2013-02-21 12:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-11 17:13 - 2013-02-21 12:29 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-11 17:13 - 2013-02-21 12:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-11 17:13 - 2013-02-21 12:14 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-09-11 17:13 - 2013-02-21 12:14 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-11 17:13 - 2013-02-19 11:53 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-09-11 17:13 - 2012-11-08 06:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-11 17:13 - 2012-11-08 06:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-11 17:13 - 2012-07-26 05:06 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-11 16:22 - 2014-08-30 07:48 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-09-11 16:22 - 2014-08-30 07:47 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-09-11 16:22 - 2014-08-30 07:46 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-09-11 16:22 - 2014-08-30 06:05 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-09-11 16:22 - 2014-08-30 06:04 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-09-11 16:22 - 2014-08-30 06:03 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-09-11 16:22 - 2014-06-13 01:34 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-09-11 16:22 - 2014-06-13 01:29 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-09-11 16:19 - 2014-08-02 00:08 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-09-11 16:19 - 2014-07-24 15:50 - 00447296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-09-11 16:19 - 2014-07-17 01:28 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2014-09-11 16:19 - 2014-07-17 00:59 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2014-09-11 16:19 - 2014-07-17 00:59 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2014-09-11 16:19 - 2014-07-12 08:45 - 01549824 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-09-11 16:19 - 2014-07-12 06:36 - 00674304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-09-11 16:19 - 2014-07-12 06:36 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-09-11 16:19 - 2014-07-12 06:34 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-09-11 16:19 - 2014-07-12 06:34 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-09-11 16:19 - 2014-06-28 08:57 - 01341952 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-09-11 16:19 - 2014-06-28 04:23 - 01126400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-09-11 16:12 - 2014-08-28 13:34 - 00059400 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-11 16:12 - 2014-08-28 08:05 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-09-11 16:12 - 2014-08-28 08:05 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-11 16:12 - 2014-08-28 08:05 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-09-11 16:12 - 2014-08-28 08:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-09-11 16:12 - 2014-08-28 08:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-11 16:12 - 2014-08-28 08:01 - 03285504 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 01623552 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wuaext.dll
2014-09-11 16:12 - 2014-07-24 05:33 - 00875688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2014-09-11 16:12 - 2014-07-24 05:33 - 00869544 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2014-09-11 16:10 - 2014-06-05 03:12 - 00678600 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2014-09-11 16:10 - 2014-06-04 01:12 - 00536776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2014-09-11 16:07 - 2014-09-05 00:36 - 00755712 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 16:07 - 2014-09-03 03:49 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 16:03 - 2014-08-09 10:30 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2014-09-11 16:03 - 2014-08-09 10:29 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\tssdisai.dll
2014-09-11 15:59 - 2014-08-01 01:40 - 01287680 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2014-09-08 15:41 - 2014-09-08 17:05 - 240790732 _____ () C:\Users\Clemens\Downloads\Massiv - M10.rar
2014-09-07 19:32 - 2014-09-07 21:14 - 252580822 _____ () C:\Users\Clemens\Downloads\Majoe - BADT.rar
2014-09-07 12:56 - 2014-09-07 12:56 - 00287608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-06 22:04 - 2014-07-12 06:41 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\KBDRUM.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRUM.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-09-06 22:04 - 2014-07-12 06:15 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-09-06 22:04 - 2014-07-12 02:02 - 00478352 _____ () C:\Windows\SysWOW64\locale.nls
2014-09-06 22:04 - 2014-07-12 02:00 - 00478352 _____ () C:\Windows\system32\locale.nls
2014-09-06 22:04 - 2014-07-09 00:33 - 00181248 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe
2014-09-06 22:04 - 2014-07-09 00:32 - 01539584 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2014-09-06 22:04 - 2014-07-09 00:32 - 00340480 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll
2014-09-06 22:04 - 2014-07-09 00:30 - 01220608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2014-09-06 22:04 - 2014-07-07 07:52 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2014-09-06 22:04 - 2014-07-07 07:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2014-09-06 22:04 - 2014-07-04 12:52 - 00328000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-09-06 22:04 - 2014-07-03 03:59 - 01824784 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-09-06 22:04 - 2014-07-03 02:30 - 01408952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-09-06 22:04 - 2014-06-28 09:01 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2014-09-06 22:04 - 2014-06-28 08:57 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-09-06 22:04 - 2014-06-28 08:56 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2014-09-06 22:04 - 2014-06-25 09:09 - 00733184 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-09-06 22:04 - 2014-06-25 09:07 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-09-06 22:04 - 2014-06-18 01:27 - 02032640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-06 22:04 - 2014-06-18 01:23 - 02238464 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-06 22:04 - 2014-06-11 16:47 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-09-06 22:04 - 2014-06-11 06:40 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-09-06 22:04 - 2014-06-11 00:44 - 01403896 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-09-06 22:04 - 2014-05-30 01:31 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-09-06 22:04 - 2014-05-30 01:03 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-09-06 22:04 - 2014-02-04 12:57 - 01271664 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-09-06 22:00 - 2014-08-21 01:40 - 00732880 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-09-06 22:00 - 2014-08-20 19:05 - 00694784 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-09-06 22:00 - 2014-08-20 19:05 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-09-06 22:00 - 2014-08-20 19:05 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-06 22:00 - 2014-08-20 19:02 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-09-06 22:00 - 2014-08-20 19:02 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-06 22:00 - 2014-06-24 09:35 - 00010450 _____ () C:\Windows\system32\autoconfig.cab
2014-09-06 22:00 - 2014-06-24 08:40 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2014-09-06 20:43 - 2014-09-06 20:45 - 03380372 _____ () C:\Users\Clemens\Downloads\adblockplusandroid-1.2.1.apk
2014-09-03 18:04 - 2014-09-03 18:15 - 29354504 _____ () C:\Users\Clemens\Downloads\25865-weapon-sound-by-just.zip
2014-09-03 17:52 - 2014-09-03 17:59 - 19379431 _____ () C:\Users\Clemens\Downloads\Weapon Sounds.rar
2014-09-03 17:39 - 2014-09-03 17:51 - 29354504 _____ () C:\Users\Clemens\Downloads\25865-weapon-sound-by-just.zip.zip
2014-09-03 17:37 - 2014-09-03 17:37 - 00308076 _____ () C:\Users\Clemens\Downloads\Sounds.zip
2014-09-03 17:37 - 2014-09-03 17:37 - 00305919 _____ () C:\Users\Clemens\Downloads\Weapon Sounds by Rodrigo Lopez.rar
2014-09-03 17:37 - 2014-09-03 17:37 - 00228184 _____ () C:\Users\Clemens\Downloads\sounds (2).rar
2014-09-03 16:44 - 2014-09-03 16:44 - 00043130 _____ () C:\Users\Clemens\Downloads\CONFIG for scorpion.zip
2014-09-03 16:13 - 2014-09-03 16:25 - 29143789 _____ () C:\Users\Clemens\Downloads\Sounds-nd-Mods.rar
2014-09-01 15:51 - 2014-09-01 16:02 - 25949466 _____ () C:\Users\Clemens\Downloads\GENRL (2)
2014-09-01 12:32 - 2014-09-01 12:39 - 17567358 _____ () C:\Users\Clemens\Downloads\ASG Bilder.zip
2014-08-31 22:23 - 2014-08-31 22:25 - 00000000 ____D () C:\Users\Clemens\AppData\Local\LoiLo
2014-08-31 22:23 - 2014-08-31 22:23 - 00000000 ____D () C:\Users\Clemens\Documents\LoiLo
2014-08-31 21:50 - 2014-08-31 22:22 - 74612920 _____ (LoiLo inc. ) C:\Users\Clemens\Downloads\LoiLoGameRecorder1.1.0.0.exe
2014-08-29 22:16 - 2014-08-29 22:16 - 04652126 _____ () C:\Users\Clemens\Desktop\Unbenannt.mp4
2014-08-29 19:29 - 2014-08-29 19:40 - 25607384 _____ () C:\Users\Clemens\Downloads\GENRL (1)
2014-08-28 13:49 - 2014-08-23 08:47 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-28 13:49 - 2014-07-16 01:03 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 13:49 - 2014-07-12 04:36 - 01023488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-22 23:18 - 2014-08-22 23:19 - 00234729 _____ () C:\Users\Clemens\Downloads\imgtool20.zip
2014-08-21 22:41 - 2014-08-21 22:41 - 03582842 _____ () C:\Users\Clemens\Downloads\229446-669214-san-andreas-mod-installer.zip
2014-08-21 22:40 - 2014-08-21 22:40 - 01028010 _____ () C:\Users\Clemens\Downloads\Backup Radar gta sa.rar
2014-08-21 22:38 - 2014-08-21 22:38 - 00899752 _____ () C:\Users\Clemens\Downloads\installer_san_andreas_mod_install_Deutsch.exe
2014-08-21 22:38 - 2014-08-21 22:38 - 00523910 _____ () C:\Users\Clemens\Downloads\rockstargames_sabackupfronten123andpc.rar
2014-08-21 22:12 - 2014-08-21 22:12 - 00034816 _____ () C:\Users\Clemens\Downloads\radar00.txd
2014-08-21 20:02 - 2014-08-21 20:02 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-21 20:02 - 2014-08-21 20:02 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-20 02:49 - 2014-08-20 02:49 - 00000000 __HDC () C:\$SysReset
2014-08-20 02:43 - 2014-08-20 02:43 - 00030084 _____ () C:\Windows\Ascd_tmp.ini
2014-08-20 02:43 - 2014-08-20 02:43 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-08-20 02:43 - 2009-04-02 22:30 - 00010296 _____ () C:\Windows\SysWOW64\Drivers\ASUSHWIO.SYS
2014-08-19 22:17 - 2014-08-19 22:22 - 09941504 _____ (mfbot.de) C:\Users\Clemens\Downloads\MFBot-3313-x64.exe
2014-08-19 21:28 - 2014-08-19 21:28 - 00002120 _____ () C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk
2014-08-19 21:28 - 2014-08-19 21:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3
2014-08-19 19:55 - 2014-08-19 20:10 - 19357147 _____ () C:\Users\Clemens\Downloads\Sound's.rar
2014-08-19 19:32 - 2014-08-19 19:33 - 02697862 _____ () C:\Users\Clemens\Downloads\1407954038_GTA SA - Weapons Brazuca - PointBlank.rar
2014-08-19 19:29 - 2014-08-19 19:30 - 02116570 _____ () C:\Users\Clemens\Downloads\1407954055_GTA SA - Weapons BLOODY - PointBlank.rar
2014-08-19 19:08 - 2014-08-19 19:09 - 00604863 _____ () C:\Users\Clemens\Downloads\Sounds (1).rar
2014-08-19 19:08 - 2014-08-19 19:08 - 00604863 _____ () C:\Users\Clemens\Downloads\Sounds.rar
2014-08-19 18:51 - 2014-08-19 18:54 - 07930562 _____ () C:\Users\Clemens\Downloads\1407916887_SLAUGHTER WP.zip
2014-08-19 18:50 - 2014-08-19 18:51 - 00751090 _____ () C:\Users\Clemens\Downloads\1407954016_GTA SA - Weapons GSL 2014 - PointBlank.rar
2014-08-19 18:46 - 2014-08-19 18:46 - 00541641 _____ () C:\Users\Clemens\Downloads\Pack.zip
2014-08-18 19:34 - 2014-08-18 19:35 - 01239430 _____ () C:\Users\Clemens\Downloads\603_randomnigga.zip
2014-08-18 19:34 - 2014-08-18 19:35 - 01014521 _____ () C:\Users\Clemens\Downloads\730_cityboy.zip
2014-08-18 19:33 - 2014-08-18 19:34 - 00852757 _____ () C:\Users\Clemens\Downloads\682_claudefx.zip
2014-08-18 17:50 - 2014-08-18 17:50 - 00005243 _____ () C:\Users\Clemens\Downloads\gta-sa_mini_su (1).rar
2014-08-18 16:07 - 2014-08-18 16:07 - 00002120 _____ () C:\Users\Public\Desktop\MTA San Andreas 1.4.lnk
2014-08-18 16:07 - 2014-08-18 16:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4
2014-08-18 15:50 - 2014-08-18 15:58 - 21866928 _____ (Multi Theft Auto) C:\Users\Clemens\Downloads\mtasa-1.4.exe
2014-08-18 15:30 - 2014-08-18 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2014-08-17 23:40 - 2014-08-17 23:45 - 11990847 _____ () C:\Users\Clemens\Downloads\sa-mp-0.3z-R1-install.exe
2014-08-17 22:25 - 2014-08-17 22:37 - 25932734 _____ () C:\Users\Clemens\Downloads\GENRL
2014-08-17 04:15 - 2014-08-17 22:34 - 00000000 ____D () C:\Windows\softwaredistribution.bak1
2014-08-17 00:11 - 2014-08-17 00:18 - 14483057 _____ () C:\Users\Clemens\Downloads\12_gun_pack.rar
2014-08-16 22:56 - 2014-08-16 22:57 - 01861203 _____ () C:\Users\Clemens\Downloads\43_fam1.zip
2014-08-16 22:54 - 2014-08-16 22:56 - 05343493 _____ () C:\Users\Clemens\Downloads\512-2_gunpack.zip
2014-08-16 02:09 - 2014-08-18 16:07 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.4
2014-08-16 00:56 - 2014-06-11 00:44 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 00:56 - 2014-06-11 00:43 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-16 00:29 - 2014-06-13 03:57 - 01453400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 00:29 - 2014-06-13 03:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-16 00:19 - 2014-06-05 19:56 - 00112984 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-16 00:19 - 2014-06-05 19:29 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 00:19 - 2014-06-05 15:11 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-16 00:17 - 2014-06-20 01:35 - 01312768 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-16 00:17 - 2014-06-20 00:24 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-14 12:14 - 2014-09-14 12:14 - 00015749 _____ () C:\Users\Clemens\Desktop\FRST.txt
2014-09-14 12:14 - 2014-09-14 12:13 - 00000000 ___DC () C:\FRST
2014-09-14 12:14 - 2014-01-15 16:28 - 01766959 _____ () C:\Windows\WindowsUpdate.log
2014-09-14 12:13 - 2014-09-14 12:13 - 02105856 _____ (Farbar) C:\Users\Clemens\Desktop\FRST64.exe
2014-09-14 12:13 - 2014-09-14 12:11 - 02105856 _____ (Farbar) C:\Users\Clemens\Downloads\FRST64.exe
2014-09-14 12:11 - 2013-12-07 12:35 - 00001134 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-14 12:10 - 2014-09-14 12:10 - 00000000 ____D () C:\Windows\LastGood
2014-09-14 11:43 - 2013-12-31 14:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-14 11:43 - 2013-12-13 20:54 - 00007598 _____ () C:\Users\Clemens\AppData\Local\Resmon.ResmonCfg
2014-09-14 11:37 - 2013-12-07 12:35 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-14 11:35 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-09-12 16:02 - 2013-12-07 13:47 - 00000000 ____D () C:\Users\Clemens\AppData\Roaming\TS3Client
2014-09-12 15:42 - 2013-12-08 18:10 - 13763072 ___SH () C:\Users\Clemens\Desktop\Thumbs.db
2014-09-11 20:57 - 2014-01-03 16:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-11 20:56 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-11 20:51 - 2013-12-09 19:02 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-11 20:51 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-11 20:11 - 2014-01-19 20:07 - 00080820 _____ () C:\Windows\PFRO.log
2014-09-11 17:51 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-09-11 17:24 - 2014-07-10 16:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-11 17:24 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-09-11 17:16 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-09-11 17:12 - 2013-12-09 18:32 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-11 17:10 - 2013-12-09 18:32 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-11 15:51 - 2014-01-13 23:23 - 00003584 _____ () C:\Users\Clemens\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-09 19:52 - 2013-12-31 14:54 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-08 19:08 - 2014-02-08 13:38 - 00000000 ____D () C:\Program Files (x86)\Activision
2014-09-08 19:07 - 2013-12-09 18:33 - 00032768 ____H () C:\Users\Clemens\Desktop\photothumb.db
2014-09-08 17:19 - 2014-07-23 01:20 - 00000000 ____D () C:\Users\Clemens\AppData\Local\mfbot.de
2014-09-08 17:05 - 2014-09-08 15:41 - 240790732 _____ () C:\Users\Clemens\Downloads\Massiv - M10.rar
2014-09-07 21:14 - 2014-09-07 19:32 - 252580822 _____ () C:\Users\Clemens\Downloads\Majoe - BADT.rar
2014-09-07 17:35 - 2014-07-05 11:09 - 00000000 ____D () C:\Users\Clemens\Desktop\Mods
2014-09-07 17:35 - 2014-06-08 20:43 - 00000000 ___RD () C:\Users\Clemens\Desktop\Alles
2014-09-07 12:56 - 2014-09-07 12:56 - 00287608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-06 22:10 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-09-06 22:10 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-09-06 20:45 - 2014-09-06 20:43 - 03380372 _____ () C:\Users\Clemens\Downloads\adblockplusandroid-1.2.1.apk
2014-09-05 15:54 - 2013-12-07 12:17 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-957755645-4260464881-2478257714-1001
2014-09-05 00:36 - 2014-09-11 16:07 - 00755712 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-03 18:17 - 2014-04-27 02:24 - 00000000 ____D () C:\Users\Clemens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\www.gtavicecity.ru
2014-09-03 18:15 - 2014-09-03 18:04 - 29354504 _____ () C:\Users\Clemens\Downloads\25865-weapon-sound-by-just.zip
2014-09-03 17:59 - 2014-09-03 17:52 - 19379431 _____ () C:\Users\Clemens\Downloads\Weapon Sounds.rar
2014-09-03 17:51 - 2014-09-03 17:39 - 29354504 _____ () C:\Users\Clemens\Downloads\25865-weapon-sound-by-just.zip.zip
2014-09-03 17:37 - 2014-09-03 17:37 - 00308076 _____ () C:\Users\Clemens\Downloads\Sounds.zip
2014-09-03 17:37 - 2014-09-03 17:37 - 00305919 _____ () C:\Users\Clemens\Downloads\Weapon Sounds by Rodrigo Lopez.rar
2014-09-03 17:37 - 2014-09-03 17:37 - 00228184 _____ () C:\Users\Clemens\Downloads\sounds (2).rar
2014-09-03 17:37 - 2014-01-07 19:48 - 00000000 ____D () C:\Users\Clemens\AppData\Roaming\vlc
2014-09-03 16:44 - 2014-09-03 16:44 - 00043130 _____ () C:\Users\Clemens\Downloads\CONFIG for scorpion.zip
2014-09-03 16:25 - 2014-09-03 16:13 - 29143789 _____ () C:\Users\Clemens\Downloads\Sounds-nd-Mods.rar
2014-09-03 03:49 - 2014-09-11 16:07 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-02 21:32 - 2014-07-10 16:19 - 00705480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-02 21:32 - 2014-07-10 16:19 - 00104904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-01 16:02 - 2014-09-01 15:51 - 25949466 _____ () C:\Users\Clemens\Downloads\GENRL (2)
2014-09-01 12:39 - 2014-09-01 12:32 - 17567358 _____ () C:\Users\Clemens\Downloads\ASG Bilder.zip
2014-08-31 22:25 - 2014-08-31 22:23 - 00000000 ____D () C:\Users\Clemens\AppData\Local\LoiLo
2014-08-31 22:23 - 2014-08-31 22:23 - 00000000 ____D () C:\Users\Clemens\Documents\LoiLo
2014-08-31 22:22 - 2014-08-31 21:50 - 74612920 _____ (LoiLo inc. ) C:\Users\Clemens\Downloads\LoiLoGameRecorder1.1.0.0.exe
2014-08-30 07:48 - 2014-09-11 16:22 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-08-30 07:47 - 2014-09-11 16:22 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-30 07:46 - 2014-09-11 16:22 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-30 06:05 - 2014-09-11 16:22 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-08-30 06:04 - 2014-09-11 16:22 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-30 06:03 - 2014-09-11 16:22 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-29 22:16 - 2014-08-29 22:16 - 04652126 _____ () C:\Users\Clemens\Desktop\Unbenannt.mp4
2014-08-29 19:40 - 2014-08-29 19:29 - 25607384 _____ () C:\Users\Clemens\Downloads\GENRL (1)
2014-08-28 22:11 - 2014-01-03 17:17 - 00000000 ____D () C:\Users\Clemens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-08-28 22:02 - 2014-04-04 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-08-28 22:02 - 2014-04-04 14:38 - 00000000 ____D () C:\Program Files (x86)\Sony
2014-08-28 22:02 - 2014-03-03 17:59 - 00000000 ____D () C:\ProgramData\Sony
2014-08-28 22:02 - 2014-01-11 11:36 - 00000000 ____D () C:\Users\Clemens\AppData\Local\CrashDumps
2014-08-28 22:02 - 2013-12-28 19:58 - 00000000 ___RD () C:\Users\Clemens\Desktop\Tools
2014-08-28 13:34 - 2014-09-11 16:12 - 00059400 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-28 08:05 - 2014-09-11 16:12 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-28 08:05 - 2014-09-11 16:12 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-28 08:05 - 2014-09-11 16:12 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-28 08:05 - 2014-09-11 16:12 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-28 08:02 - 2014-09-11 16:12 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-28 08:01 - 2014-09-11 16:12 - 03285504 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 01623552 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wuaext.dll
2014-08-23 08:47 - 2014-08-28 13:49 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 23:19 - 2014-08-22 23:18 - 00234729 _____ () C:\Users\Clemens\Downloads\imgtool20.zip
2014-08-22 12:48 - 2013-12-07 12:10 - 00000000 ____D () C:\Users\Clemens\AppData\Local\Packages
2014-08-21 22:41 - 2014-08-21 22:41 - 03582842 _____ () C:\Users\Clemens\Downloads\229446-669214-san-andreas-mod-installer.zip
2014-08-21 22:40 - 2014-08-21 22:40 - 01028010 _____ () C:\Users\Clemens\Downloads\Backup Radar gta sa.rar
2014-08-21 22:38 - 2014-08-21 22:38 - 00899752 _____ () C:\Users\Clemens\Downloads\installer_san_andreas_mod_install_Deutsch.exe
2014-08-21 22:38 - 2014-08-21 22:38 - 00523910 _____ () C:\Users\Clemens\Downloads\rockstargames_sabackupfronten123andpc.rar
2014-08-21 22:12 - 2014-08-21 22:12 - 00034816 _____ () C:\Users\Clemens\Downloads\radar00.txd
2014-08-21 20:03 - 2013-12-12 17:47 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-21 20:02 - 2014-08-21 20:02 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-21 20:02 - 2014-08-21 20:02 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-21 01:40 - 2014-09-06 22:00 - 00732880 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-08-20 19:05 - 2014-09-06 22:00 - 00694784 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-08-20 19:05 - 2014-09-06 22:00 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-08-20 19:05 - 2014-09-06 22:00 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-08-20 19:02 - 2014-09-06 22:00 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-08-20 19:02 - 2014-09-06 22:00 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-08-20 02:49 - 2014-08-20 02:49 - 00000000 __HDC () C:\$SysReset
2014-08-20 02:43 - 2014-08-20 02:43 - 00030084 _____ () C:\Windows\Ascd_tmp.ini
2014-08-20 02:43 - 2014-08-20 02:43 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-08-20 01:44 - 2014-02-15 13:54 - 00007110 _____ () C:\Windows\setupact.log
2014-08-19 22:23 - 2013-12-18 19:18 - 00000000 ____D () C:\Users\Clemens\Desktop\Musik
2014-08-19 22:22 - 2014-08-19 22:17 - 09941504 _____ (mfbot.de) C:\Users\Clemens\Downloads\MFBot-3313-x64.exe
2014-08-19 21:28 - 2014-08-19 21:28 - 00002120 _____ () C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk
2014-08-19 21:28 - 2014-08-19 21:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3
2014-08-19 21:28 - 2014-02-04 18:42 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.3
2014-08-19 21:28 - 2013-12-07 12:39 - 00000000 ____D () C:\ProgramData\MTA San Andreas All
2014-08-19 20:10 - 2014-08-19 19:55 - 19357147 _____ () C:\Users\Clemens\Downloads\Sound's.rar
2014-08-19 19:33 - 2014-08-19 19:32 - 02697862 _____ () C:\Users\Clemens\Downloads\1407954038_GTA SA - Weapons Brazuca - PointBlank.rar
2014-08-19 19:30 - 2014-08-19 19:29 - 02116570 _____ () C:\Users\Clemens\Downloads\1407954055_GTA SA - Weapons BLOODY - PointBlank.rar
2014-08-19 19:09 - 2014-08-19 19:08 - 00604863 _____ () C:\Users\Clemens\Downloads\Sounds (1).rar
2014-08-19 19:08 - 2014-08-19 19:08 - 00604863 _____ () C:\Users\Clemens\Downloads\Sounds.rar
2014-08-19 18:54 - 2014-08-19 18:51 - 07930562 _____ () C:\Users\Clemens\Downloads\1407916887_SLAUGHTER WP.zip
2014-08-19 18:51 - 2014-08-19 18:50 - 00751090 _____ () C:\Users\Clemens\Downloads\1407954016_GTA SA - Weapons GSL 2014 - PointBlank.rar
2014-08-19 18:46 - 2014-08-19 18:46 - 00541641 _____ () C:\Users\Clemens\Downloads\Pack.zip
2014-08-18 22:25 - 2014-02-08 13:52 - 00442041 _____ () C:\Windows\DirectX.log
2014-08-18 19:35 - 2014-08-18 19:34 - 01239430 _____ () C:\Users\Clemens\Downloads\603_randomnigga.zip
2014-08-18 19:35 - 2014-08-18 19:34 - 01014521 _____ () C:\Users\Clemens\Downloads\730_cityboy.zip
2014-08-18 19:34 - 2014-08-18 19:33 - 00852757 _____ () C:\Users\Clemens\Downloads\682_claudefx.zip
2014-08-18 17:50 - 2014-08-18 17:50 - 00005243 _____ () C:\Users\Clemens\Downloads\gta-sa_mini_su (1).rar
2014-08-18 17:48 - 2014-07-04 23:52 - 00005138 _____ () C:\Users\Clemens\Downloads\gta-sa_mini_su.rar
2014-08-18 16:07 - 2014-08-18 16:07 - 00002120 _____ () C:\Users\Public\Desktop\MTA San Andreas 1.4.lnk
2014-08-18 16:07 - 2014-08-18 16:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4
2014-08-18 16:07 - 2014-08-16 02:09 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.4
2014-08-18 15:58 - 2014-08-18 15:50 - 21866928 _____ (Multi Theft Auto) C:\Users\Clemens\Downloads\mtasa-1.4.exe
2014-08-18 15:30 - 2014-08-18 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2014-08-18 15:30 - 2013-12-07 12:16 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-08-18 12:55 - 2013-12-07 13:46 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-08-17 23:45 - 2014-08-17 23:40 - 11990847 _____ () C:\Users\Clemens\Downloads\sa-mp-0.3z-R1-install.exe
2014-08-17 23:45 - 2014-02-09 16:38 - 00000000 ____D () C:\Users\Clemens\Documents\GTA San Andreas User Files
2014-08-17 22:37 - 2014-08-17 22:25 - 25932734 _____ () C:\Users\Clemens\Downloads\GENRL
2014-08-17 22:34 - 2014-08-17 04:15 - 00000000 ____D () C:\Windows\softwaredistribution.bak1
2014-08-17 00:18 - 2014-08-17 00:11 - 14483057 _____ () C:\Users\Clemens\Downloads\12_gun_pack.rar
2014-08-16 22:57 - 2014-08-16 22:56 - 01861203 _____ () C:\Users\Clemens\Downloads\43_fam1.zip
2014-08-16 22:56 - 2014-08-16 22:54 - 05343493 _____ () C:\Users\Clemens\Downloads\512-2_gunpack.zip
2014-08-16 12:58 - 2013-12-09 21:49 - 00481792 ___SH () C:\Users\Clemens\Downloads\Thumbs.db
2014-08-16 11:34 - 2014-09-11 17:13 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-16 11:34 - 2014-09-11 17:13 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-16 11:34 - 2014-09-11 17:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-08-16 11:34 - 2014-09-11 17:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-16 11:33 - 2014-09-11 17:13 - 19280384 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-16 11:33 - 2014-09-11 17:13 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-16 11:33 - 2014-09-11 17:13 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-16 11:32 - 2014-09-11 17:13 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-16 09:37 - 2014-09-11 17:13 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-16 09:37 - 2014-09-11 17:13 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 14369280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-16 09:35 - 2014-09-11 17:13 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

Some content of TEMP:
====================
C:\Users\Clemens\AppData\Local\Temp\amt_awesomehp.exe
C:\Users\Clemens\AppData\Local\Temp\drm_dyndata_7380015.dll
C:\Users\Clemens\AppData\Local\Temp\drm_dyndata_7390006.dll
C:\Users\Clemens\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Clemens\AppData\Local\Temp\drm_dyndata_7410004.dll
C:\Users\Clemens\AppData\Local\Temp\installer_san_andreas_mod_install_Deutsch.exe
C:\Users\Clemens\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Clemens\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Clemens\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Clemens\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Clemens\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Clemens\AppData\Local\Temp\nsc1209.exe
C:\Users\Clemens\AppData\Local\Temp\nscAD7B.exe
C:\Users\Clemens\AppData\Local\Temp\nseCB77.exe
C:\Users\Clemens\AppData\Local\Temp\nskB114.exe
C:\Users\Clemens\AppData\Local\Temp\nsmAB96.exe
C:\Users\Clemens\AppData\Local\Temp\nsmF88.exe
C:\Users\Clemens\AppData\Local\Temp\nsq1188.exe
C:\Users\Clemens\AppData\Local\Temp\nss37E5.exe
C:\Users\Clemens\AppData\Local\Temp\nsw34F6.exe
C:\Users\Clemens\AppData\Local\Temp\nsyC982.exe
C:\Users\Clemens\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Clemens\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Clemens\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Clemens\AppData\Local\Temp\nvStInst.exe
C:\Users\Clemens\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Clemens\AppData\Local\Temp\sdapskill.exe
C:\Users\Clemens\AppData\Local\Temp\sdaspwn.exe
C:\Users\Clemens\AppData\Local\Temp\SRLDetectionLibrary5065165501650374711.dll
C:\Users\Clemens\AppData\Local\Temp\toolbar.exe
C:\Users\Clemens\AppData\Local\Temp\ubi1292.tmp.exe
C:\Users\Clemens\AppData\Local\Temp\ubiCF17.tmp.exe
C:\Users\Clemens\AppData\Local\Temp\Uninstaller-2640.exe
C:\Users\Clemens\AppData\Local\Temp\Uninstaller-3180.exe
C:\Users\Clemens\AppData\Local\Temp\utt912F.tmp.exe
C:\Users\Clemens\AppData\Local\Temp\xmlUpdater.exe
C:\Users\Clemens\AppData\Local\Temp\_is7742.exe
C:\Users\Clemens\AppData\Local\Temp\_is9890.exe
C:\Users\Clemens\AppData\Local\Temp\{70DC1A77-A9D3-49D1-9097-3A19CDF7807E}-35.0.1916.114_chrome_installer.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-07 17:07

==================== End Of Log ============================

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Clemens at 2014-09-14 12:15:20
Running from C:\Users\Clemens\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Alpha Protocol (HKLM-x32\...\{D37FE0E3-B1A9-4E41-AB5D-DA62E04D2C42}) (Version: 1.00.0000 - SEGA Corporation)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Assassin's Creed Brotherhood (HKLM-x32\...\{BE4BA698-8533-4F77-9559-C7F3F78C0B05}) (Version: 1.00 - Ubisoft)
Assassin's Creed Revelations (HKLM-x32\...\{33A22B2D-55BA-4508-B767-BF2E9C21A73F}) (Version: 1.00 - Ubisoft)
Borderlands (HKLM-x32\...\{52B65911-1559-4ED5-9461-46957FDD48CD}) (Version: 1.0.295 - 2K Games)
Borderlands 2 (HKLM-x32\...\Borderlands 2_is1) (Version:  - )
Call of Duty(R) 4 - Modern Warfare(TM) (HKLM-x32\...\InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}) (Version: 1.7 - Activision)
Call of Duty(R) 4 - Modern Warfare(TM) (x32 Version: 1.6 - Activision) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch (x32 Version:  - ) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch (x32 Version: 1.7 - Activision) Hidden
Call of Duty: Black Ops - Multiplayer (HKLM-x32\...\Steam App 42710) (Version:  - Treyarch)
Call of Duty: Black Ops (HKLM-x32\...\Steam App 42700) (Version:  - Treyarch)
Camtasia Studio 8 (HKLM-x32\...\{F5C9BE9A-04C3-4A72-8CD0-BB67C722D608}) (Version: 8.1.2.1344 - TechSmith Corporation)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
EXPERTool v9.1 (HKLM-x32\...\{551D9481-9487-4D0C-9A1D-6BC3E7B6D991}_is1) (Version: 9.1.0.2 - Gainward Co. Ltd.)
Fallout New Vegas (HKLM-x32\...\Fallout New Vegas_is1) (Version: 1.0 - Bethesda Softworks)
Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.00 - Ubisoft)
Far Cry 3 Blood Dragon (HKLM-x32\...\{A071F478-73E0-4143-AE55-4DD6BABD74F5}) (Version: 1.00 - Ubisoft)
Far Cry 3 Deutsch Patch Fix-TokZic 1.00 (HKLM-x32\...\Far Cry 3 Deutsch Patch Fix-TokZic 1.00) (Version: 1.00 - TokZic)
Far Cry 3 Deutsch Patch-TokZic 1.00 (HKLM-x32\...\Far Cry 3 Deutsch Patch-TokZic 1.00) (Version: 1.00 - TokZic)
Fiesta Online (HKLM-x32\...\Steam App 280620) (Version:  - Onson Soft)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Grand Theft Auto San Andreas (HKLM-x32\...\{086BADF8-9B1F-4E89-B207-2EDA520972D6}) (Version: 1.00.00001 - Rockstar Games)
Grand Theft Auto: Episodes From Liberty City (HKLM-x32\...\{61B8B2F9-D8DA-4B24-89A9-DB09F38A4899}) (Version: 1.1.0.0 - Rockstar Games)
Grand Theft Auto: Episodes from Liberty City (x32 Version: 1.0.0003.135 - Rockstar Games Inc.) Hidden
Hitman Absolution (HKLM-x32\...\Hitman Absolution_is1) (Version:  - )
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Mafia II (HKLM-x32\...\Mafia II_is1) (Version: 1.0 - Take-Two Interactive Software, Inc.)
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10111.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Mirror's Edge™ (HKLM-x32\...\{AEDBD563-24BB-4EE3-8366-A654DAC2D988}) (Version: 1.0.0.0 - Electronic Arts)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MTA:SA v1.3.5 (HKLM-x32\...\MTA:SA 1.3) (Version: v1.3.5 - Multi Theft Auto)
MTA:SA v1.4.0 (HKLM-x32\...\MTA:SA 1.4) (Version: v1.4.0 - Multi Theft Auto)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.6 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
Orcs Must Die! (HKLM-x32\...\Orcs Must Die!_is1) (Version:  - )
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version:  - OVERKILL - a Starbreeze Studio.)
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Sniper Elite: Zombie Army (HKLM-x32\...\Steam App 235700) (Version:  - Rebellion)
Sniper Elite: Zombie Army 2 (HKLM-x32\...\Steam App 247930) (Version:  - Rebellion)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
System Requirements Lab for Intel (HKLM-x32\...\{04C4B49D-45D9-4A28-9ED1-B45CBD99B8C7}) (Version: 4.5.24.0 - Husdawg, LLC)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
Vegas Pro 12.0 (64-bit) (HKLM\...\{BE94768F-5232-11E3-BD78-F04DA23A5C58}) (Version: 12.0.770 - Sony)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Xfire 2.0 (HKLM-x32\...\{43ADAE00-A4ED-4379-A76D-A1FF5D9D334A}_is1) (Version: 2.0 - Xfire, Inc.)
Xfire Codec (remove only) (HKLM-x32\...\XfireCodec) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

26-08-2014 11:47:07 Windows Update
29-08-2014 15:00:13 Windows Update
01-09-2014 17:42:07 Windows Update
05-09-2014 13:55:02 Windows Update
09-09-2014 12:54:50 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 07:26 - 2014-03-02 16:07 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {4E89B4B0-CC85-46ED-B4E8-3F3CA78FCCC4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-07] (Google Inc.)
Task: {69CB7372-1372-43A0-987D-6A1072039494} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-09-11] (Microsoft Corporation)
Task: {722F2DA5-3D75-4B8B-A706-616B7C64A5E9} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe
Task: {744E0A84-6F53-48A1-8682-6CD9292E97D0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-07] (Google Inc.)
Task: {8063572F-4A3D-4740-BAAA-BC079BF24584} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-09] (Adobe Systems Incorporated)
Task: {836ABE6E-E11C-4E82-96A8-985A05C32049} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
Task: {8AF71566-8F9A-490E-9EE2-512F7C72ECBA} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install => C:\Windows\system32\NotificationUI.exe [2014-08-21] (Microsoft Corporation)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {C4A2FA10-F036-4824-9D0C-1800F17E6AB9} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {EBD8D9D1-EE7A-404D-BB8C-4619D14EEB36} - System32\Tasks\EXPERTool => C:\Program Files (x86)\EXPERTool\TBPanel.exe [2014-02-17] (Gainward Co. Ltd.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-12-09 19:20 - 2014-06-23 15:49 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-12-09 19:02 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libglesv2.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libegl.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\pdf.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData:NT
AlternateDataStreams: C:\ProgramData:NT2
AlternateDataStreams: C:\Users\All Users:NT
AlternateDataStreams: C:\Users\All Users:NT2
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2
AlternateDataStreams: C:\ProgramData\Application Data:NT
AlternateDataStreams: C:\ProgramData\Application Data:NT2
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2
AlternateDataStreams: C:\Users\Clemens\Anwendungsdaten:NT
AlternateDataStreams: C:\Users\Clemens\Anwendungsdaten:NT2
AlternateDataStreams: C:\Users\Clemens\AppData\Roaming:NT
AlternateDataStreams: C:\Users\Clemens\AppData\Roaming:NT2

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "NvBackend"
HKLM\...\StartupApproved\Run32: => "Aeria Ignite"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKCU\...\StartupApproved\StartupFolder: => "MFBot.url"
HKCU\...\StartupApproved\Run: => "EA Core"
HKCU\...\StartupApproved\Run: => "Steam"
HKCU\...\StartupApproved\Run: => "Skype"
HKCU\...\StartupApproved\Run: => "Akamai NetSession Interface"
HKCU\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKCU\...\StartupApproved\Run: => "Overwolf"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/14/2014 11:33:06 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (09/11/2014 08:13:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Multi Theft Auto.exe, Version 1.5975.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 10a8

Startzeit: 01cfcdec02e11892

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\MTA San Andreas 1.3\Multi Theft Auto.exe

Berichts-ID: 4bc8b0fc-39df-11e4-bf30-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/11/2014 03:55:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CamtasiaStudio.exe, Version 8.1.2.1344 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: dcc

Startzeit: 01cfcdc7ed734e21

Endzeit: 19

Anwendungspfad: C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe

Berichts-ID: 37faac96-39bb-11e4-bf2e-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/11/2014 03:53:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CamtasiaStudio.exe, Version 8.1.2.1344 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e14

Startzeit: 01cfcdc7a77f9c8f

Endzeit: 32

Anwendungspfad: C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe

Berichts-ID: 03208eb7-39bb-11e4-bf2e-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/11/2014 03:52:38 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CamtasiaStudio.exe, Version 8.1.2.1344 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 138c

Startzeit: 01cfcdc74f6dbef3

Endzeit: 21

Anwendungspfad: C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe

Berichts-ID: e2acc31a-39ba-11e4-bf2e-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/09/2014 09:53:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: CLEMENS-PC)
Description: Das Paket „winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy“ wurde beendet, da das Anhalten zu lange dauerte.

Error: (09/09/2014 09:53:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm WWAHost.exe, Version 6.2.9200.16420 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 7f0

Startzeit: 01cfcc27ea7f1180

Endzeit: 4294967295

Anwendungspfad: C:\Windows\System32\WWAHost.exe

Berichts-ID: ece0cae3-385a-11e4-bf2b-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Windows.Store

Error: (09/09/2014 09:52:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.2.9200.16628 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: d38

Startzeit: 01cfcc27831ac3ad

Endzeit: 97

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: dac6a73a-385a-11e4-bf2b-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/06/2014 11:48:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CamRecorder.exe, Version: 8.1.2.1344, Zeitstempel: 0x521468e9
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.17046, Zeitstempel: 0x53b485c4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00056360
ID des fehlerhaften Prozesses: 0x139c
Startzeit der fehlerhaften Anwendung: 0xCamRecorder.exe0
Pfad der fehlerhaften Anwendung: CamRecorder.exe1
Pfad des fehlerhaften Moduls: CamRecorder.exe2
Berichtskennung: CamRecorder.exe3
Vollständiger Name des fehlerhaften Pakets: CamRecorder.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CamRecorder.exe5

Error: (09/06/2014 06:14:30 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005


System errors:
=============
Error: (09/11/2014 08:51:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "RzKLService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/11/2014 08:51:19 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\Rtlihvs.dll
Fehlercode: 126

Error: (09/11/2014 08:51:16 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎11.‎09.‎2014 um 20:11:49 unerwartet heruntergefahren.

Error: (09/11/2014 08:51:03 PM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT-AUTORITÄT)
Description: 32212256845917090545730768

Error: (09/11/2014 08:12:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "RzKLService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/11/2014 08:11:53 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\Rtlihvs.dll
Fehlercode: 126

Error: (09/11/2014 08:11:49 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎11.‎09.‎2014 um 20:05:34 unerwartet heruntergefahren.

Error: (09/11/2014 05:53:10 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\Rtlihvs.dll
Fehlercode: 126

Error: (09/11/2014 05:26:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "RzKLService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/11/2014 05:25:39 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\Rtlihvs.dll
Fehlercode: 126


Microsoft Office Sessions:
=========================
Error: (09/14/2014 11:33:06 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (09/11/2014 08:13:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Multi Theft Auto.exe1.5975.0.010a801cfcdec02e118920C:\Program Files (x86)\MTA San Andreas 1.3\Multi Theft Auto.exe4bc8b0fc-39df-11e4-bf30-60a44c3287ba

Error: (09/11/2014 03:55:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: CamtasiaStudio.exe8.1.2.1344dcc01cfcdc7ed734e2119C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe37faac96-39bb-11e4-bf2e-60a44c3287ba

Error: (09/11/2014 03:53:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: CamtasiaStudio.exe8.1.2.1344e1401cfcdc7a77f9c8f32C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe03208eb7-39bb-11e4-bf2e-60a44c3287ba

Error: (09/11/2014 03:52:38 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: CamtasiaStudio.exe8.1.2.1344138c01cfcdc74f6dbef321C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exee2acc31a-39ba-11e4-bf2e-60a44c3287ba

Error: (09/09/2014 09:53:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: CLEMENS-PC)
Description: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy

Error: (09/09/2014 09:53:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: WWAHost.exe6.2.9200.164207f001cfcc27ea7f11804294967295C:\Windows\System32\WWAHost.exeece0cae3-385a-11e4-bf2b-60a44c3287bawinstore_1.0.0.0_neutral_neutral_cw5n1h2txyewyWindows.Store

Error: (09/09/2014 09:52:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.2.9200.16628d3801cfcc27831ac3ad97C:\Windows\Explorer.EXEdac6a73a-385a-11e4-bf2b-60a44c3287ba

Error: (09/06/2014 11:48:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CamRecorder.exe8.1.2.1344521468e9ntdll.dll6.2.9200.1704653b485c4c000000500056360139c01cfca1904817c19C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamRecorder.exeC:\Windows\SYSTEM32\ntdll.dll9013f9ed-360f-11e4-bf27-60a44c3287ba

Error: (09/06/2014 06:14:30 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005


CodeIntegrity Errors:
===================================
  Date: 2014-07-22 01:09:17.420
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Clemens\AppData\Local\Temp\EverestDriver.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-07-22 01:09:17.264
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-05-18 18:01:37.838
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Clemens\AppData\Local\Temp\EverestDriver.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-05-18 18:01:37.784
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz
Percentage of memory in use: 20%
Total physical RAM: 12224.28 MB
Available physical RAM: 9738.38 MB
Total Pagefile: 13952.28 MB
Available Pagefile: 11271.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.51 GB) (Free:604.54 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 2DF6D47D)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Vorweg mir ist bewusst, das dort einiges nicht erlaubt ist, aber der Pc wurde von einem Freund meines Bruders eingestellt und alles installiert.
Gerne Deinstalliere ich es, wenn Sie es möchten!

M-K-D-B · 14.09.2014, 11:26

Servus,

Zitat:

InternetURL: C:\Users\Clemens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFBot.url -> file:///C:\Users\Clemens\Desktop\Neuer Ordner\MFBot-3313-x64.exe

Was ist das für ein Bot?

Wir beginnen so:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

clemicool · 14.09.2014, 11:42

Dieser Bot ist für Shakes&Fidget gedacht, aber schon seit einiger Zeit nicht mehr in Benutzung.
Zurzeit wird mir auch bei Windows Defender angezeigt, das Daten an Microsoft geschickt werden sollen(instaler_san_andreas_mod_installer_deutsch.exe)dies ist für Mods für GTA San Andreas gedacht, aber jedes mal wird ein Error angezeigt.

CombatFix

Code:

ATTFilter

ComboFix 14-09-12.01 - Clemens 14.09.2014  12:36:33.1.4 - x64
Microsoft Windows 8  6.2.9200.0.1252.49.1031.18.12224.8789 [GMT 2:00]
ausgeführt von:: c:\users\Clemens\Desktop\ComboFix.exe
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-08-14 bis 2014-09-14  ))))))))))))))))))))))))))))))
.
.
2014-09-14 10:13 . 2014-09-14 10:15	--------	dc----w-	C:\FRST
2014-09-14 10:10 . 2014-09-14 10:10	--------	d-----w-	c:\windows\LastGood
2014-09-14 09:45 . 2014-09-14 09:45	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{098A67DA-9CBC-4416-AD3C-481073B86D6E}\offreg.dll
2014-09-13 15:44 . 2014-09-13 15:44	305832	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10246.bin
2014-09-12 13:35 . 2014-08-21 03:43	11319192	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{098A67DA-9CBC-4416-AD3C-481073B86D6E}\mpengine.dll
2014-09-11 14:22 . 2014-08-30 04:05	8858112	----a-w-	c:\windows\SysWow64\twinui.dll
2014-09-11 14:22 . 2014-06-12 23:34	754176	----a-w-	c:\windows\SysWow64\actxprxy.dll
2014-09-11 14:22 . 2014-08-30 05:48	10115072	----a-w-	c:\windows\system32\twinui.dll
2014-09-11 14:22 . 2014-06-12 23:29	2146304	----a-w-	c:\windows\system32\actxprxy.dll
2014-09-11 14:22 . 2014-08-30 05:47	2885632	----a-w-	c:\windows\system32\msi.dll
2014-09-11 14:22 . 2014-08-30 05:46	2306560	----a-w-	c:\windows\system32\authui.dll
2014-09-11 14:22 . 2014-08-30 04:04	2416128	----a-w-	c:\windows\SysWow64\msi.dll
2014-09-11 14:22 . 2014-08-30 04:03	2037760	----a-w-	c:\windows\SysWow64\authui.dll
2014-09-11 14:12 . 2014-08-28 06:05	630272	----a-w-	c:\windows\SysWow64\wuapi.dll
2014-09-11 14:10 . 2014-06-05 01:12	678600	----a-w-	c:\windows\system32\msvcp120_clr0400.dll
2014-09-11 14:10 . 2014-06-03 23:12	536776	----a-w-	c:\windows\SysWow64\msvcp120_clr0400.dll
2014-09-11 14:07 . 2014-09-04 22:36	755712	----a-w-	c:\windows\system32\aepdu.dll
2014-09-11 14:07 . 2014-09-03 01:49	556544	----a-w-	c:\windows\system32\aeinv.dll
2014-09-11 14:04 . 2014-07-26 02:19	26218496	----a-w-	c:\program files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2014-09-11 14:04 . 2014-07-26 01:52	25479168	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2014-09-11 14:03 . 2014-08-09 08:30	148480	----a-w-	c:\windows\system32\poqexec.exe
2014-09-11 14:03 . 2014-08-09 08:29	144896	----a-w-	c:\windows\system32\tssdisai.dll
2014-09-11 13:59 . 2014-07-31 23:40	1287680	----a-w-	c:\windows\system32\schedsvc.dll
2014-09-06 20:00 . 2014-08-20 23:40	732880	----a-w-	c:\windows\system32\NotificationUI.exe
2014-09-06 20:00 . 2014-08-20 17:05	694784	----a-w-	c:\windows\system32\WSShared.dll
2014-09-06 20:00 . 2014-08-20 17:05	198656	----a-w-	c:\windows\system32\Windows.ApplicationModel.Store.dll
2014-09-06 20:00 . 2014-08-20 17:05	163840	----a-w-	c:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-06 20:00 . 2014-08-20 17:02	567808	----a-w-	c:\windows\SysWow64\WSShared.dll
2014-09-06 20:00 . 2014-08-20 17:02	124928	----a-w-	c:\windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-06 20:00 . 2014-06-24 06:40	125952	----a-w-	c:\windows\system32\WinSetupUI.dll
2014-08-31 20:23 . 2014-08-31 20:25	--------	d-----w-	c:\users\Clemens\AppData\Local\LoiLo
2014-08-28 11:49 . 2014-08-23 06:47	4036096	----a-w-	c:\windows\system32\win32k.sys
2014-08-28 11:49 . 2014-07-15 23:03	1300992	----a-w-	c:\windows\system32\gdi32.dll
2014-08-28 11:49 . 2014-07-12 02:36	1023488	----a-w-	c:\windows\SysWow64\gdi32.dll
2014-08-21 20:42 . 2014-08-21 20:42	--------	d-----w-	c:\windows\San Andreas Mod Installer
2014-08-21 18:03 . 2014-08-21 18:03	--------	d-----w-	c:\program files (x86)\Common Files\Java
2014-08-21 18:02 . 2014-08-21 18:02	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-08-21 18:02 . 2014-08-21 18:02	--------	d-----w-	c:\program files (x86)\Java
2014-08-20 00:49 . 2014-08-20 00:49	--------	dc----w-	C:\$SysReset
2014-08-20 00:43 . 2009-04-02 20:30	10296	----a-w-	c:\windows\SysWow64\drivers\ASUSHWIO.SYS
2014-08-18 13:29 . 2014-08-18 13:29	--------	d-----w-	c:\program files (x86)\Common Files\InstallShield
2014-08-17 02:15 . 2014-08-17 20:34	--------	d-----w-	c:\windows\softwaredistribution.bak1
2014-08-16 00:09 . 2014-08-18 14:07	--------	d-----w-	c:\program files (x86)\MTA San Andreas 1.4
2014-08-15 22:56 . 2014-06-10 22:44	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2014-08-15 22:56 . 2014-06-10 22:43	35480	----a-w-	c:\windows\SysWow64\TsWpfWrp.exe
2014-08-15 22:29 . 2014-06-13 01:57	1453400	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2014-08-15 22:29 . 2014-06-13 01:55	199680	----a-w-	c:\windows\system32\cdd.dll
2014-08-15 22:19 . 2014-06-05 17:56	112984	----a-w-	c:\windows\system32\consent.exe
2014-08-15 22:19 . 2014-06-05 17:29	393216	----a-w-	c:\windows\system32\msihnd.dll
2014-08-15 22:19 . 2014-06-05 13:11	295424	----a-w-	c:\windows\SysWow64\msihnd.dll
2014-08-15 22:17 . 2014-06-19 23:35	1312768	----a-w-	c:\windows\system32\rpcrt4.dll
2014-08-15 22:17 . 2014-06-19 22:24	694272	----a-w-	c:\windows\SysWow64\rpcrt4.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-11 15:10 . 2013-12-09 16:32	101694776	----a-w-	c:\windows\system32\MRT.exe
2014-09-02 19:32 . 2014-07-10 14:19	705480	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-02 19:32 . 2014-07-10 14:19	104904	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-08-05 19:05 . 2014-08-05 19:05	74703	----a-w-	c:\windows\SysWow64\mfc45.dat
2014-08-05 15:58 . 2012-07-26 08:13	23256	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-07-31 19:06 . 2013-12-09 19:00	281768	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2014-07-31 19:06 . 2013-12-09 19:00	281768	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2014-07-31 19:05 . 2013-12-09 17:20	103736	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2014-07-25 14:01 . 2014-07-31 20:28	1291280	----a-w-	c:\windows\SysWow64\nvspbridge.dll
2014-07-25 14:01 . 2014-03-17 17:32	1126480	----a-w-	c:\windows\SysWow64\nvspcap.dll
2014-07-25 14:01 . 2014-07-31 20:28	1715224	----a-w-	c:\windows\system32\nvspbridge64.dll
2014-07-25 14:01 . 2014-03-17 17:32	1283136	----a-w-	c:\windows\system32\nvspcap64.dll
2014-07-15 22:51 . 2014-07-22 23:46	71168	----a-w-	c:\windows\system32\drivers\hdaudbus.sys
2014-07-02 20:48 . 2014-07-31 20:23	846832	----a-w-	c:\windows\SysWow64\nvumdshim.dll
2014-07-02 20:48 . 2014-07-31 20:23	354016	----a-w-	c:\windows\system32\nvoglshim64.dll
2014-07-02 20:48 . 2014-07-31 20:23	31512520	----a-w-	c:\windows\system32\nvoglv64.dll
2014-07-02 20:48 . 2014-07-31 20:23	305600	----a-w-	c:\windows\SysWow64\nvoglshim32.dll
2014-07-02 20:48 . 2014-07-31 20:23	24196896	----a-w-	c:\windows\SysWow64\nvoglv32.dll
2014-07-02 20:48 . 2014-07-31 20:23	13922752	----a-w-	c:\windows\system32\nvopencl.dll
2014-07-02 20:48 . 2014-07-31 20:23	12866008	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2014-07-02 20:48 . 2014-07-31 20:23	11283344	----a-w-	c:\windows\SysWow64\nvopencl.dll
2014-07-02 20:48 . 2014-07-31 20:23	944928	----a-w-	c:\windows\system32\NvIFR64.dll
2014-07-02 20:48 . 2014-07-31 20:23	907096	----a-w-	c:\windows\SysWow64\NvIFR.dll
2014-07-02 20:48 . 2014-07-31 20:23	903624	----a-w-	c:\windows\system32\NvFBC64.dll
2014-07-02 20:48 . 2014-07-31 20:23	869152	----a-w-	c:\windows\SysWow64\NvFBC.dll
2014-07-02 20:48 . 2014-07-31 20:23	502232	----a-w-	c:\windows\system32\nvEncodeAPI64.dll
2014-07-02 20:48 . 2014-07-31 20:23	4247000	----a-w-	c:\windows\system32\nvcuvid.dll
2014-07-02 20:48 . 2014-07-31 20:23	418760	----a-w-	c:\windows\SysWow64\nvEncodeAPI.dll
2014-07-02 20:48 . 2014-07-31 20:23	3989960	----a-w-	c:\windows\SysWow64\nvcuvid.dll
2014-07-02 20:48 . 2014-07-31 20:23	391640	----a-w-	c:\windows\system32\NvIFROpenGL.dll
2014-07-02 20:48 . 2014-07-31 20:23	348120	----a-w-	c:\windows\SysWow64\NvIFROpenGL.dll
2014-07-02 20:48 . 2014-07-31 20:23	1890080	----a-w-	c:\windows\system32\nvdispco6434052.dll
2014-07-02 20:48 . 2014-07-31 20:23	17555104	----a-w-	c:\windows\system32\nvd3dumx.dll
2014-07-02 20:48 . 2014-07-31 20:23	166568	----a-w-	c:\windows\system32\nvinitx.dll
2014-07-02 20:48 . 2014-07-31 20:23	1539928	----a-w-	c:\windows\system32\nvdispgenco6434052.dll
2014-07-02 20:48 . 2014-07-31 20:23	146480	----a-w-	c:\windows\SysWow64\nvinit.dll
2014-07-02 20:48 . 2014-07-31 20:23	13835208	----a-w-	c:\windows\system32\nvcuda.dll
2014-07-02 20:48 . 2014-07-31 20:23	11222048	----a-w-	c:\windows\SysWow64\nvcuda.dll
2014-07-02 20:48 . 2014-07-31 20:23	22994208	----a-w-	c:\windows\system32\nvcompiler.dll
2014-07-02 20:48 . 2014-07-31 20:23	15294296	----a-w-	c:\windows\SysWow64\nvcompiler.dll
2014-07-02 20:48 . 2014-06-08 18:55	16122344	----a-w-	c:\windows\SysWow64\nvwgf2um.dll
2014-07-02 20:48 . 2014-03-17 17:29	965312	----a-w-	c:\windows\system32\nvumdshimx.dll
2014-07-02 20:48 . 2014-03-17 17:29	2814656	----a-w-	c:\windows\SysWow64\nvapi.dll
2014-07-02 20:48 . 2014-03-17 17:29	14498552	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2014-07-02 20:48 . 2013-12-09 17:02	75040	----a-w-	c:\windows\system32\OpenCL.dll
2014-07-02 20:48 . 2013-12-09 17:02	61912	----a-w-	c:\windows\SysWow64\OpenCL.dll
2014-07-02 20:48 . 2013-10-27 08:12	3196816	----a-w-	c:\windows\system32\nvapi64.dll
2014-07-02 20:48 . 2012-07-25 20:22	18626304	----a-w-	c:\windows\system32\nvwgf2umx.dll
2014-07-02 18:55 . 2013-12-09 17:02	6783776	----a-w-	c:\windows\system32\nvcpl.dll
2014-07-02 18:55 . 2013-12-09 17:02	3522392	----a-w-	c:\windows\system32\nvsvc64.dll
2014-07-02 18:55 . 2013-12-09 17:02	935368	----a-w-	c:\windows\system32\nvvsvc.exe
2014-07-02 18:55 . 2013-12-09 17:02	62808	----a-w-	c:\windows\system32\nvshext.dll
2014-07-02 18:55 . 2013-12-09 17:02	386520	----a-w-	c:\windows\system32\nvmctray.dll
2014-07-02 18:55 . 2013-12-09 17:02	2559960	----a-w-	c:\windows\system32\nvsvcr.dll
2014-07-02 17:44 . 2014-07-31 20:27	609240	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2014-07-02 10:14 . 2014-06-08 18:22	3826628	----a-w-	c:\windows\system32\nvcoproc.bin
2014-06-30 22:42 . 2014-07-10 12:49	394240	----a-w-	c:\windows\system32\devinv.dll
2014-06-30 22:42 . 2014-07-10 12:49	87552	----a-w-	c:\windows\system32\aepic.dll
2014-06-23 13:49 . 2013-12-09 17:20	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
2014-06-17 23:27 . 2014-07-10 12:49	1440256	----a-w-	c:\windows\SysWow64\osk.exe
2014-06-17 23:24 . 2014-07-10 12:49	1557504	----a-w-	c:\windows\system32\osk.exe
2014-06-17 15:40 . 2014-06-17 15:40	21712	----a-w-	c:\windows\SysWow64\drivers\DrvAgent64.SYS
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-09-03 1937600]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20924064]
"Akamai NetSession Interface"="c:\users\Clemens\AppData\Local\Akamai\netsession_win.exe" [2014-04-17 4672920]
"TBPanel"="c:\program files (x86)\EXPERTool\TBPanel.exe" [2014-02-17 2195240]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
.
c:\users\Clemens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MFBot.url [2014-8-20 129]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 RzKLService;RzKLService;c:\program files (x86)\Razer\Razer Game Booster\RzKLService.exe;c:\program files (x86)\Razer\Razer Game Booster\RzKLService.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys;c:\windows\SYSNATIVE\drivers\Apowersoft_AudioDevice.sys [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [x]
R3 FairplayKD;FairplayKD;c:\programdata\MTA San Andreas All\Common\temp\FairplayKD.sys;c:\programdata\MTA San Andreas All\Common\temp\FairplayKD.sys [x]
R3 GameKB;SHARKOON Skiller;c:\windows\system32\drivers\GameKB.sys;c:\windows\SYSNATIVE\drivers\GameKB.sys [x]
R3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\System32\drivers\point64.sys;c:\windows\SYSNATIVE\drivers\point64.sys [x]
R3 RTL8168;Realtek 8168 NT-Treiber;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8187B.sys [x]
R3 RtlWlanu;Realtek Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtwlanu.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlanu.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 wolfkr;wolfkr;c:\aeriagames\WolfTeam-DE\avital\wolfk64.sys;c:\aeriagames\WolfTeam-DE\avital\wolfk64.sys [x]
R3 XFDriver64;XFDriver64;c:\program files (x86)\Xfire2\XFDriver64.sys;c:\program files (x86)\Xfire2\XFDriver64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\System32\drivers\dtsoftbus01.sys;c:\windows\SYSNATIVE\drivers\dtsoftbus01.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 AU8168;AU 8168 NT Driver;c:\windows\system32\DRIVERS\au630x64.sys;c:\windows\SYSNATIVE\DRIVERS\au630x64.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
S3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-10 19:11	1096520	----a-w-	c:\program files (x86)\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-31 17:52]
.
2014-09-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-07 10:35]
.
2014-09-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-07 10:35]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-07-25 2403104]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-07-25 1283136]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.trovi.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&ISID=M18CEBFDC-E1D6-4F55-A93D-1C20C3016816&SearchSource=55&CUI=&UM=6&UP=SP7A3DCEFA-5B80-459B-8FDB-C5C7F2D6883D&SSPV=
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
Trusted Zone: aeriagames.com
TCP: DhcpNameServer = 192.168.2.1
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\Common Files\Metabar\tdataprotocol.dll
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\Common Files\Metabar\tdataprotocol.dll
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\Common Files\Metabar\tdataprotocol.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
BHO-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-957755645-4260464881-2478257714-1001CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\SecuROM\License information*]
"datasecu"=hex:52,0c,a4,88,1c,ce,60,0b,53,f4,3c,5c,1d,8b,c1,32,f9,bd,18,67,98,
   d8,9e,52,9e,58,e6,4a,f3,2b,5d,24,c5,1c,0c,22,8f,55,c4,b4,95,4a,33,58,fd,c3,\
"rkeysecu"=hex:e8,54,8c,1f,a4,8b,df,75,ed,09,99,f0,ca,c8,99,7b
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2014-09-14  12:41:49
ComboFix-quarantined-files.txt  2014-09-14 10:41
.
Vor Suchlauf: 13 Verzeichnis(se), 648.801.808.384 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 653.473.402.880 Bytes frei
.
- - End Of File - - B93E069B56FA901393EDD17092D5916C
A36C5E4F47E84449FF07ED3517B43A31

M-K-D-B · 14.09.2014, 11:46

ok, wir machen so weiter:

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3
Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann.
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.

Starte Zoek.exe mit einem Doppelklick.
Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und könnte andere Computer beschädigen.
Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
Code:
ATTFilter
```
iedefaults;
resetIEproxy;
shortcutfix;
CHRdefaults;
emptyclsid;
         
```
Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
Wenn das Tool fertig ist, wird sich Notepad mit der Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:\ .
Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken).

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die Logdatei von Zoek,
die beiden neuen Logdateien von FRST.

clemicool · 14.09.2014, 12:40

So hier die Logs:
ADWCleaner:

Code:

ATTFilter

# AdwCleaner v3.310 - Bericht erstellt am 14/09/2014 um 12:58:24
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Clemens - CLEMENS-PC
# Gestartet von : C:\Users\Clemens\Downloads\AdwCleaner_3.310.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\eSupport.com
Ordner Gelöscht : C:\Users\Clemens\AppData\Local\BeamriseUninstall
Ordner Gelöscht : C:\Users\Clemens\AppData\Local\cool_mirage
Ordner Gelöscht : C:\Users\Clemens\AppData\Local\eSupport.com
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\tdataprotocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\base64
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\chrome
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\prox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\anchorfree
Schlüssel Gelöscht : HKCU\Software\eSupport.com
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Vittalia
Schlüssel Gelöscht : HKLM\SOFTWARE\Iminent

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Google Chrome v37.0.2062.120

[ Datei : C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Homepage] : hxxp://www.trovi.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&ISID=M18CEBFDC-E1D6-4F55-A93D-1C20C3016816&SearchSource=55&CUI=&UM=6&UP=SP7A3DCEFA-5B80-459B-8FDB-C5C7F2D6883D&SSPV=
Gelöscht [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
Gelöscht [Extension] : flpcjncodpafbgdpnkljologafpionhb
Gelöscht [Extension] : pkhojieggfgllhllcegoffdcnmdeojgb

*************************

AdwCleaner[R0].txt - [4053 octets] - [14/09/2014 12:51:20]
AdwCleaner[S0].txt - [3365 octets] - [14/09/2014 12:58:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3425 octets] ##########

MBAM:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 14.09.2014
Suchlauf-Zeit: 13:20:40
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.02.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: Clemens

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 242732
Verstrichene Zeit: 6 Min, 23 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 1
PUP.Optional.FTdownloader.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\FTdownloader V7.0, In Quarantäne, [a9a028d7e39721155f7593fb639f916f], 

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 1
RiskWare.Tool.CK, C:\Users\Clemens\Downloads\Easy Account 1.7 By Dante.rar, In Quarantäne, [34157a85cdad9c9a4f0516be4db42bd5], 

Physische Sektoren: 0
(No malicious items detected)


(end)

Zoek:

Code:

ATTFilter

Zoek.exe v5.0.0.0 Updated 13-September-2014
Tool run by Clemens on 14.09.2014 at 13:33:26,91.
Microsoft Windows 8 6.2.9200  x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Clemens\Downloads\zoek.exe [Scan all users] [Script inserted] 

==== System Restore Info ======================

14.09.2014 13:33:50 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-957755645-4260464881-2478257714-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{00000000-0000-0000-0000-000000000000} deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{9C112D7C-1165-4661-8C0C-570CC04BAECD} Unknown  Url="Not_Found"

==== Reset Google Chrome ======================

C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== shortcuts on Users Desktops ======================

C:\Users\Clemens\Desktop\EVEREST Home Edition.lnk - C:\Program Files (x86)\Lavalys\EVEREST Home Edition\everest.exe 
C:\Users\Clemens\Desktop\EXPERTool.lnk - C:\Program Files (x86)\EXPERTool\TBPanel.exe 
C:\Users\Clemens\Desktop\Fraps.lnk - C:\Fraps\fraps.exe 
C:\Users\Clemens\Desktop\Sony Vegas.lnk - C:\Program Files (x86)\Sony\Vegas Pro 12.0\vegas120.exe 
C:\Users\Clemens\Desktop\Steam - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Alles\3D Vision Photo Viewer.lnk - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvstview.exe 
C:\Users\Clemens\Desktop\Alles\Camtasia Studio 8.lnk - C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe 
C:\Users\Clemens\Desktop\Alles\GeForce Experience.lnk - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\GFExperience.exe 
C:\Users\Clemens\Desktop\Alles\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
C:\Users\Clemens\Desktop\Alles\QuickTime Player.lnk - C:\Program Files (x86)\QuickTime\QuickTimePlayer.exe 
C:\Users\Clemens\Desktop\Alles\Skype.lnk - C:\Windows\Installer\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}\SkypeIcon.exe 
C:\Users\Clemens\Desktop\Spiele\Alpha Protocol\APLauncher - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Assasin Creed\ACBMP - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Assasin Creed\ACBSP - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Assasin Creed\ACRMP - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Assasin Creed\ACRPR - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Assasin Creed\ACRSP - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Assasin Creed\AssassinsCreedBrotherhood - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Borderlands1u2\Borderlands - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Borderlands1u2\Borderlands2 - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Cod1\CoDMP - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Cod1\CoDSP - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Cod4\Call of Duty(R) 4 - Modern Warfare(TM) - Einzelspieler.lnk - C:\Program Files (x86)\Activision\Call of Duty 4 - Modern Warfare\iw3sp.exe 
C:\Users\Clemens\Desktop\Spiele\Cod4\Call of Duty(R) 4 - Modern Warfare(TM) - Mehrspieler.lnk - C:\Program Files (x86)\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe 
C:\Users\Clemens\Desktop\Spiele\FalloutNV\FalloutNV.lnk - C:\Program Files (x86)\Bethesda Softworks\Fallout New Vegas\FalloutNVLauncher.exe 
C:\Users\Clemens\Desktop\Spiele\Far Cry 3\farcry3 - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Flatout2\FlatOut2 - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Für micha\Flatout2\FlatOut2 - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Für micha\Flatout2\Verknüpfung mit FlatOut2.lnk -  
C:\Users\Clemens\Desktop\Spiele\GTA4\LaunchEFLC - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Hitman\HMA - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Spiele\Mafia 2\Mafia 2 Multiplayer.lnk - C:\Program Files (x86)\Mafia 2 Multiplayer\m2mp.exe 
C:\Users\Clemens\Desktop\Spiele\Mafia 2\Mafia II.lnk - C:\Program Files (x86)\2K Games\Mafia II\pc\mafia2.exe 
C:\Users\Clemens\Desktop\Spiele\Mirrors Edge\Mirror's Edge™.lnk -  
C:\Users\Clemens\Desktop\Spiele\Orcs Must Die\Orcs Must Die.lnk -  
C:\Users\Clemens\Desktop\Spiele\Prototype\Prototype - Verknüpfung.lnk -  
C:\Users\Clemens\Desktop\Tools\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe 
C:\Users\Clemens\Desktop\Tools\Vegas Pro 12.0 (64-bit).lnk - C:\Program Files (x86)\Sony\Vegas Pro 12.0\vegas120.exe 
C:\Users\Clemens\Desktop\Tools\Wordpad.lnk - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\DAEMON Tools Lite.lnk - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe 
C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe 
C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk - C:\Program Files (x86)\MTA San Andreas 1.3\Multi Theft Auto.exe 
C:\Users\Public\Desktop\MTA San Andreas 1.4.lnk - C:\Program Files (x86)\MTA San Andreas 1.4\Multi Theft Auto.exe 
C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk - C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe 
C:\Users\Public\Desktop\Xfire.lnk - C:\Program Files (x86)\Xfire2\Xfire.exe 

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe -tab about
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe -tab update
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.lnk -  
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.lnk -  
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Malwarebytes Anti-Malware entfernen.lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \unins000.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Malwarebytes Anti-Malware Notifications.lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \ Malwarebytes Anti-Malware .lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\chameleon.chm 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3\MTA San Andreas.lnk - C:\Program Files (x86)\MTA San Andreas 1.3\Multi Theft Auto.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3\MTA Server.lnk - C:\Program Files (x86)\MTA San Andreas 1.3\server\MTA Server.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3\Uninstall MTA San Andreas.lnk - C:\Program Files (x86)\MTA San Andreas 1.3\Uninstall.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4\MTA San Andreas.lnk - C:\Program Files (x86)\MTA San Andreas 1.4\Multi Theft Auto.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4\MTA Server.lnk - C:\Program Files (x86)\MTA San Andreas 1.4\server\MTA Server.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4\Uninstall MTA San Andreas.lnk - C:\Program Files (x86)\MTA San Andreas 1.4\Uninstall.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games\GTA San Andreas\GTA San Andreas deinstallieren.lnk - C:\Windows\system32\RunDll32.exe C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{086BADF8-9B1F-4E89-B207-2EDA520972D6}\setup.exe" -l0x7
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games\GTA San Andreas\GTA San Andreas spielen.lnk - C:\Users\Clemens\Desktop\Spiele\GTA SA\Grand Theft Auto San Andreas\gta_sa.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games\GTA San Andreas\README.lnk - C:\Users\Clemens\Desktop\Spiele\GTA SA\Grand Theft Auto San Andreas\ReadMe\Readme.txt 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer\San Andreas Multiplayer.lnk - C:\Users\Clemens\Desktop\Spiele\GTA SA\Grand Theft Auto San Andreas\samp.exe 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer\Uninstall.lnk - C:\Users\Clemens\Desktop\Spiele\GTA SA\Grand Theft Auto San Andreas\SAMPUninstall.exe 

==== shortcuts in Quick Launch ======================

C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe 
C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe 
C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\70f62c6a7f1739bd\pinned.lnk - C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,Options_RunDLL 1
C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk - C:\Users\Clemens\AppData\Roaming\Microsoft\Windows\Libraries 
C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
C:\Users\Clemens\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TeamSpeak 3 Client.lnk - C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe 
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyOverride"="<local>"
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== C:\zoek_backup content ======================

C:\zoek_backup (files=0 folders=0 0 bytes)

==== EOF on 14.09.2014 at 13:34:14,24 ======================

FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Clemens (administrator) on CLEMENS-PC on 14-09-2014 13:35:50
Running from C:\Users\Clemens\Desktop
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Gainward Co. Ltd.) C:\Program Files (x86)\EXPERTool\TBPanel.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Users\Clemens\Downloads\zoek.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1937600 2014-09-03] (Valve Corporation)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20924064 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Clemens\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [TBPanel] => C:\Program Files (x86)\EXPERTool\TBPanel.exe [2195240 2014-02-17] (Gainward Co. Ltd.)
HKU\S-1-5-21-957755645-4260464881-2478257714-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
InternetURL: C:\Users\Clemens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFBot.url -> file:///C:\Users\Clemens\Desktop\Neuer Ordner\MFBot-3313-x64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=MASBJS
SearchScopes: HKLM-x32 - {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=MASBJS
SearchScopes: HKCU - {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

Chrome: 
=======
CHR HomePage: Default -> C8C8883B59AF8ADEBB17728A58CAAB91D7BA5DD2A9DE82C310B7B09AD21D6B26
CHR DefaultSearchKeyword: Default -> 7EF8A6062AD9980B04EC38C0140E67D1AB631A9267BA37C8724F777EFDEEF334
CHR DefaultSearchProvider: Default -> 0E58CA9EBDF2EE4D5E2068CB63481F06CBD81C4D8CEDFBE4072E612A5EB2EC5E
CHR DefaultSearchURL: Default -> 02911E6D33CCCCD005F4E8B049980B7B98E1F67E99FEB43A910A249FFDBF0500
CHR Profile: C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-14]
CHR Extension: (Google Docs) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-07]
CHR Extension: (Google Drive) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-14]
CHR Extension: (YouTube) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-07]
CHR Extension: (Google-Suche) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-07]
CHR Extension: (Google Tabellen) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-14]
CHR Extension: (Google Wallet) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-14]
CHR Extension: (Google Mail) - C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-07]
CHR Profile: C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Profile 1

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-23] ()
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Apowersoft_AudioDevice; C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R3 AU8168; C:\Windows\system32\DRIVERS\au630x64.sys [792648 2013-09-23] (Realtek                                            )
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-06-08] (Disc Soft Ltd)
S3 GameKB; C:\Windows\system32\drivers\GameKB.sys [27648 2012-05-11] () [File not signed]
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 RTL8187B; C:\Windows\system32\DRIVERS\RTL8187B.sys [458384 2012-05-31] (Realtek Semiconductor Corporation                           )
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-09-17] (Realtek Semiconductor Corporation                           )
S3 taphss6; C:\Windows\system32\DRIVERS\taphss6.sys [42184 2014-01-15] (Anchorfree Inc.)
S3 XFDriver64; C:\Program Files (x86)\Xfire2\XFDriver64.sys [17160 2013-03-14] (XFire)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
S3 wolfkr; \??\C:\AeriaGames\WolfTeam-DE\avital\wolfk64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-14 13:33 - 2014-09-14 13:34 - 00012080 ____C () C:\zoek-results.log
2014-09-14 13:33 - 2014-09-14 13:34 - 00000678 ____C () C:\runcheck.txt
2014-09-14 13:32 - 2014-09-14 13:32 - 00000000 ___DC () C:\zoek_backup
2014-09-14 13:29 - 2014-09-14 13:31 - 01290240 _____ () C:\Users\Clemens\Downloads\zoek.exe
2014-09-14 13:28 - 2014-09-14 13:28 - 00001396 ____C () C:\Users\Clemens\Desktop\mbam.txt
2014-09-14 13:18 - 2014-09-14 13:31 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-14 13:18 - 2014-09-14 13:18 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-14 13:18 - 2014-09-14 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-14 13:18 - 2014-09-14 13:18 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-14 13:18 - 2014-09-14 13:18 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-14 13:18 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-14 13:18 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-14 13:18 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-14 13:03 - 2014-09-14 13:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Clemens\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-14 12:51 - 2014-09-14 12:58 - 00000000 ___DC () C:\AdwCleaner
2014-09-14 12:48 - 2014-09-14 12:49 - 01373475 _____ () C:\Users\Clemens\Downloads\AdwCleaner_3.310.exe
2014-09-14 12:41 - 2014-09-14 12:41 - 00018963 ____C () C:\ComboFix.txt
2014-09-14 12:35 - 2014-09-14 12:41 - 00000000 ___DC () C:\Qoobox
2014-09-14 12:35 - 2014-09-14 12:40 - 00000000 ____D () C:\Windows\erdnt
2014-09-14 12:35 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-14 12:35 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-14 12:35 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-14 12:35 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-14 12:35 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-14 12:35 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-09-14 12:35 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-14 12:35 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-14 12:35 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-14 12:33 - 2014-09-14 12:33 - 05577449 ____R (Swearware) C:\Users\Clemens\Desktop\ComboFix.exe
2014-09-14 12:28 - 2014-09-14 12:33 - 05577449 _____ (Swearware) C:\Users\Clemens\Downloads\ComboFix.exe
2014-09-14 12:15 - 2014-09-14 12:15 - 00031434 _____ () C:\Users\Clemens\Desktop\Addition.txt
2014-09-14 12:14 - 2014-09-14 13:36 - 00012466 _____ () C:\Users\Clemens\Desktop\FRST.txt
2014-09-14 12:13 - 2014-09-14 13:35 - 00000000 ___DC () C:\FRST
2014-09-14 12:13 - 2014-09-14 12:13 - 02105856 _____ (Farbar) C:\Users\Clemens\Desktop\FRST64.exe
2014-09-14 12:11 - 2014-09-14 12:13 - 02105856 _____ (Farbar) C:\Users\Clemens\Downloads\FRST64.exe
2014-09-14 12:10 - 2014-09-14 12:10 - 00000000 ____D () C:\Windows\LastGood.Tmp
2014-09-11 17:13 - 2014-08-16 11:34 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-11 17:13 - 2014-08-16 11:34 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-11 17:13 - 2014-08-16 11:34 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-09-11 17:13 - 2014-08-16 11:34 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-11 17:13 - 2014-08-16 11:33 - 19280384 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-11 17:13 - 2014-08-16 11:33 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-11 17:13 - 2014-08-16 11:33 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-11 17:13 - 2014-08-16 11:32 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-11 17:13 - 2014-08-16 11:32 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-11 17:13 - 2014-08-16 09:37 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-11 17:13 - 2014-08-16 09:37 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 14369280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-11 17:13 - 2014-08-16 09:36 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-11 17:13 - 2014-08-16 09:35 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-11 17:13 - 2014-03-07 02:47 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-11 17:13 - 2013-05-16 00:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-09-11 17:13 - 2013-05-16 00:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-09-11 17:13 - 2013-05-14 15:14 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-11 17:13 - 2013-05-14 11:23 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-11 17:13 - 2013-02-21 12:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-09-11 17:13 - 2013-02-21 12:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-11 17:13 - 2013-02-21 12:29 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-11 17:13 - 2013-02-21 12:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-11 17:13 - 2013-02-21 12:14 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-09-11 17:13 - 2013-02-21 12:14 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-11 17:13 - 2013-02-19 11:53 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-09-11 17:13 - 2012-11-08 06:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-11 17:13 - 2012-11-08 06:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-11 17:13 - 2012-07-26 05:06 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-11 16:22 - 2014-08-30 07:48 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-09-11 16:22 - 2014-08-30 07:47 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-09-11 16:22 - 2014-08-30 07:46 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-09-11 16:22 - 2014-08-30 06:05 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-09-11 16:22 - 2014-08-30 06:04 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-09-11 16:22 - 2014-08-30 06:03 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-09-11 16:22 - 2014-06-13 01:34 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-09-11 16:22 - 2014-06-13 01:29 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-09-11 16:19 - 2014-08-02 00:08 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-09-11 16:19 - 2014-07-24 15:50 - 00447296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-09-11 16:19 - 2014-07-17 01:28 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2014-09-11 16:19 - 2014-07-17 00:59 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2014-09-11 16:19 - 2014-07-17 00:59 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2014-09-11 16:19 - 2014-07-12 08:45 - 01549824 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-09-11 16:19 - 2014-07-12 06:36 - 00674304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-09-11 16:19 - 2014-07-12 06:36 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-09-11 16:19 - 2014-07-12 06:34 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-09-11 16:19 - 2014-07-12 06:34 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-09-11 16:19 - 2014-06-28 08:57 - 01341952 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-09-11 16:19 - 2014-06-28 04:23 - 01126400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-09-11 16:12 - 2014-08-28 13:34 - 00059400 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-11 16:12 - 2014-08-28 08:05 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-09-11 16:12 - 2014-08-28 08:05 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-09-11 16:12 - 2014-08-28 08:05 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-09-11 16:12 - 2014-08-28 08:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-09-11 16:12 - 2014-08-28 08:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-09-11 16:12 - 2014-08-28 08:01 - 03285504 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 01623552 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-11 16:12 - 2014-08-28 08:01 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wuaext.dll
2014-09-11 16:12 - 2014-07-24 05:33 - 00875688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2014-09-11 16:12 - 2014-07-24 05:33 - 00869544 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2014-09-11 16:10 - 2014-06-05 03:12 - 00678600 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2014-09-11 16:10 - 2014-06-04 01:12 - 00536776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2014-09-11 16:07 - 2014-09-05 00:36 - 00755712 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 16:07 - 2014-09-03 03:49 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 16:03 - 2014-08-09 10:30 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2014-09-11 16:03 - 2014-08-09 10:29 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\tssdisai.dll
2014-09-11 15:59 - 2014-08-01 01:40 - 01287680 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2014-09-08 15:41 - 2014-09-08 17:05 - 240790732 _____ () C:\Users\Clemens\Downloads\Massiv - M10.rar
2014-09-07 19:32 - 2014-09-07 21:14 - 252580822 _____ () C:\Users\Clemens\Downloads\Majoe - BADT.rar
2014-09-07 12:56 - 2014-09-07 12:56 - 00287608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-06 22:04 - 2014-07-12 06:41 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\KBDRUM.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-09-06 22:04 - 2014-07-12 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRUM.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-09-06 22:04 - 2014-07-12 06:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-09-06 22:04 - 2014-07-12 06:15 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-09-06 22:04 - 2014-07-12 02:02 - 00478352 _____ () C:\Windows\SysWOW64\locale.nls
2014-09-06 22:04 - 2014-07-12 02:00 - 00478352 _____ () C:\Windows\system32\locale.nls
2014-09-06 22:04 - 2014-07-09 00:33 - 00181248 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe
2014-09-06 22:04 - 2014-07-09 00:32 - 01539584 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2014-09-06 22:04 - 2014-07-09 00:32 - 00340480 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll
2014-09-06 22:04 - 2014-07-09 00:30 - 01220608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2014-09-06 22:04 - 2014-07-07 07:52 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2014-09-06 22:04 - 2014-07-07 07:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2014-09-06 22:04 - 2014-07-04 12:52 - 00328000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-09-06 22:04 - 2014-07-03 03:59 - 01824784 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-09-06 22:04 - 2014-07-03 02:30 - 01408952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-09-06 22:04 - 2014-06-28 09:01 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2014-09-06 22:04 - 2014-06-28 08:57 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-09-06 22:04 - 2014-06-28 08:56 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2014-09-06 22:04 - 2014-06-25 09:09 - 00733184 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-09-06 22:04 - 2014-06-25 09:07 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-09-06 22:04 - 2014-06-18 01:27 - 02032640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-06 22:04 - 2014-06-18 01:23 - 02238464 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-06 22:04 - 2014-06-11 16:47 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-09-06 22:04 - 2014-06-11 06:40 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-09-06 22:04 - 2014-06-11 00:44 - 01403896 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-09-06 22:04 - 2014-05-30 01:31 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-09-06 22:04 - 2014-05-30 01:03 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-09-06 22:04 - 2014-02-04 12:57 - 01271664 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-09-06 22:00 - 2014-08-21 01:40 - 00732880 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-09-06 22:00 - 2014-08-20 19:05 - 00694784 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-09-06 22:00 - 2014-08-20 19:05 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-09-06 22:00 - 2014-08-20 19:05 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-06 22:00 - 2014-08-20 19:02 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-09-06 22:00 - 2014-08-20 19:02 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-06 22:00 - 2014-06-24 09:35 - 00010450 _____ () C:\Windows\system32\autoconfig.cab
2014-09-06 22:00 - 2014-06-24 08:40 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2014-09-06 20:43 - 2014-09-06 20:45 - 03380372 _____ () C:\Users\Clemens\Downloads\adblockplusandroid-1.2.1.apk
2014-09-03 18:04 - 2014-09-03 18:15 - 29354504 _____ () C:\Users\Clemens\Downloads\25865-weapon-sound-by-just.zip
2014-09-03 17:52 - 2014-09-03 17:59 - 19379431 _____ () C:\Users\Clemens\Downloads\Weapon Sounds.rar
2014-09-03 17:39 - 2014-09-03 17:51 - 29354504 _____ () C:\Users\Clemens\Downloads\25865-weapon-sound-by-just.zip.zip
2014-09-03 17:37 - 2014-09-03 17:37 - 00308076 _____ () C:\Users\Clemens\Downloads\Sounds.zip
2014-09-03 17:37 - 2014-09-03 17:37 - 00305919 _____ () C:\Users\Clemens\Downloads\Weapon Sounds by Rodrigo Lopez.rar
2014-09-03 17:37 - 2014-09-03 17:37 - 00228184 _____ () C:\Users\Clemens\Downloads\sounds (2).rar
2014-09-03 16:44 - 2014-09-03 16:44 - 00043130 _____ () C:\Users\Clemens\Downloads\CONFIG for scorpion.zip
2014-09-03 16:13 - 2014-09-03 16:25 - 29143789 _____ () C:\Users\Clemens\Downloads\Sounds-nd-Mods.rar
2014-09-01 15:51 - 2014-09-01 16:02 - 25949466 _____ () C:\Users\Clemens\Downloads\GENRL (2)
2014-09-01 12:32 - 2014-09-01 12:39 - 17567358 _____ () C:\Users\Clemens\Downloads\ASG Bilder.zip
2014-08-31 22:23 - 2014-08-31 22:25 - 00000000 ____D () C:\Users\Clemens\AppData\Local\LoiLo
2014-08-31 22:23 - 2014-08-31 22:23 - 00000000 ____D () C:\Users\Clemens\Documents\LoiLo
2014-08-31 21:50 - 2014-08-31 22:22 - 74612920 _____ (LoiLo inc. ) C:\Users\Clemens\Downloads\LoiLoGameRecorder1.1.0.0.exe
2014-08-29 22:16 - 2014-08-29 22:16 - 04652126 _____ () C:\Users\Clemens\Desktop\Unbenannt.mp4
2014-08-29 19:29 - 2014-08-29 19:40 - 25607384 _____ () C:\Users\Clemens\Downloads\GENRL (1)
2014-08-28 13:49 - 2014-08-23 08:47 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-28 13:49 - 2014-07-16 01:03 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 13:49 - 2014-07-12 04:36 - 01023488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-22 23:18 - 2014-08-22 23:19 - 00234729 _____ () C:\Users\Clemens\Downloads\imgtool20.zip
2014-08-21 22:41 - 2014-08-21 22:41 - 03582842 _____ () C:\Users\Clemens\Downloads\229446-669214-san-andreas-mod-installer.zip
2014-08-21 22:40 - 2014-08-21 22:40 - 01028010 _____ () C:\Users\Clemens\Downloads\Backup Radar gta sa.rar
2014-08-21 22:38 - 2014-08-21 22:38 - 00899752 _____ () C:\Users\Clemens\Downloads\installer_san_andreas_mod_install_Deutsch.exe
2014-08-21 22:38 - 2014-08-21 22:38 - 00523910 _____ () C:\Users\Clemens\Downloads\rockstargames_sabackupfronten123andpc.rar
2014-08-21 22:12 - 2014-08-21 22:12 - 00034816 _____ () C:\Users\Clemens\Downloads\radar00.txd
2014-08-21 20:02 - 2014-08-21 20:02 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-21 20:02 - 2014-08-21 20:02 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-20 02:49 - 2014-08-20 02:49 - 00000000 ___DC () C:\$SysReset
2014-08-20 02:43 - 2014-08-20 02:43 - 00030084 _____ () C:\Windows\Ascd_tmp.ini
2014-08-20 02:43 - 2014-08-20 02:43 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-08-20 02:43 - 2009-04-02 22:30 - 00010296 _____ () C:\Windows\SysWOW64\Drivers\ASUSHWIO.SYS
2014-08-19 22:17 - 2014-08-19 22:22 - 09941504 _____ (mfbot.de) C:\Users\Clemens\Downloads\MFBot-3313-x64.exe
2014-08-19 21:28 - 2014-08-19 21:28 - 00002120 _____ () C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk
2014-08-19 21:28 - 2014-08-19 21:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3
2014-08-19 19:55 - 2014-08-19 20:10 - 19357147 _____ () C:\Users\Clemens\Downloads\Sound's.rar
2014-08-19 19:32 - 2014-08-19 19:33 - 02697862 _____ () C:\Users\Clemens\Downloads\1407954038_GTA SA - Weapons Brazuca - PointBlank.rar
2014-08-19 19:29 - 2014-08-19 19:30 - 02116570 _____ () C:\Users\Clemens\Downloads\1407954055_GTA SA - Weapons BLOODY - PointBlank.rar
2014-08-19 19:08 - 2014-08-19 19:09 - 00604863 _____ () C:\Users\Clemens\Downloads\Sounds (1).rar
2014-08-19 19:08 - 2014-08-19 19:08 - 00604863 _____ () C:\Users\Clemens\Downloads\Sounds.rar
2014-08-19 18:51 - 2014-08-19 18:54 - 07930562 _____ () C:\Users\Clemens\Downloads\1407916887_SLAUGHTER WP.zip
2014-08-19 18:50 - 2014-08-19 18:51 - 00751090 _____ () C:\Users\Clemens\Downloads\1407954016_GTA SA - Weapons GSL 2014 - PointBlank.rar
2014-08-19 18:46 - 2014-08-19 18:46 - 00541641 _____ () C:\Users\Clemens\Downloads\Pack.zip
2014-08-18 19:34 - 2014-08-18 19:35 - 01239430 _____ () C:\Users\Clemens\Downloads\603_randomnigga.zip
2014-08-18 19:34 - 2014-08-18 19:35 - 01014521 _____ () C:\Users\Clemens\Downloads\730_cityboy.zip
2014-08-18 19:33 - 2014-08-18 19:34 - 00852757 _____ () C:\Users\Clemens\Downloads\682_claudefx.zip
2014-08-18 17:50 - 2014-08-18 17:50 - 00005243 _____ () C:\Users\Clemens\Downloads\gta-sa_mini_su (1).rar
2014-08-18 16:07 - 2014-08-18 16:07 - 00002120 _____ () C:\Users\Public\Desktop\MTA San Andreas 1.4.lnk
2014-08-18 16:07 - 2014-08-18 16:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4
2014-08-18 15:50 - 2014-08-18 15:58 - 21866928 _____ (Multi Theft Auto) C:\Users\Clemens\Downloads\mtasa-1.4.exe
2014-08-18 15:30 - 2014-08-18 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2014-08-17 23:40 - 2014-08-17 23:45 - 11990847 _____ () C:\Users\Clemens\Downloads\sa-mp-0.3z-R1-install.exe
2014-08-17 22:25 - 2014-08-17 22:37 - 25932734 _____ () C:\Users\Clemens\Downloads\GENRL
2014-08-17 04:15 - 2014-08-17 22:34 - 00000000 ____D () C:\Windows\softwaredistribution.bak1
2014-08-17 00:11 - 2014-08-17 00:18 - 14483057 _____ () C:\Users\Clemens\Downloads\12_gun_pack.rar
2014-08-16 22:56 - 2014-08-16 22:57 - 01861203 _____ () C:\Users\Clemens\Downloads\43_fam1.zip
2014-08-16 22:54 - 2014-08-16 22:56 - 05343493 _____ () C:\Users\Clemens\Downloads\512-2_gunpack.zip
2014-08-16 02:09 - 2014-08-18 16:07 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.4
2014-08-16 00:56 - 2014-06-11 00:44 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 00:56 - 2014-06-11 00:43 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-16 00:29 - 2014-06-13 03:57 - 01453400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 00:29 - 2014-06-13 03:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-16 00:19 - 2014-06-05 19:56 - 00112984 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-16 00:19 - 2014-06-05 19:29 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 00:19 - 2014-06-05 15:11 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-16 00:17 - 2014-06-20 01:35 - 01312768 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-16 00:17 - 2014-06-20 00:24 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-14 13:36 - 2014-09-14 12:14 - 00012466 _____ () C:\Users\Clemens\Desktop\FRST.txt
2014-09-14 13:35 - 2014-09-14 12:13 - 00000000 ___DC () C:\FRST
2014-09-14 13:34 - 2014-09-14 13:33 - 00012080 ____C () C:\zoek-results.log
2014-09-14 13:34 - 2014-09-14 13:33 - 00000678 ____C () C:\runcheck.txt
2014-09-14 13:33 - 2014-01-15 16:28 - 01105464 _____ () C:\Windows\WindowsUpdate.log
2014-09-14 13:32 - 2014-09-14 13:32 - 00000000 ___DC () C:\zoek_backup
2014-09-14 13:31 - 2014-09-14 13:29 - 01290240 _____ () C:\Users\Clemens\Downloads\zoek.exe
2014-09-14 13:31 - 2014-09-14 13:18 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-14 13:28 - 2014-09-14 13:28 - 00001396 ____C () C:\Users\Clemens\Desktop\mbam.txt
2014-09-14 13:18 - 2014-09-14 13:18 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-14 13:18 - 2014-09-14 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-14 13:18 - 2014-09-14 13:18 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-14 13:18 - 2014-09-14 13:18 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-14 13:15 - 2014-09-14 13:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Clemens\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-14 13:10 - 2013-12-07 12:35 - 00001134 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-14 13:01 - 2013-12-07 12:35 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-14 13:00 - 2013-12-09 19:02 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-14 13:00 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-14 12:59 - 2014-01-19 20:07 - 00081580 _____ () C:\Windows\PFRO.log
2014-09-14 12:58 - 2014-09-14 12:51 - 00000000 ___DC () C:\AdwCleaner
2014-09-14 12:49 - 2014-09-14 12:48 - 01373475 _____ () C:\Users\Clemens\Downloads\AdwCleaner_3.310.exe
2014-09-14 12:43 - 2013-12-31 14:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-14 12:41 - 2014-09-14 12:41 - 00018963 ____C () C:\ComboFix.txt
2014-09-14 12:41 - 2014-09-14 12:35 - 00000000 ___DC () C:\Qoobox
2014-09-14 12:41 - 2012-07-26 07:37 - 00000000 __RHD () C:\Users\Default
2014-09-14 12:40 - 2014-09-14 12:35 - 00000000 ____D () C:\Windows\erdnt
2014-09-14 12:40 - 2012-07-26 07:26 - 00000215 ____C () C:\Windows\system.ini
2014-09-14 12:38 - 2014-06-15 20:11 - 00000000 ____D () C:\ProgramData\TEMP
2014-09-14 12:33 - 2014-09-14 12:33 - 05577449 ____R (Swearware) C:\Users\Clemens\Desktop\ComboFix.exe
2014-09-14 12:33 - 2014-09-14 12:28 - 05577449 _____ (Swearware) C:\Users\Clemens\Downloads\ComboFix.exe
2014-09-14 12:15 - 2014-09-14 12:15 - 00031434 _____ () C:\Users\Clemens\Desktop\Addition.txt
2014-09-14 12:13 - 2014-09-14 12:13 - 02105856 _____ (Farbar) C:\Users\Clemens\Desktop\FRST64.exe
2014-09-14 12:13 - 2014-09-14 12:11 - 02105856 _____ (Farbar) C:\Users\Clemens\Downloads\FRST64.exe
2014-09-14 12:10 - 2014-09-14 12:10 - 00000000 ____D () C:\Windows\LastGood.Tmp
2014-09-14 11:43 - 2013-12-13 20:54 - 00007598 _____ () C:\Users\Clemens\AppData\Local\Resmon.ResmonCfg
2014-09-14 11:35 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-09-12 16:02 - 2013-12-07 13:47 - 00000000 ____D () C:\Users\Clemens\AppData\Roaming\TS3Client
2014-09-12 15:42 - 2013-12-08 18:10 - 13763072 ___SH () C:\Users\Clemens\Desktop\Thumbs.db
2014-09-11 20:57 - 2014-01-03 16:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-11 20:56 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-11 17:51 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-09-11 17:24 - 2014-07-10 16:17 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-11 17:24 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-09-11 17:16 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-09-11 17:12 - 2013-12-09 18:32 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-11 17:10 - 2013-12-09 18:32 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-11 15:51 - 2014-01-13 23:23 - 00003584 _____ () C:\Users\Clemens\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-09 19:52 - 2013-12-31 14:54 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-08 19:08 - 2014-02-08 13:38 - 00000000 ____D () C:\Program Files (x86)\Activision
2014-09-08 19:07 - 2013-12-09 18:33 - 00032768 ____H () C:\Users\Clemens\Desktop\photothumb.db
2014-09-08 17:19 - 2014-07-23 01:20 - 00000000 ____D () C:\Users\Clemens\AppData\Local\mfbot.de
2014-09-08 17:05 - 2014-09-08 15:41 - 240790732 _____ () C:\Users\Clemens\Downloads\Massiv - M10.rar
2014-09-07 21:14 - 2014-09-07 19:32 - 252580822 _____ () C:\Users\Clemens\Downloads\Majoe - BADT.rar
2014-09-07 17:35 - 2014-07-05 11:09 - 00000000 ____D () C:\Users\Clemens\Desktop\Mods
2014-09-07 17:35 - 2014-06-08 20:43 - 00000000 ___RD () C:\Users\Clemens\Desktop\Alles
2014-09-07 12:56 - 2014-09-07 12:56 - 00287608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-06 22:10 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-09-06 22:10 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-09-06 20:45 - 2014-09-06 20:43 - 03380372 _____ () C:\Users\Clemens\Downloads\adblockplusandroid-1.2.1.apk
2014-09-05 15:54 - 2013-12-07 12:17 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-957755645-4260464881-2478257714-1001
2014-09-05 00:36 - 2014-09-11 16:07 - 00755712 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-03 18:17 - 2014-04-27 02:24 - 00000000 ____D () C:\Users\Clemens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\www.gtavicecity.ru
2014-09-03 18:15 - 2014-09-03 18:04 - 29354504 _____ () C:\Users\Clemens\Downloads\25865-weapon-sound-by-just.zip
2014-09-03 17:59 - 2014-09-03 17:52 - 19379431 _____ () C:\Users\Clemens\Downloads\Weapon Sounds.rar
2014-09-03 17:51 - 2014-09-03 17:39 - 29354504 _____ () C:\Users\Clemens\Downloads\25865-weapon-sound-by-just.zip.zip
2014-09-03 17:37 - 2014-09-03 17:37 - 00308076 _____ () C:\Users\Clemens\Downloads\Sounds.zip
2014-09-03 17:37 - 2014-09-03 17:37 - 00305919 _____ () C:\Users\Clemens\Downloads\Weapon Sounds by Rodrigo Lopez.rar
2014-09-03 17:37 - 2014-09-03 17:37 - 00228184 _____ () C:\Users\Clemens\Downloads\sounds (2).rar
2014-09-03 17:37 - 2014-01-07 19:48 - 00000000 ____D () C:\Users\Clemens\AppData\Roaming\vlc
2014-09-03 16:44 - 2014-09-03 16:44 - 00043130 _____ () C:\Users\Clemens\Downloads\CONFIG for scorpion.zip
2014-09-03 16:25 - 2014-09-03 16:13 - 29143789 _____ () C:\Users\Clemens\Downloads\Sounds-nd-Mods.rar
2014-09-03 03:49 - 2014-09-11 16:07 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-02 21:32 - 2014-07-10 16:19 - 00705480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-02 21:32 - 2014-07-10 16:19 - 00104904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-01 16:02 - 2014-09-01 15:51 - 25949466 _____ () C:\Users\Clemens\Downloads\GENRL (2)
2014-09-01 12:39 - 2014-09-01 12:32 - 17567358 _____ () C:\Users\Clemens\Downloads\ASG Bilder.zip
2014-08-31 22:25 - 2014-08-31 22:23 - 00000000 ____D () C:\Users\Clemens\AppData\Local\LoiLo
2014-08-31 22:23 - 2014-08-31 22:23 - 00000000 ____D () C:\Users\Clemens\Documents\LoiLo
2014-08-31 22:22 - 2014-08-31 21:50 - 74612920 _____ (LoiLo inc. ) C:\Users\Clemens\Downloads\LoiLoGameRecorder1.1.0.0.exe
2014-08-30 07:48 - 2014-09-11 16:22 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-08-30 07:47 - 2014-09-11 16:22 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-30 07:46 - 2014-09-11 16:22 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-30 06:05 - 2014-09-11 16:22 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-08-30 06:04 - 2014-09-11 16:22 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-30 06:03 - 2014-09-11 16:22 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-29 22:16 - 2014-08-29 22:16 - 04652126 _____ () C:\Users\Clemens\Desktop\Unbenannt.mp4
2014-08-29 19:40 - 2014-08-29 19:29 - 25607384 _____ () C:\Users\Clemens\Downloads\GENRL (1)
2014-08-28 22:11 - 2014-01-03 17:17 - 00000000 ____D () C:\Users\Clemens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-08-28 22:02 - 2014-04-04 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-08-28 22:02 - 2014-04-04 14:38 - 00000000 ____D () C:\Program Files (x86)\Sony
2014-08-28 22:02 - 2014-03-03 17:59 - 00000000 ____D () C:\ProgramData\Sony
2014-08-28 22:02 - 2014-01-11 11:36 - 00000000 ____D () C:\Users\Clemens\AppData\Local\CrashDumps
2014-08-28 22:02 - 2013-12-28 19:58 - 00000000 ___RD () C:\Users\Clemens\Desktop\Tools
2014-08-28 13:34 - 2014-09-11 16:12 - 00059400 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-28 08:05 - 2014-09-11 16:12 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-28 08:05 - 2014-09-11 16:12 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-28 08:05 - 2014-09-11 16:12 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-28 08:05 - 2014-09-11 16:12 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-28 08:02 - 2014-09-11 16:12 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-28 08:01 - 2014-09-11 16:12 - 03285504 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 01623552 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-28 08:01 - 2014-09-11 16:12 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wuaext.dll
2014-08-23 08:47 - 2014-08-28 13:49 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 23:19 - 2014-08-22 23:18 - 00234729 _____ () C:\Users\Clemens\Downloads\imgtool20.zip
2014-08-22 12:48 - 2013-12-07 12:10 - 00000000 ____D () C:\Users\Clemens\AppData\Local\Packages
2014-08-21 22:41 - 2014-08-21 22:41 - 03582842 _____ () C:\Users\Clemens\Downloads\229446-669214-san-andreas-mod-installer.zip
2014-08-21 22:40 - 2014-08-21 22:40 - 01028010 _____ () C:\Users\Clemens\Downloads\Backup Radar gta sa.rar
2014-08-21 22:38 - 2014-08-21 22:38 - 00899752 _____ () C:\Users\Clemens\Downloads\installer_san_andreas_mod_install_Deutsch.exe
2014-08-21 22:38 - 2014-08-21 22:38 - 00523910 _____ () C:\Users\Clemens\Downloads\rockstargames_sabackupfronten123andpc.rar
2014-08-21 22:12 - 2014-08-21 22:12 - 00034816 _____ () C:\Users\Clemens\Downloads\radar00.txd
2014-08-21 20:03 - 2013-12-12 17:47 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-21 20:02 - 2014-08-21 20:02 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-21 20:02 - 2014-08-21 20:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-21 20:02 - 2014-08-21 20:02 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-21 01:40 - 2014-09-06 22:00 - 00732880 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-08-20 19:05 - 2014-09-06 22:00 - 00694784 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-08-20 19:05 - 2014-09-06 22:00 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-08-20 19:05 - 2014-09-06 22:00 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-08-20 19:02 - 2014-09-06 22:00 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-08-20 19:02 - 2014-09-06 22:00 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-08-20 02:49 - 2014-08-20 02:49 - 00000000 ___DC () C:\$SysReset
2014-08-20 02:43 - 2014-08-20 02:43 - 00030084 _____ () C:\Windows\Ascd_tmp.ini
2014-08-20 02:43 - 2014-08-20 02:43 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-08-20 01:44 - 2014-02-15 13:54 - 00007110 _____ () C:\Windows\setupact.log
2014-08-19 22:23 - 2013-12-18 19:18 - 00000000 ____D () C:\Users\Clemens\Desktop\Musik
2014-08-19 22:22 - 2014-08-19 22:17 - 09941504 _____ (mfbot.de) C:\Users\Clemens\Downloads\MFBot-3313-x64.exe
2014-08-19 21:28 - 2014-08-19 21:28 - 00002120 _____ () C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk
2014-08-19 21:28 - 2014-08-19 21:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3
2014-08-19 21:28 - 2014-02-04 18:42 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.3
2014-08-19 21:28 - 2013-12-07 12:39 - 00000000 ____D () C:\ProgramData\MTA San Andreas All
2014-08-19 20:10 - 2014-08-19 19:55 - 19357147 _____ () C:\Users\Clemens\Downloads\Sound's.rar
2014-08-19 19:33 - 2014-08-19 19:32 - 02697862 _____ () C:\Users\Clemens\Downloads\1407954038_GTA SA - Weapons Brazuca - PointBlank.rar
2014-08-19 19:30 - 2014-08-19 19:29 - 02116570 _____ () C:\Users\Clemens\Downloads\1407954055_GTA SA - Weapons BLOODY - PointBlank.rar
2014-08-19 19:09 - 2014-08-19 19:08 - 00604863 _____ () C:\Users\Clemens\Downloads\Sounds (1).rar
2014-08-19 19:08 - 2014-08-19 19:08 - 00604863 _____ () C:\Users\Clemens\Downloads\Sounds.rar
2014-08-19 18:54 - 2014-08-19 18:51 - 07930562 _____ () C:\Users\Clemens\Downloads\1407916887_SLAUGHTER WP.zip
2014-08-19 18:51 - 2014-08-19 18:50 - 00751090 _____ () C:\Users\Clemens\Downloads\1407954016_GTA SA - Weapons GSL 2014 - PointBlank.rar
2014-08-19 18:46 - 2014-08-19 18:46 - 00541641 _____ () C:\Users\Clemens\Downloads\Pack.zip
2014-08-18 22:25 - 2014-02-08 13:52 - 00442041 _____ () C:\Windows\DirectX.log
2014-08-18 19:35 - 2014-08-18 19:34 - 01239430 _____ () C:\Users\Clemens\Downloads\603_randomnigga.zip
2014-08-18 19:35 - 2014-08-18 19:34 - 01014521 _____ () C:\Users\Clemens\Downloads\730_cityboy.zip
2014-08-18 19:34 - 2014-08-18 19:33 - 00852757 _____ () C:\Users\Clemens\Downloads\682_claudefx.zip
2014-08-18 17:50 - 2014-08-18 17:50 - 00005243 _____ () C:\Users\Clemens\Downloads\gta-sa_mini_su (1).rar
2014-08-18 17:48 - 2014-07-04 23:52 - 00005138 _____ () C:\Users\Clemens\Downloads\gta-sa_mini_su.rar
2014-08-18 16:07 - 2014-08-18 16:07 - 00002120 _____ () C:\Users\Public\Desktop\MTA San Andreas 1.4.lnk
2014-08-18 16:07 - 2014-08-18 16:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4
2014-08-18 16:07 - 2014-08-16 02:09 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.4
2014-08-18 15:58 - 2014-08-18 15:50 - 21866928 _____ (Multi Theft Auto) C:\Users\Clemens\Downloads\mtasa-1.4.exe
2014-08-18 15:30 - 2014-08-18 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2014-08-18 15:30 - 2013-12-07 12:16 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-08-18 12:55 - 2013-12-07 13:46 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-08-17 23:45 - 2014-08-17 23:40 - 11990847 _____ () C:\Users\Clemens\Downloads\sa-mp-0.3z-R1-install.exe
2014-08-17 23:45 - 2014-02-09 16:38 - 00000000 ____D () C:\Users\Clemens\Documents\GTA San Andreas User Files
2014-08-17 22:37 - 2014-08-17 22:25 - 25932734 _____ () C:\Users\Clemens\Downloads\GENRL
2014-08-17 22:34 - 2014-08-17 04:15 - 00000000 ____D () C:\Windows\softwaredistribution.bak1
2014-08-17 00:18 - 2014-08-17 00:11 - 14483057 _____ () C:\Users\Clemens\Downloads\12_gun_pack.rar
2014-08-16 22:57 - 2014-08-16 22:56 - 01861203 _____ () C:\Users\Clemens\Downloads\43_fam1.zip
2014-08-16 22:56 - 2014-08-16 22:54 - 05343493 _____ () C:\Users\Clemens\Downloads\512-2_gunpack.zip
2014-08-16 12:58 - 2013-12-09 21:49 - 00481792 ___SH () C:\Users\Clemens\Downloads\Thumbs.db
2014-08-16 11:34 - 2014-09-11 17:13 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-16 11:34 - 2014-09-11 17:13 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-16 11:34 - 2014-09-11 17:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-08-16 11:34 - 2014-09-11 17:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-16 11:33 - 2014-09-11 17:13 - 19280384 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-16 11:33 - 2014-09-11 17:13 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-16 11:33 - 2014-09-11 17:13 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-16 11:32 - 2014-09-11 17:13 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-16 11:32 - 2014-09-11 17:13 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-16 09:37 - 2014-09-11 17:13 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-16 09:37 - 2014-09-11 17:13 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 14369280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-16 09:36 - 2014-09-11 17:13 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-16 09:35 - 2014-09-11 17:13 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

Some content of TEMP:
====================
C:\Users\Clemens\AppData\Local\Temp\7za.exe
C:\Users\Clemens\AppData\Local\Temp\hijackthis.exe
C:\Users\Clemens\AppData\Local\Temp\NirCmd.exe
C:\Users\Clemens\AppData\Local\Temp\PEVZ.EXE
C:\Users\Clemens\AppData\Local\Temp\Quarantine.exe
C:\Users\Clemens\AppData\Local\Temp\remove.exe
C:\Users\Clemens\AppData\Local\Temp\sed.exe
C:\Users\Clemens\AppData\Local\Temp\swreg.exe
C:\Users\Clemens\AppData\Local\Temp\swxcacls.exe
C:\Users\Clemens\AppData\Local\Temp\wget.exe
C:\Users\Clemens\AppData\Local\Temp\zoek-delete.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-07 17:07

==================== End Of Log ============================

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Clemens at 2014-09-14 13:36:19
Running from C:\Users\Clemens\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Alpha Protocol (HKLM-x32\...\{D37FE0E3-B1A9-4E41-AB5D-DA62E04D2C42}) (Version: 1.00.0000 - SEGA Corporation)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Assassin's Creed Brotherhood (HKLM-x32\...\{BE4BA698-8533-4F77-9559-C7F3F78C0B05}) (Version: 1.00 - Ubisoft)
Assassin's Creed Revelations (HKLM-x32\...\{33A22B2D-55BA-4508-B767-BF2E9C21A73F}) (Version: 1.00 - Ubisoft)
Borderlands (HKLM-x32\...\{52B65911-1559-4ED5-9461-46957FDD48CD}) (Version: 1.0.295 - 2K Games)
Borderlands 2 (HKLM-x32\...\Borderlands 2_is1) (Version:  - )
Call of Duty(R) 4 - Modern Warfare(TM) (HKLM-x32\...\InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}) (Version: 1.7 - Activision)
Call of Duty(R) 4 - Modern Warfare(TM) (x32 Version: 1.6 - Activision) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch (x32 Version:  - ) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch (x32 Version: 1.7 - Activision) Hidden
Call of Duty: Black Ops - Multiplayer (HKLM-x32\...\Steam App 42710) (Version:  - Treyarch)
Call of Duty: Black Ops (HKLM-x32\...\Steam App 42700) (Version:  - Treyarch)
Camtasia Studio 8 (HKLM-x32\...\{F5C9BE9A-04C3-4A72-8CD0-BB67C722D608}) (Version: 8.1.2.1344 - TechSmith Corporation)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
EXPERTool v9.1 (HKLM-x32\...\{551D9481-9487-4D0C-9A1D-6BC3E7B6D991}_is1) (Version: 9.1.0.2 - Gainward Co. Ltd.)
Fallout New Vegas (HKLM-x32\...\Fallout New Vegas_is1) (Version: 1.0 - Bethesda Softworks)
Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.00 - Ubisoft)
Far Cry 3 Blood Dragon (HKLM-x32\...\{A071F478-73E0-4143-AE55-4DD6BABD74F5}) (Version: 1.00 - Ubisoft)
Far Cry 3 Deutsch Patch Fix-TokZic 1.00 (HKLM-x32\...\Far Cry 3 Deutsch Patch Fix-TokZic 1.00) (Version: 1.00 - TokZic)
Far Cry 3 Deutsch Patch-TokZic 1.00 (HKLM-x32\...\Far Cry 3 Deutsch Patch-TokZic 1.00) (Version: 1.00 - TokZic)
Fiesta Online (HKLM-x32\...\Steam App 280620) (Version:  - Onson Soft)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Grand Theft Auto San Andreas (HKLM-x32\...\{086BADF8-9B1F-4E89-B207-2EDA520972D6}) (Version: 1.00.00001 - Rockstar Games)
Grand Theft Auto: Episodes From Liberty City (HKLM-x32\...\{61B8B2F9-D8DA-4B24-89A9-DB09F38A4899}) (Version: 1.1.0.0 - Rockstar Games)
Grand Theft Auto: Episodes from Liberty City (x32 Version: 1.0.0003.135 - Rockstar Games Inc.) Hidden
Hitman Absolution (HKLM-x32\...\Hitman Absolution_is1) (Version:  - )
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Mafia II (HKLM-x32\...\Mafia II_is1) (Version: 1.0 - Take-Two Interactive Software, Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10111.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Mirror's Edge™ (HKLM-x32\...\{AEDBD563-24BB-4EE3-8366-A654DAC2D988}) (Version: 1.0.0.0 - Electronic Arts)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MTA:SA v1.3.5 (HKLM-x32\...\MTA:SA 1.3) (Version: v1.3.5 - Multi Theft Auto)
MTA:SA v1.4.0 (HKLM-x32\...\MTA:SA 1.4) (Version: v1.4.0 - Multi Theft Auto)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.6 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
Orcs Must Die! (HKLM-x32\...\Orcs Must Die!_is1) (Version:  - )
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version:  - OVERKILL - a Starbreeze Studio.)
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Sniper Elite: Zombie Army (HKLM-x32\...\Steam App 235700) (Version:  - Rebellion)
Sniper Elite: Zombie Army 2 (HKLM-x32\...\Steam App 247930) (Version:  - Rebellion)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
System Requirements Lab for Intel (HKLM-x32\...\{04C4B49D-45D9-4A28-9ED1-B45CBD99B8C7}) (Version: 4.5.24.0 - Husdawg, LLC)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
Vegas Pro 12.0 (64-bit) (HKLM\...\{BE94768F-5232-11E3-BD78-F04DA23A5C58}) (Version: 12.0.770 - Sony)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Xfire 2.0 (HKLM-x32\...\{43ADAE00-A4ED-4379-A76D-A1FF5D9D334A}_is1) (Version: 2.0 - Xfire, Inc.)
Xfire Codec (remove only) (HKLM-x32\...\XfireCodec) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

26-08-2014 11:47:07 Windows Update
29-08-2014 15:00:13 Windows Update
01-09-2014 17:42:07 Windows Update
05-09-2014 13:55:02 Windows Update
09-09-2014 12:54:50 Windows Update
14-09-2014 10:35:20 ComboFix created restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 07:26 - 2014-09-14 12:40 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {4995D2FD-7B5E-4FF8-BDAD-08C769DEAA48} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-09-11] (Microsoft Corporation)
Task: {4E89B4B0-CC85-46ED-B4E8-3F3CA78FCCC4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-07] (Google Inc.)
Task: {722F2DA5-3D75-4B8B-A706-616B7C64A5E9} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe
Task: {744E0A84-6F53-48A1-8682-6CD9292E97D0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-07] (Google Inc.)
Task: {8063572F-4A3D-4740-BAAA-BC079BF24584} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-09] (Adobe Systems Incorporated)
Task: {836ABE6E-E11C-4E82-96A8-985A05C32049} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
Task: {8AF71566-8F9A-490E-9EE2-512F7C72ECBA} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install => C:\Windows\system32\NotificationUI.exe [2014-08-21] (Microsoft Corporation)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {C4A2FA10-F036-4824-9D0C-1800F17E6AB9} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {EBD8D9D1-EE7A-404D-BB8C-4619D14EEB36} - System32\Tasks\EXPERTool => C:\Program Files (x86)\EXPERTool\TBPanel.exe [2014-02-17] (Gainward Co. Ltd.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-12-09 19:02 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-12-09 19:20 - 2014-06-23 15:49 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-09-14 13:29 - 2014-09-14 13:31 - 01290240 _____ () C:\Users\Clemens\Downloads\zoek.exe
2014-09-10 21:12 - 2014-09-04 05:01 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libglesv2.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libegl.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\pdf.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll
2014-09-10 21:12 - 2014-09-04 05:01 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData:NT
AlternateDataStreams: C:\ProgramData:NT2
AlternateDataStreams: C:\Users\All Users:NT
AlternateDataStreams: C:\Users\All Users:NT2
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2
AlternateDataStreams: C:\ProgramData\Application Data:NT
AlternateDataStreams: C:\ProgramData\Application Data:NT2
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2
AlternateDataStreams: C:\Users\Clemens\Anwendungsdaten:NT
AlternateDataStreams: C:\Users\Clemens\Anwendungsdaten:NT2
AlternateDataStreams: C:\Users\Clemens\AppData\Roaming:NT
AlternateDataStreams: C:\Users\Clemens\AppData\Roaming:NT2

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "NvBackend"
HKLM\...\StartupApproved\Run32: => "Aeria Ignite"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKCU\...\StartupApproved\StartupFolder: => "MFBot.url"
HKCU\...\StartupApproved\Run: => "EA Core"
HKCU\...\StartupApproved\Run: => "Steam"
HKCU\...\StartupApproved\Run: => "Skype"
HKCU\...\StartupApproved\Run: => "Akamai NetSession Interface"
HKCU\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKCU\...\StartupApproved\Run: => "Overwolf"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/14/2014 11:33:06 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (09/11/2014 08:13:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Multi Theft Auto.exe, Version 1.5975.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 10a8

Startzeit: 01cfcdec02e11892

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\MTA San Andreas 1.3\Multi Theft Auto.exe

Berichts-ID: 4bc8b0fc-39df-11e4-bf30-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/11/2014 03:55:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CamtasiaStudio.exe, Version 8.1.2.1344 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: dcc

Startzeit: 01cfcdc7ed734e21

Endzeit: 19

Anwendungspfad: C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe

Berichts-ID: 37faac96-39bb-11e4-bf2e-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/11/2014 03:53:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CamtasiaStudio.exe, Version 8.1.2.1344 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e14

Startzeit: 01cfcdc7a77f9c8f

Endzeit: 32

Anwendungspfad: C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe

Berichts-ID: 03208eb7-39bb-11e4-bf2e-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/11/2014 03:52:38 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CamtasiaStudio.exe, Version 8.1.2.1344 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 138c

Startzeit: 01cfcdc74f6dbef3

Endzeit: 21

Anwendungspfad: C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe

Berichts-ID: e2acc31a-39ba-11e4-bf2e-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/09/2014 09:53:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: CLEMENS-PC)
Description: Das Paket „winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy“ wurde beendet, da das Anhalten zu lange dauerte.

Error: (09/09/2014 09:53:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm WWAHost.exe, Version 6.2.9200.16420 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 7f0

Startzeit: 01cfcc27ea7f1180

Endzeit: 4294967295

Anwendungspfad: C:\Windows\System32\WWAHost.exe

Berichts-ID: ece0cae3-385a-11e4-bf2b-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Windows.Store

Error: (09/09/2014 09:52:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.2.9200.16628 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: d38

Startzeit: 01cfcc27831ac3ad

Endzeit: 97

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: dac6a73a-385a-11e4-bf2b-60a44c3287ba

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (09/06/2014 11:48:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CamRecorder.exe, Version: 8.1.2.1344, Zeitstempel: 0x521468e9
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.17046, Zeitstempel: 0x53b485c4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00056360
ID des fehlerhaften Prozesses: 0x139c
Startzeit der fehlerhaften Anwendung: 0xCamRecorder.exe0
Pfad der fehlerhaften Anwendung: CamRecorder.exe1
Pfad des fehlerhaften Moduls: CamRecorder.exe2
Berichtskennung: CamRecorder.exe3
Vollständiger Name des fehlerhaften Pakets: CamRecorder.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CamRecorder.exe5

Error: (09/06/2014 06:14:30 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005


System errors:
=============
Error: (09/14/2014 01:00:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "RzKLService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/14/2014 00:57:54 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (09/14/2014 00:57:24 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (09/14/2014 00:56:54 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (09/14/2014 00:56:24 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (09/14/2014 00:55:54 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (09/14/2014 00:55:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Update für Microsoft Silverlight (KB2977218)

Error: (09/14/2014 00:55:24 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (09/14/2014 00:54:54 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (09/14/2014 00:54:24 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (09/14/2014 11:33:06 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (09/11/2014 08:13:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Multi Theft Auto.exe1.5975.0.010a801cfcdec02e118920C:\Program Files (x86)\MTA San Andreas 1.3\Multi Theft Auto.exe4bc8b0fc-39df-11e4-bf30-60a44c3287ba

Error: (09/11/2014 03:55:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: CamtasiaStudio.exe8.1.2.1344dcc01cfcdc7ed734e2119C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe37faac96-39bb-11e4-bf2e-60a44c3287ba

Error: (09/11/2014 03:53:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: CamtasiaStudio.exe8.1.2.1344e1401cfcdc7a77f9c8f32C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exe03208eb7-39bb-11e4-bf2e-60a44c3287ba

Error: (09/11/2014 03:52:38 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: CamtasiaStudio.exe8.1.2.1344138c01cfcdc74f6dbef321C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamtasiaStudio.exee2acc31a-39ba-11e4-bf2e-60a44c3287ba

Error: (09/09/2014 09:53:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: CLEMENS-PC)
Description: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy

Error: (09/09/2014 09:53:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: WWAHost.exe6.2.9200.164207f001cfcc27ea7f11804294967295C:\Windows\System32\WWAHost.exeece0cae3-385a-11e4-bf2b-60a44c3287bawinstore_1.0.0.0_neutral_neutral_cw5n1h2txyewyWindows.Store

Error: (09/09/2014 09:52:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.2.9200.16628d3801cfcc27831ac3ad97C:\Windows\Explorer.EXEdac6a73a-385a-11e4-bf2b-60a44c3287ba

Error: (09/06/2014 11:48:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CamRecorder.exe8.1.2.1344521468e9ntdll.dll6.2.9200.1704653b485c4c000000500056360139c01cfca1904817c19C:\Program Files (x86)\TechSmith\Camtasia Studio 8\CamRecorder.exeC:\Windows\SYSTEM32\ntdll.dll9013f9ed-360f-11e4-bf27-60a44c3287ba

Error: (09/06/2014 06:14:30 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005


CodeIntegrity Errors:
===================================
  Date: 2014-09-14 12:39:53.357
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-07-22 01:09:17.420
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Clemens\AppData\Local\Temp\EverestDriver.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-07-22 01:09:17.264
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-05-18 18:01:37.838
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Clemens\AppData\Local\Temp\EverestDriver.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-05-18 18:01:37.784
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz
Percentage of memory in use: 15%
Total physical RAM: 12224.28 MB
Available physical RAM: 10293.09 MB
Total Pagefile: 13952.28 MB
Available Pagefile: 11866.22 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.51 GB) (Free:607.61 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 2DF6D47D)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

M-K-D-B · 14.09.2014, 12:44

Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 3 h) dauern.
Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
CloseProcesses:
SearchScopes: HKCU - {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = 
EmptyTemp:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3
Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Bitte poste mit deiner nächsten Antwort

die Logdatei des FRST-Fix,
die Logdatei von ESET,
die Logdatei von SecurityCheck.

clemicool · 14.09.2014, 13:20

Bei ESET kam der Fehler 2002 und ich bin ratlos.

M-K-D-B · 14.09.2014, 13:21

Zitat:

Zitat von clemicool

Bei ESET kam der Fehler 2002 und ich bin ratlos.

etwas genauer bitte... oder eine Screenshot posten.

clemicool · 14.09.2014, 16:26

Habe es jetzt nochmal gestartet, wenn das Problem nochmal auftritt poste ich einen Screen.

So hat jetzt gedauert, denn habe mich während des Scans bisschen hingelegt

Hier der FixLog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014
Ran by Clemens at 2014-09-14 13:46:56 Run:1
Running from C:\Users\Clemens\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
SearchScopes: HKCU - {9C112D7C-1165-4661-8C0C-570CC04BAECD} URL = 
EmptyTemp:
end
*****************

Processes closed successfully.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9C112D7C-1165-4661-8C0C-570CC04BAECD}" => Key deleted successfully.
"HKCR\CLSID\{9C112D7C-1165-4661-8C0C-570CC04BAECD}" => Key not found.
EmptyTemp: => Removed 866.9 MB temporary data.


The system needed a reboot. 

==== End of Fixlog ====

Der ESET Log:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=4e9537cf809303418be6e5825a6acf27
# engine=20148
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-14 03:16:38
# local_time=2014-09-14 05:16:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 19850 15098687 0 0
# scanned=277312
# found=9
# cleaned=0
# scan_time=9840
sh=D4B66D63BDB5B1E3B008FCEC0339D4EFEF9ACBC3 ft=1 fh=b8d78b984d4f7d1a vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=7F44A22E0A7B795DB6B81B8FBE42C809441C3E31 ft=1 fh=6d3a6cc63abdd3a8 vn="Win32/Toolbar.witToolbar.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\Metabar\backgroundHost.exe"
sh=96672D4FC6674582F95133823738EBD9849BAECA ft=1 fh=32bc410db6173492 vn="Win32/Toolbar.witToolbar.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\Metabar\HTMLHost.dll"
sh=E4E91FFDC841998CAD7FCF819CACA7BE74DBF29F ft=1 fh=1650fa1f2ec2f182 vn="Variante von Win32/Toolbar.witToolbar.C evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\Metabar\tdataprotocol.dll"
sh=E9CEB6468E345B07F1A7D4088AA212A5B62213D1 ft=1 fh=eb725bed8e495e16 vn="Variante von Win32/Toolbar.Metabar.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\Metabar\XHR.dll"
sh=D0490F422EE2FF9CE5FD04867348BB5A343C831A ft=1 fh=3ccde555bec845b3 vn="Win32/Somoto.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\File System\017\t\00\00000000"
sh=19876B0C21073CE7AC4725124851FC36B7EA7301 ft=1 fh=31b372839de59c7b vn="Variante von Win32/CNETInstaller.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Clemens\Downloads\cbsidlm-cbsi188-Streaming_Video_Recorder-BP-75586860.exe"
sh=333F9395D4D9FAF4DFBA6317F41CAB3CEA95D153 ft=1 fh=370469a8e94087a6 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Clemens\Downloads\Everest Home Edition - CHIP-Installer.exe"
sh=D2284026341E12003D16A1C8B2F5030A47BF95B3 ft=1 fh=2521e6b973d9ef15 vn="Variante von Win32/InstallCore.QJ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Clemens\Downloads\installer_san_andreas_mod_install_Deutsch.exe"

Also es hat 9 Datein festgestellt, aber es wundert mich das dort der AdwCleaner ist von Ihnen?
Hier noch ein Screen dazu:

Und hier die Checkup Datei:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.87  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 67  
 Adobe Flash Player 	15.0.0.152  
 Google Chrome 37.0.2062.103  
 Google Chrome 37.0.2062.120  
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe 
 Windows Defender MsMpEng.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

M-K-D-B · 15.09.2014, 12:22

Servus,

die Funde von ESET zeigen u. a. auf die Quarantäne von AdwCleaner... nicht auf AdwCleaner selbst...

Dateien in einer Quarantäne können keinen Schaden mehr anrichten.

Mit den abschließenden Schritten kümmern wir um alles.

Reste entfernen
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
CloseProcesses:
C:\Program Files (x86)\Common Files\Metabar
C:\Users\Clemens\AppData\Local\Google\Chrome\User Data\Default\File System\017\t\00\00000000
C:\Users\Clemens\Downloads\cbsidlm-cbsi188-Streaming_Video_Recorder-BP-75586860.exe
C:\Users\Clemens\Downloads\Everest Home Edition - CHIP-Installer.exe
C:\Users\Clemens\Downloads\installer_san_andreas_mod_install_Deutsch.exe
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.

Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.

Ändere regelmäßig alle deine Passwörter, jetzt nach der Bereinigung ist ein idealer Zeitpunkt dafür!

Verwende für jede Anwendung und jeden Account ein anderes Passwort.
Ändere regelmäßig dein Passwort, vor allem bei Onlinebanking oder deinem Emailpostfach ist das sehr wichtig.
Speichere keine Passwörter auf deinem PC, gib diese nicht an Dritte weiter.
Ein sicheres Passwort besteht aus mindestens 8 Zeichen und beinhaltet Groß- und Kleinbuchstaben, Zahlen und Sonderzeichen.
Benutze keine Zahlen- oder Buchstabenkombinationen, ( zB 12345678, qwertzui) auch keine Zahlen oder Buchstabenmuster.
Verwende keine Passwörter die einen Bezug zu dir, deinem Wohnort, Familienmitglied oder Haustier (Geburtsdatum, Postleitzahl, Adresse, Name) haben.

Schritt 1
Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Schritt 2
Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems.

Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti-Viren-Programm und zusätzlicher Schutz

Gehe sicher, dass du immer nur eine Anti-Viren Software installiert hast und dass diese auch up to date ist! Ein kostenloses Anti-Viren Programm, das wir empfehlen, wäre z. B. Avast! Free Antivirus oder Microsoft Security Essentials.
MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt. Du kannst es zusätzlich zu deinem Anti-Viren Programm verwenden.
Update das Tool und lasse es einmal in der Woche laufen. Die Kaufversion bietet zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
AdwCleaner
Dieses Tool erkennt eine Vielzahl von Werbeprogrammen (Adware) und unerwünschten Programmen (PUPs).
Starte das Tool einmal die Woche und lass es laufen. Sollte eine neue Version verfügbar sein, so wird dies angezeigt und du kannst dir die neueste Version direkt von der Herstellerseite auf den Desktop herunterladen. Auch dieses Programm kann parallel zu deinem Anti-Viren Programm verwendet werden.
SpywareBlaster
Eine kurze Einführung findest du Hier

Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Mozilla Firefox

Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
NoScript
Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt, wenn Du es bestätigst.
AdblockPlus
Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzuzufügen reicht und dieser wird nicht mehr geladen.
Es spart außerdem Downloadkapazität.

Performance

Halte dich fern von Registry Cleanern.
Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link:
Miekemoes Blogspot ( MVP )

Was du vermeiden solltest:

Klicke nicht auf alles, nur weil es dich dazu auffordert und schön bunt ist.
Verwende keine P2P oder Filesharing Software (Emule, uTorrent,..).
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie z.B. deinFoto.jpg.exe.
Lade keine Software von Softonic oder Chip herunter, da diese Installer oft mit Adware oder unerünschter Software versehen sind!

Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen?

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

clemicool · 15.09.2014, 14:58

Okey ja, es hatte alles gut funktioniert.
Gestern ist mein Ping auch wieder abgestiegen.
Gerade habe ich zwar wieder einen 1000er Ping(1000ms), aber mal hoffen es ändert sich.
Zusätzlich zu dem Thema.
Es lässt sich ein Update nicht herunterladen(Microsoft Silverlight) ich habe auch schon das Microsoft Fixtool genutzt, aber es hatte alles nichts gebracht....

M-K-D-B · 16.09.2014, 11:12

Zitat:

Zitat von clemicool

Es lässt sich ein Update nicht herunterladen(Microsoft Silverlight) ich habe auch schon das Microsoft Fixtool genutzt, aber es hatte alles nichts gebracht....

Welche Fehlermeldung erscheint genau?
Hast du schon versucht, Silverlight nicht über das Windows Update, sondern manuell herunterzuladen und zu installieren?

clemicool · 16.09.2014, 14:00

Hatte bisher nicht einen genauen Download gefunden

Hier ein Screen davon:

Dies könnte eventuell was damit zu tun haben?

Internetverbindung seit 7 Tagen verschlechtert. Verdacht auf Virus.

Log-Analyse und Auswertung: Internetverbindung seit 7 Tagen verschlechtert. Verdacht auf Virus.