Hallo!

Ich habe gestern mein Handy gerootet und um mir eine Sicherheitskopie meiner IMEI und EFS anzulegen, habe ich eine vermeintlich sichere Datei von XDA Developers gezogen, welche beim installieren massig Programme installiert hat - irgendwelche Schutzsoftware, Downloader, usw. und die beiden äußert hartnäckigen Erweiterungen BuyNsave und OptOn, welche ich partut nicht aus Chrome entfernt bekomme.

Ich bin dazu Schritt für Schritt nach folgender Anleitung gegangen http://www.trojaner-board.de/155077-...entfernen.html , jedoch hab ich diese beiden Plugins immer noch in Chrome. Gestern hat es mich nicht sonderlich gestört, da sie einfach nur da waren und nichts gemacht hatten, aber heute wird mir jede Webseite mit Werbung bombardiert, es erscheinen fake links zu irgendwelchen Download Seiten usw.

Hier meine Log Files

FRST


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-12-2014
Ran by Hempf (administrator) on HEMPF-PC on 05-12-2014 10:42:23
Running from C:\Users\Hempf\Downloads
Loaded Profile: Hempf (Available profiles: Hempf)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\MusicManager.exe
(Dropbox, Inc.) C:\Users\Hempf\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(E.W.E.-Software) C:\Users\Hempf\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2464072 2014-11-06] (NVIDIA Corporation)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6202416 2014-03-04] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2014-03-04] (Lenovo (Beijing) Limited)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-31] (AVAST Software)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-11-10] (Intel Corporation)
HKLM-x32\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe [1581056 2007-04-27] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [EnergyCut] => C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe [1167360 2007-03-09] (Lenovo (Beijing) Limited)
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Run: [TVTip] => C:\Users\Hempf\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvstart.exe [102400 2010-05-31] (E.W.E.-Software)
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22869088 2014-10-21] (Google)
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Run: [MusicManager] => C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7475200 2014-11-13] (Google Inc.)
Startup: C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX64.dll ()
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX64.dll ()
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX32.dll ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX32.dll ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX32.dll ()
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2103675106-285616780-2124652750-1000\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE7317F878401CF01
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKU\S-1-5-21-2103675106-285616780-2124652750-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Hempf\AppData\Roaming\Mozilla\Firefox\Profiles\lwh52p3k.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll No File
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-2103675106-285616780-2124652750-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-2103675106-285616780-2124652750-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Hempf\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-2103675106-285616780-2124652750-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Hempf\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-2103675106-285616780-2124652750-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-25]
FF Extension: No Name - wrc@avast.com [Not Found]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR DefaultSearchKeyword: Default -> 9E9F945DCEF14D09A35457FC62544A0029A4C358177A5FCBDA932176C8710D24
CHR DefaultSearchURL: Default -> B5F97A7A45FCF0914BB6C876412027E97ED4FE6FDF4F0EFD943A34F26F5A0CC9
CHR Profile: C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-05-20]
CHR Extension: (Angry Birds) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2013-12-25]
CHR Extension: (Google Drive) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-04]
CHR Extension: (YouTube) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-25]
CHR Extension: (Google-Suche) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-25]
CHR Extension: (Photo Zoom für Facebook) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhapiedbmffnpkahkcjdjpikmodjipmd [2013-12-26]
CHR Extension: (Video Downloader professional) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2014-02-15]
CHR Extension: (AdBlock) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-19]
CHR Extension: (Avast Online Security) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-12-25]
CHR Extension: (Unfriend Alerts) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgbeldbnadmemecalekdfnffgobkpafc [2013-12-25]
CHR Extension: (Google Maps) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2013-12-25]
CHR Extension: (3D Solar System Web) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdaaepplopehigjgkolniddiadbbkphd [2013-12-25]
CHR Extension: (Picasa) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb [2013-12-25]
CHR Extension: (Google Mail) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-25]
CHR Extension: (OptOn) - C:\ProgramData\ipcbdebpmfkngepkfafbennlfdoogigb\ [2013-12-25]
CHR Extension: (BuyNsave) - C:\ProgramData\lbocnocddiibbijgnnblellnmfghcmbb\ [2013-12-25]
CHR Extension: (BuyNsave) - C:\ProgramData\npmfehnpganhapkhgegjpfdfebbdpgfd\ [2013-12-25]
CHR HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-13] (AVAST Software)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-11-06] (NVIDIA Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-11-06] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19819848 2014-11-06] (NVIDIA Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-13] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-22] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-13] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-13] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-26] (Disc Soft Ltd)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104048 2012-03-02] (Qualcomm Atheros Co., Ltd.)
R3 L6UX1; C:\Windows\System32\Drivers\L6UX164.sys [772864 2013-07-11] (Line 6)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2014-11-06] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation)
S3 rpkmdrv; C:\Windows\System32\drivers\rpkmdrv.sys [21248 2012-08-16] () [File not signed]
S1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [23552 2009-10-25] (Flint Incorporation) [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-05 10:42 - 2014-12-05 10:42 - 02117632 _____ (Farbar) C:\Users\Hempf\Downloads\FRST64.exe
2014-12-05 10:42 - 2014-12-05 10:42 - 00020114 _____ () C:\Users\Hempf\Downloads\FRST.txt
2014-12-05 10:41 - 2014-12-05 10:41 - 00050477 _____ () C:\Users\Hempf\Downloads\Defogger.exe
2014-12-05 10:41 - 2014-12-05 10:41 - 00000472 _____ () C:\Users\Hempf\Downloads\defogger_disable.log
2014-12-05 10:41 - 2014-12-05 10:41 - 00000000 _____ () C:\Users\Hempf\defogger_reenable
2014-12-05 10:27 - 2014-12-05 10:27 - 02153472 _____ () C:\Users\Hempf\Downloads\adwcleaner_4.104 (1).exe
2014-12-05 10:26 - 2014-12-05 10:26 - 00000085 _____ () C:\Windows\wininit.ini
2014-12-05 10:24 - 2014-12-05 10:24 - 00003188 _____ () C:\Users\Hempf\Desktop\AdwCleaner[S4].txt
2014-12-05 10:22 - 2014-12-05 10:22 - 00000055 _____ () C:\AdwCleanerDebug.txt
2014-12-05 10:21 - 2014-12-05 10:21 - 02153472 _____ () C:\Users\Hempf\Downloads\adwcleaner_4.104.exe
2014-12-05 10:12 - 2014-12-05 10:12 - 00259584 _____ (OldTimer Tools) C:\Users\Hempf\Downloads\OTH.scr
2014-12-05 07:59 - 2014-12-05 07:59 - 00069169 _____ () C:\Users\Hempf\Downloads\Children Of Bodom - Lobodomy (Pro).gp4
2014-12-05 07:26 - 2014-12-05 10:25 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-12-05 07:25 - 2014-12-05 07:25 - 02347384 _____ (ESET) C:\Users\Hempf\Downloads\esetsmartinstaller_enu.exe
2014-12-05 07:23 - 2014-12-05 07:23 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\Hempf\Downloads\sc-cleaner.exe
2014-12-05 07:23 - 2014-12-05 07:23 - 00001796 _____ () C:\Users\Hempf\Desktop\sc-cleaner.txt
2014-12-05 07:23 - 2014-12-05 07:23 - 00001796 _____ () C:\sc-cleaner.txt
2014-12-05 07:20 - 2014-12-05 07:20 - 00001608 _____ () C:\Users\Hempf\Desktop\JRT.txt
2014-12-05 07:17 - 2014-12-05 07:17 - 01707646 _____ (Thisisu) C:\Users\Hempf\Downloads\JRT.exe
2014-12-05 07:17 - 2014-12-05 07:17 - 00000000 ____D () C:\Windows\ERUNT
2014-12-05 07:07 - 2014-12-05 10:26 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-05 06:48 - 2014-12-05 06:48 - 00356105 _____ () C:\Users\Hempf\Downloads\libgnustl_shared.so.zip
2014-12-04 17:56 - 2014-12-04 17:56 - 00057950 _____ () C:\Users\Hempf\Downloads\schrank.skp
2014-12-04 17:53 - 2014-12-04 17:53 - 00225481 _____ () C:\Users\Hempf\Downloads\KARE_75281_Latino_Wardrobe_(Latino_Kleiderschrank).skp
2014-12-04 17:45 - 2014-12-04 17:45 - 00260895 _____ () C:\Users\Hempf\Downloads\SLOT_LOWBOARD_114_CKID_3D_SW.skp
2014-12-04 17:45 - 2014-12-04 17:45 - 00177251 _____ () C:\Users\Hempf\Downloads\LACK_Shelf_Wheels_2.skp
2014-12-04 17:31 - 2014-12-04 17:31 - 00116014 _____ () C:\Users\Hempf\Downloads\Untitled 2.skp
2014-12-04 17:25 - 2014-12-04 17:25 - 00919608 _____ () C:\Users\Hempf\Downloads\tv.skp
2014-12-04 17:18 - 2014-12-04 17:19 - 05728996 _____ () C:\Users\Hempf\Downloads\Untitled.skp
2014-12-04 17:08 - 2014-12-04 17:08 - 00443650 _____ () C:\Users\Hempf\Downloads\deskplan.skp
2014-12-04 09:45 - 2014-12-04 09:45 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Hempf\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-04 09:32 - 2014-12-04 09:32 - 00000000 ____D () C:\ProgramData\ipcbdebpmfkngepkfafbennlfdoogigb
2014-12-04 09:30 - 2014-12-04 09:30 - 00000000 ____D () C:\ProgramData\lbocnocddiibbijgnnblellnmfghcmbb
2014-12-04 09:30 - 2014-12-04 09:30 - 00000000 ____D () C:\Program Files (x86)\Chrome Web Store Launcher
2014-12-04 09:29 - 2014-12-04 09:29 - 00000000 ____D () C:\ProgramData\npmfehnpganhapkhgegjpfdfebbdpgfd
2014-12-04 09:21 - 2014-12-04 09:24 - 00001969 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2014-12-04 09:21 - 2014-12-04 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-12-04 09:20 - 2014-12-04 09:21 - 41860496 _____ (Samsung Electronics Co., Ltd.) C:\Users\Hempf\Downloads\Kies3Setup17.exe
2014-12-04 06:16 - 2014-12-04 06:16 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2014-12-03 19:13 - 2014-12-03 19:15 - 00000000 ____D () C:\Users\Hempf\Desktop\Root b2
2014-12-03 16:50 - 2014-06-16 07:01 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01007.dll
2014-12-03 16:50 - 2014-06-16 07:01 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller.dll
2014-12-03 16:46 - 2014-12-03 16:48 - 70892872 _____ (Samsung Electronics Co., Ltd.) C:\Users\Hempf\Downloads\KiesSetup74.exe
2014-12-01 12:43 - 2014-12-01 12:43 - 00013659 _____ () C:\Users\Hempf\Downloads\05 Relentless Reckless Forever.gp4
2014-11-30 11:20 - 2014-11-30 11:21 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hempf\Downloads\spybot-2.4.exe
2014-11-30 11:19 - 2014-11-30 11:20 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Hempf\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-29 22:23 - 2014-11-29 22:23 - 00000000 ____D () C:\Users\Hempf\Documents\My Cheat Tables
2014-11-26 13:36 - 2014-11-26 13:36 - 00016618 _____ () C:\Users\Hempf\Downloads\Metal Preset by Blaine P.txt
2014-11-26 13:31 - 2014-11-26 13:31 - 00034237 _____ () C:\Users\Hempf\Downloads\Metal Foundry Preset 2.s20
2014-11-26 13:30 - 2014-11-26 13:30 - 00030931 _____ () C:\Users\Hempf\Downloads\Metal Foundry Preset 6.s20
2014-11-26 13:30 - 2014-11-26 13:30 - 00020799 _____ () C:\Users\Hempf\Downloads\Metal Machine Preset 1.s20
2014-11-26 13:29 - 2014-11-26 13:29 - 00022417 _____ () C:\Users\Hempf\Downloads\N.Y. Avatar Preset 1.s20
2014-11-26 13:26 - 2002-07-07 23:14 - 01294336 _____ (HMS hxxp://hp.vector.co.jp/authors/VA012897/) C:\Windows\SysWOW64\vorbis.acm
2014-11-26 12:33 - 2014-11-26 12:33 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\IrfanView
2014-11-26 12:33 - 2014-11-26 12:33 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-11-25 12:31 - 2014-11-25 12:31 - 00001166 _____ () C:\Users\Hempf\Desktop\FarCry4 - Verknüpfung.lnk
2014-11-25 11:20 - 2014-11-25 11:25 - 00000859 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Far Cry 4.lnk
2014-11-25 09:48 - 2014-11-25 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-11-24 14:53 - 2014-12-05 10:24 - 00000000 ____D () C:\AdwCleaner
2014-11-24 14:06 - 2014-11-24 14:06 - 00000000 __HDC () C:\ProgramData\{2E9C94ED-C152-4D5D-8E21-AAE23373844C}
2014-11-24 14:03 - 2014-11-24 14:03 - 00000000 __HDC () C:\ProgramData\{868E5822-04F1-4FBB-98CD-DC08EB82D497}
2014-11-21 06:29 - 2014-11-12 21:46 - 00615624 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-11-21 06:27 - 2014-11-13 01:20 - 31893136 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 24557712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 18514616 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 14032984 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 13944952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 13213512 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-11-21 06:27 - 2014-11-13 01:20 - 11397744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 11336432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 04292416 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 04011208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434475.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 01540424 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434475.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00964928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00935240 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00923792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00900928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00500880 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00418112 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00393024 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00348304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-11-21 06:21 - 2014-10-03 20:23 - 00038216 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-11-21 06:21 - 2014-10-03 20:23 - 00032584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-11-21 05:08 - 2014-11-21 05:08 - 00000000 __SHD () C:\Users\Hempf\AppData\Local\EmieBrowserModeList
2014-11-20 12:08 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-20 12:08 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-20 12:08 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-20 12:08 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-20 12:08 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-20 12:08 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-20 12:08 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-20 12:08 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-20 12:08 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-20 12:08 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-20 12:08 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-20 12:08 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-20 12:08 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-20 12:08 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-20 12:08 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-20 12:08 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-20 12:08 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-20 12:08 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-20 12:08 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-20 12:08 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-20 12:08 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-20 12:08 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-20 12:08 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-20 12:08 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-20 12:08 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-20 12:08 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-20 12:08 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-20 12:08 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-20 12:08 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-20 12:08 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-20 12:08 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-20 12:08 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-20 12:08 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-20 12:08 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-20 12:08 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-20 12:08 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-20 12:08 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-20 12:08 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-20 12:08 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-20 12:08 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-20 12:08 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-20 12:08 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-20 12:08 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-20 12:08 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-20 12:08 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-20 12:08 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-20 12:08 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-20 12:08 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-20 12:08 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-20 12:08 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-20 12:08 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-20 12:08 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-20 12:08 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-20 12:08 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-20 12:08 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-20 12:07 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-20 11:56 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-20 11:56 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-20 11:56 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-20 11:50 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-20 11:50 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-20 11:50 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-20 11:50 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-20 11:50 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-20 11:45 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-20 11:45 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-20 11:45 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-20 11:45 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-20 11:35 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-20 11:35 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-20 11:35 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-20 11:35 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-20 11:35 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-20 11:35 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-20 11:35 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-20 11:35 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-20 11:35 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-20 11:35 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-20 11:35 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-20 11:35 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-20 11:35 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-20 11:35 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-20 11:35 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-20 11:35 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-20 11:35 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-20 11:35 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-20 11:35 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-20 11:35 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-20 11:35 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-20 11:35 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-20 11:35 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-20 11:35 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-20 11:35 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-05 10:42 - 2014-08-27 08:09 - 00000000 ____D () C:\FRST
2014-12-05 10:41 - 2013-12-25 15:49 - 00000000 ____D () C:\Users\Hempf
2014-12-05 10:31 - 2011-04-12 08:43 - 00704504 _____ () C:\Windows\system32\perfh007.dat
2014-12-05 10:31 - 2011-04-12 08:43 - 00152310 _____ () C:\Windows\system32\perfc007.dat
2014-12-05 10:31 - 2009-07-14 06:13 - 01634288 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-05 10:31 - 2009-07-14 05:45 - 00032864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-05 10:31 - 2009-07-14 05:45 - 00032864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-05 10:29 - 2014-10-27 07:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-05 10:27 - 2013-12-25 15:49 - 01686279 _____ () C:\Windows\WindowsUpdate.log
2014-12-05 10:26 - 2014-01-03 10:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-05 10:24 - 2014-10-28 13:45 - 00107290 _____ () C:\Windows\PFRO.log
2014-12-05 10:24 - 2014-09-29 15:07 - 00023706 _____ () C:\Windows\setupact.log
2014-12-05 10:24 - 2014-05-27 23:01 - 00000000 ___RD () C:\Users\Hempf\Google Drive
2014-12-05 10:24 - 2014-01-04 17:38 - 00000000 ___RD () C:\Users\Hempf\Dropbox
2014-12-05 10:24 - 2013-12-26 16:28 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Dropbox
2014-12-05 10:24 - 2013-12-25 17:17 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-05 10:24 - 2013-12-25 16:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-05 10:24 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-05 09:52 - 2014-08-08 08:05 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000UA.job
2014-12-05 00:10 - 2014-01-04 23:48 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-04 10:52 - 2014-08-08 08:05 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000Core.job
2014-12-04 09:54 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-12-04 09:25 - 2014-02-27 00:30 - 00000000 ____D () C:\ProgramData\Samsung
2014-12-04 09:24 - 2014-02-27 00:36 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Samsung
2014-12-04 09:24 - 2014-02-27 00:30 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-12-04 09:21 - 2014-02-27 00:43 - 00000000 ____D () C:\Users\Hempf\Documents\SelfMV
2014-12-04 09:21 - 2014-02-10 20:11 - 00000000 ____D () C:\Users\Hempf\AppData\Local\Downloaded Installations
2014-12-04 09:21 - 2013-12-25 16:17 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-04 09:20 - 2014-02-27 00:36 - 00000000 ____D () C:\Users\Hempf\AppData\Local\Samsung
2014-12-04 06:15 - 2013-12-25 18:21 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-12-03 13:56 - 2013-12-25 18:47 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\vlc
2014-12-03 12:32 - 2014-06-03 17:17 - 00003852 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1388875703
2014-11-29 23:05 - 2014-02-02 23:43 - 00000000 ____D () C:\Spiele
2014-11-27 12:03 - 2013-12-26 17:44 - 00000000 ____D () C:\Users\Hempf\Documents\Movie Studio Platinum 12.0 Projekte
2014-11-26 13:26 - 2013-12-26 17:48 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2014-11-26 13:26 - 2013-12-26 17:48 - 00000000 ____D () C:\Program Files (x86)\Image-Line
2014-11-26 09:23 - 2014-10-27 07:41 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-26 09:23 - 2014-10-27 07:41 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-26 09:23 - 2014-10-27 07:41 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 11:21 - 2014-02-02 20:50 - 00000000 ____D () C:\ProgramData\Orbit
2014-11-25 10:04 - 2014-02-19 20:50 - 00000000 ____D () C:\Users\Hempf\Documents\My Games
2014-11-24 15:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Speech
2014-11-24 15:01 - 2014-02-18 17:05 - 00001061 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-24 15:01 - 2013-12-25 16:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-24 15:01 - 2013-12-25 15:50 - 00000955 _____ () C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-24 11:12 - 2013-12-26 15:14 - 00000000 ____D () C:\Users\Hempf\Documents\Adobe
2014-11-24 11:12 - 2013-12-25 18:55 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Adobe
2014-11-22 15:52 - 2013-12-25 18:21 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-11-21 06:41 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-21 06:29 - 2013-12-25 17:17 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-11-20 18:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-11-20 17:14 - 2009-07-14 05:45 - 05027672 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-20 17:13 - 2014-05-07 05:14 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-20 13:04 - 2013-12-26 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-11-20 13:04 - 2013-12-26 16:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-20 13:02 - 2013-12-25 17:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-20 13:02 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2014-11-20 13:00 - 2013-12-25 17:20 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-20 12:23 - 2014-05-27 22:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-11-20 10:48 - 2014-08-08 08:05 - 00004090 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000UA
2014-11-20 10:47 - 2014-08-08 08:05 - 00003694 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000Core
2014-11-20 10:47 - 2013-12-25 16:27 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-20 10:47 - 2013-12-25 16:27 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-20 10:47 - 2013-12-25 16:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-20 10:46 - 2014-01-04 17:37 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-11-13 01:20 - 2013-12-25 17:17 - 00074056 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-11-13 01:20 - 2013-12-25 17:17 - 00059592 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 20986592 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 19966344 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 16884632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 03262784 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 02874456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 00027094 _____ () C:\Windows\system32\nvinfo.pb
2014-11-12 22:56 - 2013-12-25 17:17 - 06897352 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 03534152 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 02559808 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 00934032 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-11-12 22:56 - 2013-12-25 17:17 - 00625472 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\oemdspif.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 00386368 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-11-11 11:29 - 2014-04-16 12:57 - 04100776 _____ () C:\Windows\system32\nvcoproc.bin
2014-11-06 18:06 - 2014-06-02 15:20 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-11-06 18:06 - 2014-06-02 15:20 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-11-06 18:06 - 2013-12-25 17:18 - 02800296 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-11-06 18:06 - 2013-12-25 17:18 - 02197680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

Some content of TEMP:
====================
C:\Users\Hempf\AppData\Local\Temp\c22dd91.exe
C:\Users\Hempf\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0ksjkn.dll
C:\Users\Hempf\AppData\Local\Temp\drvprosetup.exe
C:\Users\Hempf\AppData\Local\Temp\Execute2App.exe
C:\Users\Hempf\AppData\Local\Temp\msvcp90.dll
C:\Users\Hempf\AppData\Local\Temp\msvcr90.dll
C:\Users\Hempf\AppData\Local\Temp\optprosetup.exe
C:\Users\Hempf\AppData\Local\Temp\Quarantine.exe
C:\Users\Hempf\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-25 13:18

==================== End Of Log ============================
         

--- --- ---


Addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-12-2014
Ran by Hempf at 2014-12-05 10:42:43
Running from C:\Users\Hempf\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Addictive Drums 1.5.2 (HKLM-x32\...\Addictive Drums Inno Setup_is1) (Version:  - )
Adobe After Effects CC (HKLM-x32\...\{317243C1-6580-4F43-AED7-37D4438C3DD5}) (Version: 12.2.1 - Adobe Systems Incorporated)
Adobe Audition 3.0 (HKLM-x32\...\Adobe Audition 3.0) (Version: 3.0 - Adobe Systems Incorporated)
Adobe Bridge CC (64 Bit) (HKLM-x32\...\{359F8007-6486-429C-A8C5-D67F6897C88C}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Photoshop CC (HKLM-x32\...\{2D99B50E-431D-4AA8-85C1-172A6F8BCF09}) (Version: 14.0 - Adobe Systems Incorporated)
Adobe Premiere Pro CC (HKLM-x32\...\{505FF1AC-E7F5-4462-BBA7-08900E7E9EEF}) (Version: 7.2.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
Any Audio Converter 4.0.1 (HKLM-x32\...\Any Audio Converter_is1) (Version:  - Any-Audio-Converter.com)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version:  - )
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.14.15 - Atheros Communications Inc.)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
Avidemux 2.6 - 64bits (HKLM-x32\...\Avidemux 2.6 - 64bits (64-bit)) (Version: 2.6.8.9045 - )
BEWERBUNGSMASTER (HKLM-x32\...\ST6UNST #1) (Version:  - )
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - ‪Canon Inc.‬)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)
Canon MG5400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5400_series) (Version: 1.00 - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.3.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)
Collab (HKLM-x32\...\Collab) (Version:  - Image-Line bvba)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Direct MIDI to MP3 Converter Version 6.2.2.46 (HKLM-x32\...\Direct MIDI to MP3 Converter_is1) (Version: 6.2.2.46 - Piston Software)
Dropbox (HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
East West HardcoreBass (HKLM-x32\...\East West HardcoreBass) (Version:  - )
EGR-ShellExtension (HKLM-x32\...\EGR-ShellExtension) (Version: 1.1.0.100 - EasternGraphics)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.4.1 - Lenovo)
Energy Management (x32 Version: 7.0.4.1 - Lenovo) Hidden
EnergyCut (HKLM-x32\...\{6E127727-CE4B-40E4-9A7D-9D65CDE0A15C}) (Version: 1.00 - Lenovo)
Evernote v. 5.4.1 (HKLM-x32\...\{A5F7DF42-F67D-11E3-B7EB-00163E98E7D6}) (Version: 5.4.1.3962 - Evernote Corp.)
EZdrummer (HKLM-x32\...\{43E8D9E7-AFC9-4BA3-8106-B95E02B87AB7}) (Version: 1.0 - Toontrack)
EZXDfh (HKLM-x32\...\{DB1299AF-9EE0-422B-959E-F4171B2AE0F7}) (Version: 1.0 - Toontrack)
Far Cry 4 (HKLM-x32\...\Far Cry 4_is1) (Version:  - )
Far Cry 4 Gold Edition Update 1 MULTi2 1.3.0 (HKLM-x32\...\Far Cry 4 Gold Edition Update 1 MULTi2 1.3.0) (Version:  - )
Far Cry 4 Update V1.4 (HKLM-x32\...\RmFyQ3J5NA==_is1) (Version: 1 - )
FL Studio 8 (HKLM-x32\...\FL Studio 8) (Version:  - Image-Line bvba)
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)
Google Drive (HKLM-x32\...\{C60F3836-333A-4AE2-B526-CFDBA143A9BA}) (Version: 1.18.7821.2489 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Guitar Pro 5.2 (HKLM-x32\...\Guitar Pro 5_is1) (Version:  - Arobas Music)
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line bvba)
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed (HKLM\...\{2C0E6BD4-65B1-4E82-B2AC-43EFFC8F100C}) (Version: 15.0.0.0059 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.9.254 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{DF7756DD-656A-45C3-BA71-74673E8259A9}) (Version: 15.00.0000.0642 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.71.1 - JMicron Technology Corp.)
K-Lite Mega Codec Pack 10.2.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.2.0 - )
Line 6 Uninstaller (HKLM-x32\...\Line 6 Uninstaller) (Version:  - Line 6)
MEGAsync (HKLM-x32\...\MEGAsync) (Version:  - Mega Limited)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Studio Platinum 12.0 (64-bit) (HKLM\...\{5375FD61-C0E9-11E1-9297-F04DA23A5C58}) (Version: 12.0.334 - Sony)
Mozilla Firefox 33.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0.1 (x86 de)) (Version: 33.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
Music Manager (HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\MusicManager) (Version:  - Google, Inc.)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.49.8 - Black Tree Gaming)
NVIDIA 3D Vision Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.75 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.4 - NVIDIA Corporation)
NVIDIA Grafiktreiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.75 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Opera Stable 26.0.1656.32 (HKLM-x32\...\Opera 26.0.1656.32) (Version: 26.0.1656.32 - Opera Software ASA)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
pCon.planner 6.7 (HKLM-x32\...\pCon.planner 6.7) (Version: 6.7.0.102 - EasternGraphics)
pCon.planner 6.7 (x32 Version: 6.7.0.102 - EasternGraphics) Hidden
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.4.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.309.0 - Tracker Software Products Ltd)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PoiZone (HKLM-x32\...\PoiZone) (Version:  - Image-Line bvba)
PSP VintageWarmer2 2.3.1 32bit (HKLM-x32\...\PSP VintageWarmer2 2.3.1 32bit) (Version: 2.3.1 32bit - PSPaudioware.com)
ReValver Mk III (HKLM-x32\...\ReValver Mk III_is1) (Version:  - )
Revo Uninstaller Pro 3.0.8 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.0.8 - VS Revo Group, Ltd.)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.) Hidden
SHIELD Streaming (Version: 3.1.2000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.65 - NVIDIA Corporation) Hidden
Superior Drummer Installer (HKLM-x32\...\{009AC76E-1A66-4682-82B7-417E77F3C648}) (Version: 2.0.0 - Toontrack)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Toontrack solo (HKLM-x32\...\{5866520C-8857-4986-833A-039F4584C3F7}) (Version: 1.1.1 - Toontrack)
Total Commander Ultima Prime 5.3.0.0 (HKLM-x32\...\TC UP) (Version: 5.3.0.0 - ULTIMA PRIME)
Toxic Biohazard (HKLM-x32\...\Toxic Biohazard) (Version:  - Image-Line bvba)
TV Movie ClickFinder (HKLM-x32\...\{A1A2ACDC-0C22-4EB1-B958-1898A93DAF28}) (Version: 1.00.0000 - TV Movie)
VisiPics V1.31 (HKLM-x32\...\VisiPics_is1) (Version:  - Ozone)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
XnConvert 1.63 (HKLM\...\XnConvert_is1) (Version: 1.63 - Gougelet Pierre-e)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Hempf\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Hempf\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2103675106-285616780-2124652750-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

03-12-2014 07:16:20 Windows Update
03-12-2014 07:16:45 Windows Update
03-12-2014 15:49:00 Installed Samsung Kies
04-12-2014 08:19:11 Revo Uninstaller Pro's restore point - Samsung Kies
04-12-2014 08:19:43 Removed Samsung Kies
04-12-2014 08:37:37 Revo Uninstaller Pro's restore point - BuyNsave
04-12-2014 08:38:06 Revo Uninstaller Pro's restore point - Driver Pro v3.2.0.2
04-12-2014 08:38:42 Revo Uninstaller Pro's restore point - EZDownloader
04-12-2014 08:39:05 Revo Uninstaller Pro's restore point - LiveSupport
04-12-2014 08:39:35 Revo Uninstaller Pro's restore point - MediaDownloader
04-12-2014 08:40:04 Revo Uninstaller Pro's restore point - Optimizer Pro v3.2
04-12-2014 08:40:28 Revo Uninstaller Pro's restore point - OptOn
04-12-2014 08:40:54 Revo Uninstaller Pro's restore point - Saving Flash
04-12-2014 08:41:16 Revo Uninstaller Pro's restore point - Search Protect
04-12-2014 08:41:53 Revo Uninstaller Pro's restore point - YoutubeAdBlocke
04-12-2014 12:28:42 Revo Uninstaller Pro's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028
05-12-2014 09:25:25 Revo Uninstaller Pro's restore point - ESET Online Scanner v3
05-12-2014 09:25:53 Revo Uninstaller Pro's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028
05-12-2014 09:26:18 Revo Uninstaller Pro's restore point - Spybot - Search & Destroy

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0F78508E-148D-410C-8C71-8BE536F6E9B6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000Core => C:\Users\Hempf\AppData\Local\Google\Update\GoogleUpdate.exe [2014-08-08] (Google Inc.)
Task: {374F42FF-31D7-4AEF-A609-547B43934796} - System32\Tasks\Opera scheduled Autoupdate 1388875703 => C:\Program Files (x86)\Opera\launcher.exe [2014-11-25] (Opera Software)
Task: {3CD2FB34-83EC-4F52-9B83-97F0FD676136} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {3E199CE5-521B-4FD6-A0F9-CD84F480201E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000UA => C:\Users\Hempf\AppData\Local\Google\Update\GoogleUpdate.exe [2014-08-08] (Google Inc.)
Task: {5021A146-CE6F-47FC-895A-03270C1D11E1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {7076C709-19D9-4EE2-84F5-809D4E9771F7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)
Task: {91DC6159-37A4-4CCE-AE8C-64665743B543} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-25] (Google Inc.)
Task: {A14BA82B-942C-44ED-9CEE-165C40E4E280} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {B310F15D-0772-408F-B0C8-7300D9708132} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-13] (AVAST Software)
Task: {BF28DAFF-D7B4-4DA6-96A1-676900F6D26E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-25] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000Core.job => C:\Users\Hempf\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000UA.job => C:\Users\Hempf\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-12-25 17:17 - 2014-11-12 22:56 - 00118080 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-01 15:13 - 2014-05-01 15:13 - 00470016 _____ () C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX64.dll
2008-12-20 03:20 - 2014-03-04 16:06 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2008-12-20 03:20 - 2014-03-04 16:06 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-04-19 16:22 - 2014-03-04 16:06 - 01516592 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2014-03-04 16:06 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2014-11-26 19:53 - 2014-11-25 06:48 - 01408328 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\libglesv2.dll
2014-11-26 19:53 - 2014-11-25 06:48 - 00204616 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\libegl.dll
2014-11-26 19:53 - 2014-11-25 06:48 - 10689352 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\pdf.dll
2014-11-26 19:53 - 2014-11-25 06:48 - 01856840 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\ffmpegsumo.dll
2014-11-26 19:53 - 2014-11-25 06:48 - 26722120 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll
2014-07-13 15:10 - 2014-07-13 15:10 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-12-04 22:39 - 2014-12-04 22:39 - 02905088 _____ () C:\Program Files\AVAST Software\Avast\defs\14120401\algo.dll
2014-09-03 20:15 - 2014-09-03 20:15 - 10683392 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\QtWebKit4.dll
2014-09-03 20:15 - 2014-09-03 20:15 - 07741952 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\QtGui4.dll
2014-09-03 20:15 - 2014-09-03 20:15 - 02248192 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\QtCore4.dll
2014-09-03 20:15 - 2014-09-03 20:15 - 01681408 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\QtNetwork4.dll
2014-11-13 19:57 - 2014-11-13 19:57 - 00117248 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\libaacdec.dll
2014-11-13 19:57 - 2014-11-13 19:57 - 00231936 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\libmpgdec.dll
2014-11-13 19:57 - 2014-11-13 19:57 - 00253440 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\libid3tag.dll
2014-11-13 19:57 - 2014-11-13 19:57 - 00344064 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\libaudioenc.dll
2014-09-03 20:15 - 2014-09-03 20:15 - 00026624 _____ () C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\imageformats\qgif4.dll
2014-12-05 10:24 - 2014-12-05 10:24 - 00043008 _____ () c:\users\hempf\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0ksjkn.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Hempf\AppData\Roaming\Dropbox\bin\libcef.dll
2014-07-13 15:10 - 2014-07-13 15:10 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-05-13 23:57 - 2005-06-24 18:05 - 00045056 _____ () C:\Program Files (x86)\Lenovo\EnergyCut\HookLib.dll
2014-12-05 10:24 - 2014-12-05 10:24 - 00098816 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32api.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00110080 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\pywintypes27.dll
2014-12-05 10:24 - 2014-12-05 10:24 - 00364544 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\pythoncom27.dll
2014-12-05 10:24 - 2014-12-05 10:24 - 00045568 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\_socket.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 01160704 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\_ssl.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00320512 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32com.shell.shell.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00713216 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\_hashlib.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 01175040 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\wx._core_.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00805888 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\wx._gdi_.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00811008 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\wx._windows_.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 01062400 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\wx._controls_.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00735232 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\wx._misc_.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00128512 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\_elementtree.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00127488 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\pyexpat.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00557056 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\pysqlite2._sqlite.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00087552 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\_ctypes.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00119808 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32file.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00108544 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32security.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00007168 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\hashobjs_ext.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00167936 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32gui.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00018432 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32event.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00038912 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32inet.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00011264 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32crypt.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00070656 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\wx._html2.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00027136 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\_multiprocessing.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00035840 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32process.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00686080 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\unicodedata.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00122368 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\wx._wizard.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00024064 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32pipe.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00025600 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32pdh.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00525640 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\windows._lib_cacheinvalidation.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00010240 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\select.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00017408 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32profile.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00022528 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\win32ts.pyd
2014-12-05 10:24 - 2014-12-05 10:24 - 00078336 _____ () C:\Users\Hempf\AppData\Local\Temp\_MEI25682\wx._animate.pyd

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: gusvc => 3
MSCONFIG\Services: IAStorDataMgrSvc => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: Samsung Link Service => 2
MSCONFIG\Services: SDScannerService => 2
MSCONFIG\Services: SDUpdateService => 2
MSCONFIG\Services: SDWSCService => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kalender1.lnk => C:\Windows\pss\Kalender1.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Hempf^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Hempf^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk => C:\Windows\pss\EvernoteClipper.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Hempf^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteTray.lnk => C:\Windows\pss\EvernoteTray.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Hempf^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MEGAsync.lnk => C:\Windows\pss\MEGAsync.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Creative Cloud => "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCEPServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: Google Update => "C:\Users\Hempf\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
MSCONFIG\startupreg: IJNetworkScannerSelectorEX => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: MusicManager => "C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\MusicManager.exe"
MSCONFIG\startupreg: Nvtmru => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: Samsung Link => "C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe"
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-2103675106-285616780-2124652750-500 - Administrator - Disabled)
Gast (S-1-5-21-2103675106-285616780-2124652750-501 - Limited - Disabled)
Hempf (S-1-5-21-2103675106-285616780-2124652750-1000 - Administrator - Enabled) => C:\Users\Hempf

==================== Faulty Device Manager Devices =============

Name: Lenovo EasyCamera
Description: USB-Videogerät
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Microsoft
Service: usbvideo
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/05/2014 10:25:25 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {7edf1207-b653-4a7e-ad9a-f61442f689ac}

Error: (12/05/2014 10:24:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/05/2014 10:21:29 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/05/2014 07:26:51 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (12/05/2014 10:24:38 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
VD_FileDisk

Error: (12/05/2014 10:12:24 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Stereoscopic 3D Driver Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/05/2014 08:02:32 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (12/05/2014 10:25:25 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {7edf1207-b653-4a7e-ad9a-f61442f689ac}

Error: (12/05/2014 10:24:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/05/2014 10:21:29 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Hempf\Downloads\esetsmartinstaller_enu.exe

Error: (12/05/2014 07:26:51 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Hempf\Downloads\esetsmartinstaller_enu.exe


CodeIntegrity Errors:
===================================
  Date: 2014-12-05 10:24:28.947
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-05 10:24:28.916
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-05 00:05:20.119
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-05 00:05:20.072
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-04 09:54:29.963
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-04 09:54:29.932
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-03 17:14:19.869
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-03 17:14:19.838
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-03 12:27:22.932
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-03 12:27:22.900
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vd_filedisk.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz
Percentage of memory in use: 48%
Total physical RAM: 8142.36 MB
Available physical RAM: 4210.63 MB
Total Pagefile: 16282.9 MB
Available Pagefile: 11820.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.37 GB) (Free:47.66 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.51 GB) (Free:242.6 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 59708F25)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E8457BFC)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

defogger_disable

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:41 on 05/12/2014 (Hempf)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

AdwCleaner

# AdwCleaner v4.104 - Bericht erstellt am 05/12/2014 um 10:24:07
# Aktualisiert 05/12/2014 von Xplode
# Database : 2014-12-03.1 [Live]
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Hempf - HEMPF-PC
# Gestartet von : C:\Users\Hempf\Downloads\adwcleaner_4.104.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gelöscht : C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gelöscht : C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journal

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17420


-\\ Mozilla Firefox v33.0.1 (x86 de)

[lwh52p3k.default\prefs.js] - Zeile gelöscht : user_pref("extensions.Vk4Qiv2OfD2BuNAr.scode", "try{(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1url.indexOf(\"warnalert11.com\")>-1url.index[...]
[lwh52p3k.default\prefs.js] - Zeile gelöscht : user_pref("extensions.oPPbFRiG8kekvztT.scode", "try{(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1url.indexOf(\"warnalert11.com\")>-1url.index[...]

-\\ Google Chrome v39.0.2171.71

[C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : nknonnojlmhnmjhpeokdbeineeajcemh
[C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Homepage] : hxxp://www.trovi.com/?gd=&ctid=CT3325580&octid=EB_ORIGINAL_CTID&ISID=M568C5B01-63C5-43D0-908D-9B0F3DAB8A37&SearchSource=55&CUI=&UM=2&UP=SP52F30835-8A82-4530-8514-066F3CFE4E24&SSPV=
[C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Homepage] : hxxp://www.trovi.com/?gd=&ctid=CT3325580&octid=EB_ORIGINAL_CTID&ISID=M568C5B01-63C5-43D0-908D-9B0F3DAB8A37&SearchSource=55&CUI=&UM=2&UP=SP52F30835-8A82-4530-8514-066F3CFE4E24&SSPV=

-\\ Opera v26.0.1656.32


*************************

AdwCleaner[R0].txt - [3338 octets] - [24/11/2014 14:53:20]
AdwCleaner[R1].txt - [4773 octets] - [24/11/2014 14:58:33]
AdwCleaner[R2].txt - [4242 octets] - [30/11/2014 11:11:04]
AdwCleaner[R3].txt - [5314 octets] - [04/12/2014 09:52:49]
AdwCleaner[R4].txt - [1965 octets] - [05/12/2014 00:02:38]
AdwCleaner[R5].txt - [3257 octets] - [05/12/2014 10:22:04]
AdwCleaner[S0].txt - [6910 octets] - [24/11/2014 15:01:33]
AdwCleaner[S1].txt - [5418 octets] - [30/11/2014 11:13:30]
AdwCleaner[S2].txt - [5382 octets] - [04/12/2014 09:54:06]
AdwCleaner[S3].txt - [2026 octets] - [05/12/2014 00:04:51]
AdwCleaner[S4].txt - [3048 octets] - [05/12/2014 10:24:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [3108 octets] ##########
         

sc-cleaner

Shortcut Cleaner 1.3.4 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Shortcut Cleaner can be found at this link:
 hxxp://www.bleepingcomputer.com/download/shortcut-cleaner/

Windows Version: Windows 7 Professional Service Pack 1
Program started at: 12/05/2014 07:23:37 AM.

Scanning for registry hijacks:

 * No issues found in the Registry.

Searching for Hijacked Shortcuts:

Searching C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\

Searching C:\ProgramData\Microsoft\Windows\Start Menu\

Searching C:\Users\Hempf\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\

Searching C:\Users\Public\Desktop\

Searching C:\Users\Hempf\Desktop


0 bad shortcuts found.

Program finished at: 12/05/2014 07:23:38 AM
Execution time: 0 hours(s), 0 minute(s), and 0 seconds(s)
         

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Professional x64
Ran by Hempf on 05.12.2014 at  7:17:53,86
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\Windows\wininit.ini"



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"



~~~ FireFox

Successfully deleted the following from C:\Users\Hempf\AppData\Roaming\mozilla\firefox\profiles\lwh52p3k.default\prefs.js

user_pref("extensions.Vk4Qiv2OfD2BuNAr.scode", "try{(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnale
user_pref("extensions.Vk4Qiv2OfD2BuNAr.url", "hxxp://json-jpi.info/sync2/?q=hfZ9ofV9CShEAen0rTa9pjkMg708BNmGWj8wmihGheDUojw9rjsEqda5rHaHrchIC7n0rjnFrTa8rdgFrjaGtNhVCT94tMVKhd9
user_pref("extensions.oPPbFRiG8kekvztT.scode", "try{(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnale
user_pref("extensions.oPPbFRiG8kekvztT.url", "hxxp://bloggerpixieusa.info/sync2/?q=hfZ9ofV9CShEAen0rTa9pjkMg708BNmGWj8wmihGheDUojw9rjsEqda5rHa9rGhIC7n0rjnFrTa8rdgFrjaGtNhVCT94



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.12.2014 at  7:20:34,78
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Malwarebytes

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 04.12.2014
Scan Time: 09:46:51
Logfile: malwarebytes log.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2014.12.04.03
Rootkit Database: v2014.12.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Hempf

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 322665
Time Elapsed: 4 min, 2 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 9
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-2103675106-285616780-2124652750-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, , [e1f2411d5e1e5fd7cddd6d59a45e36ca], 
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{e7ac8156-84eb-451c-a441-9f2d567d2cf4}, , [4e85e777ef8dd56116addae7dd2420e0], 
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\CLSID\{E7AC8156-84EB-451C-A441-9F2D567D2CF4}, , [4e85e777ef8dd56116addae7dd2420e0], 
PUP.Optional.MultiPlug, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{E7AC8156-84EB-451C-A441-9F2D567D2CF4}, , [4e85e777ef8dd56116addae7dd2420e0], 
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{E7AC8156-84EB-451C-A441-9F2D567D2CF4}, , [4e85e777ef8dd56116addae7dd2420e0], 
PUP.Optional.FastSearchings, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, , [15befd616319de58ed9e2f8d1fe54db3], 
PUP.Optional.WhiteSmoke.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WhiteSmoke_US Toolbar, , [e0f3de80abd10a2c75e1afa8d72c6c94], 
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4820778D-AB0D-6D18-C316-52A6A0E1D507}, , [3f94a3bb700c5cda5d4d86cd7e85b749], 
PUP.Optional.WebSearchInfo, HKU\S-1-5-21-2103675106-285616780-2124652750-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, , [3d965c026e0e171fd74ed8d135cf41bf], 

Registry Values: 1
PUP.Optional.WebSearchInfo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, , [6c67ce90b7c5e15540879b23a26229d7]

Registry Data: 2
PUP.Optional.SearchMania.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://websearch.searchmania.info/?pid=20495&r=2014/12/04&hid=7908804956511713436&lg=EN&cc=DE&unqvl=70, Good: (www.google.com), Bad: (hxxp://websearch.searchmania.info/?pid=20495&r=2014/12/04&hid=7908804956511713436&lg=EN&cc=DE&unqvl=70),,[409395c9c0bc8bab3bcf66ee08fdf40c]
PUP.Optional.Trovi.A, HKU\S-1-5-21-2103675106-285616780-2124652750-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.trovi.com/?gd=&ctid=CT3325580&octid=EB_ORIGINAL_CTID&ISID=M568C5B01-63C5-43D0-908D-9B0F3DAB8A37&SearchSource=55&CUI=&UM=2&UP=SP52F30835-8A82-4530-8514-066F3CFE4E24&SSPV=, Good: (www.google.com), Bad: (hxxp://www.trovi.com/?gd=&ctid=CT3325580&octid=EB_ORIGINAL_CTID&ISID=M568C5B01-63C5-43D0-908D-9B0F3DAB8A37&SearchSource=55&CUI=&UM=2&UP=SP52F30835-8A82-4530-8514-066F3CFE4E24&SSPV=),,[d201e7776913e84e5c1dd085f114956b]

Folders: 1
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\YoutubeAdBlocke, , [3b98114dc2baa98dd17b0b21bd46a858], 

Files: 30
PUP.Optional.MultiPlug, C:\Program Files (x86)\YoutubeAdBlocke\38f3lzVVob4n1O.dll, , [4e85e777ef8dd56116addae7dd2420e0], 
PUP.Optional.MultiPlug, C:\Program Files (x86)\YoutubeAdBlocke\38f3lzVVob4n1O.x64.dll, , [4e85e777ef8dd56116addae7dd2420e0], 
PUP.Optional.MultiPlug, C:\$Recycle.Bin\S-1-5-21-2103675106-285616780-2124652750-1000\$R5GWNKB\c6y3jKfyPimITN.dll, , [755eb4aaa6d6092d15aea021c23f07f9], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\verifier.exe, , [6073e7772854de58ec0e6dd537c923dd], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\nsaE852.exe, , [3c97302e67151125ae0b910db0512cd4], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\nsb67C3.exe, , [7e55c896aad20a2c4871841a659cbf41], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\nsb6FB0.exe, , [e1f2bf9f63192c0ae8d1a2fcb150d32d], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\nsr370D.exe, , [7c576df1fe7e69cd8930f9a53ac714ec], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\nsr3C3C.exe, , [8e451a4468146fc7dfdaf9a5996821df], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\nsr416B.exe, , [795a045aa1db2610ad0c405efd04f40c], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\nsr7711.exe, , [864dafaf780412245168bee047bacb35], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\dlLogic.exe, , [2da65a045d1ff3435d9cf74b3fc1e719], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\dltr.exe, , [dbf8500e621ad066b941093940c08a76], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\GCVerifier.dll, , [0dc670eed9a30c2ace2aa79b6e92ec14], 
PUP.Optional.LiveSupport, C:\Users\Hempf\AppData\Local\Temp\LiveSupport_setup.exe, , [f4df1549017b3303407da1287a87c63a], 
PUP.Optional.EZDownloader.A, C:\Users\Hempf\AppData\Local\Temp\55df5653363e\temp\EzDownloader_setup.exe, , [696a1648df9d290dc61a938c3fc149b7], 
PUP.Optional.MultiPlug.A, C:\Users\Hempf\AppData\Local\Temp\55df5653363e\temp\hpds_setup.exe, , [e5ee7ce20e6eb680ff77b04f5fa2c53b], 
PUP.Optional.EZDownloader.A, C:\Users\Hempf\AppData\Local\Temp\7DD81daA1\temp\EzDownloader_setup.exe, , [b2214c12c3b992a4459bea35bc441fe1], 
PUP.Optional.Conduit.A, C:\Users\Hempf\AppData\Local\Temp\83E82D233B86\temp\embededstub.exe, , [cf0409551a6205318574f84af60a2cd4], 
PUP.Optional.EZDownloader.A, C:\Users\Hempf\AppData\Local\Temp\83E82D233B86\temp\EzDownloader_setup.exe, , [844f243a84f8d85ea7399887cf311ae6], 
Trojan.Downloader, C:\Users\Hempf\AppData\Local\Temp\83E82D233B86\temp\usetup.exe, , [d300283635478da95428605f1de5ff01], 
PUP.Optional.SearchProtect.A, C:\Users\Hempf\AppData\Local\Temp\~nsu.tmp\Au_.exe, , [e0f36fef8eeed4628650990fd72af50b], 
PUP.Optional.Trovi.A, C:\Users\Hempf\AppData\Roaming\Mozilla\Firefox\Profiles\lwh52p3k.default\searchplugins\trovi-search.xml, , [e3f0520c0973ec4a2c009ad354af6d93], 
PUP.Optional.WebSearch.A, C:\Users\Hempf\AppData\Roaming\Mozilla\Firefox\Profiles\lwh52p3k.default\searchplugins\WebSearch.xml, , [567d4717423a5ed8a38fde9d01026f91], 
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\YoutubeAdBlocke\38f3lzVVob4n1O.dat, , [3b98114dc2baa98dd17b0b21bd46a858], 
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\YoutubeAdBlocke\38f3lzVVob4n1O.exe, , [3b98114dc2baa98dd17b0b21bd46a858], 
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\YoutubeAdBlocke\38f3lzVVob4n1O.tlb, , [3b98114dc2baa98dd17b0b21bd46a858], 
PUP.Optional.Trovi.A, C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: (   "homepage": "hxxp://www.trovi.com/?gd=&ctid=CT3325580&octid=EB_ORIGINAL_CTID&ISID=M568C5B01-63C5-43D0-908D-9B0F3DAB8A37&SearchSource=55&CUI=&UM=2&UP=SP52F30835-8A82-4530-8514-066F3CFE4E24&SSPV=",), ,[785b97c7126af343793fdbbcb055ee12]
PUP.Optional.Trovi, C:\Users\Hempf\AppData\Roaming\Mozilla\Firefox\Profiles\lwh52p3k.default\prefs.js, Good: (), Bad: (user_pref("browser.search.selectedEngine", "Trovi search");), ,[d7fc9fbf9ede60d623046334c243dc24]
PUP.Optional.Trovi.A, C:\Users\Hempf\AppData\Roaming\Mozilla\Firefox\Profiles\lwh52p3k.default\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "hxxp://www.trovi.com/?gd=&ctid=CT3325580&octid=EB_ORIGINAL_CTID&ISID=M568C5B01-63C5-43D0-908D-9B0F3DAB8A37&SearchSource=55&CUI=&UM=2&UP=SP52F30835-8A82-4530-8514-066F3CFE4E24&SSPV=");), ,[458e2d31fe7e92a43084b4e3bc4907f9]

Physical Sectors: 0
(No malicious items detected)


(end)
         

und als Anhang noch die txt file von Gemer

Edit:

Was mir gerade noch auf bzw. eingefallen ist... Sämtliche andere Erweiterungen in Chrome lassen sich nicht mehr aktivieren (Adblock, Avast,...).
Und ich bin mir gerade überhaupt nicht sicher, ob das vorher schon da war... Links neben dem minimieren Fenster ist bei mir eine Schaltfläche bei der ich mich oder einen anderen Nutzer in Chrome anmelden kann. War die vorher auch schon da, oder ist die jetzt auch neu dazu gekommen? Wirkt eigentlich recht seriös...

hi,

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de


frisches FRST log bitte.

Hab ich


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-12-2014
Ran by Hempf (administrator) on HEMPF-PC on 05-12-2014 15:41:03
Running from C:\Users\Hempf\Downloads
Loaded Profile: Hempf (Available profiles: Hempf)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(E.W.E.-Software) C:\Users\Hempf\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvtip.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Line 6, Inc.) C:\Program Files (x86)\Line6\POD Farm 2\POD Farm 2.exe
(Adobe Systems®, Incorporated) C:\Program Files (x86)\Adobe\Adobe Audition 3.0\Audition.exe
(Arobas Music) C:\Program Files (x86)\Guitar Pro 5\GP5.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Hempf\Downloads\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2464072 2014-11-06] (NVIDIA Corporation)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6202416 2014-03-04] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2014-03-04] (Lenovo (Beijing) Limited)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-31] (AVAST Software)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-11-10] (Intel Corporation)
HKLM-x32\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe [1581056 2007-04-27] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [EnergyCut] => C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe [1167360 2007-03-09] (Lenovo (Beijing) Limited)
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Run: [TVTip] => C:\Users\Hempf\AppData\Roaming\TV Movie\TV Movie Clickfinder\tvstart.exe [102400 2010-05-31] (E.W.E.-Software)
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22869088 2014-10-21] (Google)
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\...\Run: [MusicManager] => C:\Users\Hempf\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7475200 2014-11-13] (Google Inc.)
Startup: C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Hempf\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX64.dll ()
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX64.dll ()
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX64.dll ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX32.dll ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX32.dll ()
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Hempf\AppData\Local\MEGAsync\ShellExtX32.dll ()
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2103675106-285616780-2124652750-1000\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE7317F878401CF01
HKU\S-1-5-21-2103675106-285616780-2124652750-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKU\S-1-5-21-2103675106-285616780-2124652750-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Hempf\AppData\Roaming\Mozilla\Firefox\Profiles\lwh52p3k.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll No File
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-2103675106-285616780-2124652750-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-2103675106-285616780-2124652750-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Hempf\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-2103675106-285616780-2124652750-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Hempf\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-2103675106-285616780-2124652750-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-25]
FF Extension: No Name - wrc@avast.com [Not Found]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3325580&octid=EB_ORIGINAL_CTID&ISID=M568C5B01-63C5-43D0-908D-9B0F3DAB8A37&SearchSource=55&CUI=&UM=2&UP=SP52F30835-8A82-4530-8514-066F3CFE4E24&SSPV=
CHR StartupUrls: Default -> "https://www.google.de/"
CHR Profile: C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-05]
CHR Extension: (Angry Birds) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2014-12-05]
CHR Extension: (Google Drive) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-05]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-05]
CHR Extension: (YouTube) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-05]
CHR Extension: (Auf den Amazon-Wunschzettel) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced [2014-12-05]
CHR Extension: (Google-Suche) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-05]
CHR Extension: (Video Downloader professional) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2014-12-05]
CHR Extension: (Google Tabellen) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-05]
CHR Extension: (Google Maps) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2014-12-05]
CHR Extension: (dict-cc) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nknonnojlmhnmjhpeokdbeineeajcemh [2014-12-05]
CHR Extension: (Google Wallet) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-05]
CHR Extension: (Picasa) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb [2014-12-05]
CHR Extension: (Google Mail) - C:\Users\Hempf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-05]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-13] (AVAST Software)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-11-06] (NVIDIA Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-11-06] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19819848 2014-11-06] (NVIDIA Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-13] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-22] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-13] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-13] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-26] (Disc Soft Ltd)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104048 2012-03-02] (Qualcomm Atheros Co., Ltd.)
R3 L6UX1; C:\Windows\System32\Drivers\L6UX164.sys [772864 2013-07-11] (Line 6)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2014-11-06] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation)
S3 rpkmdrv; C:\Windows\System32\drivers\rpkmdrv.sys [21248 2012-08-16] () [File not signed]
S1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [23552 2009-10-25] (Flint Incorporation) [File not signed]
U3 kgloipoc; \??\C:\Users\Hempf\AppData\Local\Temp\kgloipoc.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-05 15:40 - 2014-12-05 15:40 - 02117632 _____ (Farbar) C:\Users\Hempf\Downloads\FRST64 (1).exe
2014-12-05 15:36 - 2014-12-05 15:36 - 00002247 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-05 15:36 - 2014-12-05 15:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-12-05 15:34 - 2014-12-05 15:34 - 00880784 _____ (Google Inc.) C:\Users\Hempf\Downloads\ChromeSetup.exe
2014-12-05 15:31 - 2014-12-05 15:31 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-12-05 11:20 - 2014-12-05 11:20 - 00012149 _____ () C:\Users\Hempf\Desktop\Gmer.rar
2014-12-05 10:43 - 2014-12-05 10:43 - 00380416 _____ () C:\Users\Hempf\Downloads\Gmer-19357.exe
2014-12-05 10:42 - 2014-12-05 15:41 - 00018348 _____ () C:\Users\Hempf\Downloads\FRST.txt
2014-12-05 10:42 - 2014-12-05 10:42 - 02117632 _____ (Farbar) C:\Users\Hempf\Downloads\FRST64.exe
2014-12-05 10:42 - 2014-12-05 10:42 - 00042295 _____ () C:\Users\Hempf\Downloads\Addition.txt
2014-12-05 10:41 - 2014-12-05 10:41 - 00050477 _____ () C:\Users\Hempf\Downloads\Defogger.exe
2014-12-05 10:41 - 2014-12-05 10:41 - 00000000 _____ () C:\Users\Hempf\defogger_reenable
2014-12-05 10:27 - 2014-12-05 10:27 - 02153472 _____ () C:\Users\Hempf\Downloads\adwcleaner_4.104 (1).exe
2014-12-05 10:26 - 2014-12-05 10:26 - 00000085 _____ () C:\Windows\wininit.ini
2014-12-05 10:22 - 2014-12-05 10:22 - 00000055 _____ () C:\AdwCleanerDebug.txt
2014-12-05 10:21 - 2014-12-05 10:21 - 02153472 _____ () C:\Users\Hempf\Downloads\adwcleaner_4.104.exe
2014-12-05 10:12 - 2014-12-05 10:12 - 00259584 _____ (OldTimer Tools) C:\Users\Hempf\Downloads\OTH.scr
2014-12-05 07:59 - 2014-12-05 07:59 - 00069169 _____ () C:\Users\Hempf\Downloads\Children Of Bodom - Lobodomy (Pro).gp4
2014-12-05 07:26 - 2014-12-05 10:25 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-12-05 07:25 - 2014-12-05 07:25 - 02347384 _____ (ESET) C:\Users\Hempf\Downloads\esetsmartinstaller_enu.exe
2014-12-05 07:23 - 2014-12-05 07:23 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\Hempf\Downloads\sc-cleaner.exe
2014-12-05 07:23 - 2014-12-05 07:23 - 00001796 _____ () C:\sc-cleaner.txt
2014-12-05 07:17 - 2014-12-05 07:17 - 01707646 _____ (Thisisu) C:\Users\Hempf\Downloads\JRT.exe
2014-12-05 07:17 - 2014-12-05 07:17 - 00000000 ____D () C:\Windows\ERUNT
2014-12-05 07:07 - 2014-12-05 10:26 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-05 06:48 - 2014-12-05 06:48 - 00356105 _____ () C:\Users\Hempf\Downloads\libgnustl_shared.so.zip
2014-12-04 17:56 - 2014-12-04 17:56 - 00057950 _____ () C:\Users\Hempf\Downloads\schrank.skp
2014-12-04 17:53 - 2014-12-04 17:53 - 00225481 _____ () C:\Users\Hempf\Downloads\KARE_75281_Latino_Wardrobe_(Latino_Kleiderschrank).skp
2014-12-04 17:45 - 2014-12-04 17:45 - 00260895 _____ () C:\Users\Hempf\Downloads\SLOT_LOWBOARD_114_CKID_3D_SW.skp
2014-12-04 17:45 - 2014-12-04 17:45 - 00177251 _____ () C:\Users\Hempf\Downloads\LACK_Shelf_Wheels_2.skp
2014-12-04 17:31 - 2014-12-04 17:31 - 00116014 _____ () C:\Users\Hempf\Downloads\Untitled 2.skp
2014-12-04 17:25 - 2014-12-04 17:25 - 00919608 _____ () C:\Users\Hempf\Downloads\tv.skp
2014-12-04 17:18 - 2014-12-04 17:19 - 05728996 _____ () C:\Users\Hempf\Downloads\Untitled.skp
2014-12-04 17:08 - 2014-12-04 17:08 - 00443650 _____ () C:\Users\Hempf\Downloads\deskplan.skp
2014-12-04 09:45 - 2014-12-04 09:45 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Hempf\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-04 09:32 - 2014-12-04 09:32 - 00000000 ____D () C:\ProgramData\ipcbdebpmfkngepkfafbennlfdoogigb
2014-12-04 09:30 - 2014-12-04 09:30 - 00000000 ____D () C:\ProgramData\lbocnocddiibbijgnnblellnmfghcmbb
2014-12-04 09:30 - 2014-12-04 09:30 - 00000000 ____D () C:\Program Files (x86)\Chrome Web Store Launcher
2014-12-04 09:29 - 2014-12-04 09:29 - 00000000 ____D () C:\ProgramData\npmfehnpganhapkhgegjpfdfebbdpgfd
2014-12-04 09:21 - 2014-12-04 09:24 - 00001969 _____ () C:\Users\Public\Desktop\Samsung Kies 3.lnk
2014-12-04 09:21 - 2014-12-04 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-12-04 09:20 - 2014-12-04 09:21 - 41860496 _____ (Samsung Electronics Co., Ltd.) C:\Users\Hempf\Downloads\Kies3Setup17.exe
2014-12-04 06:16 - 2014-12-04 06:16 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2014-12-03 19:13 - 2014-12-03 19:15 - 00000000 ____D () C:\Users\Hempf\Desktop\Root b2
2014-12-03 16:50 - 2014-06-16 07:01 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01007.dll
2014-12-03 16:50 - 2014-06-16 07:01 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller.dll
2014-12-03 16:46 - 2014-12-03 16:48 - 70892872 _____ (Samsung Electronics Co., Ltd.) C:\Users\Hempf\Downloads\KiesSetup74.exe
2014-12-01 12:43 - 2014-12-01 12:43 - 00013659 _____ () C:\Users\Hempf\Downloads\05 Relentless Reckless Forever.gp4
2014-11-30 11:20 - 2014-11-30 11:21 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Hempf\Downloads\spybot-2.4.exe
2014-11-30 11:19 - 2014-11-30 11:20 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Hempf\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-29 22:23 - 2014-11-29 22:23 - 00000000 ____D () C:\Users\Hempf\Documents\My Cheat Tables
2014-11-26 13:36 - 2014-11-26 13:36 - 00016618 _____ () C:\Users\Hempf\Downloads\Metal Preset by Blaine P.txt
2014-11-26 13:31 - 2014-11-26 13:31 - 00034237 _____ () C:\Users\Hempf\Downloads\Metal Foundry Preset 2.s20
2014-11-26 13:30 - 2014-11-26 13:30 - 00030931 _____ () C:\Users\Hempf\Downloads\Metal Foundry Preset 6.s20
2014-11-26 13:30 - 2014-11-26 13:30 - 00020799 _____ () C:\Users\Hempf\Downloads\Metal Machine Preset 1.s20
2014-11-26 13:29 - 2014-11-26 13:29 - 00022417 _____ () C:\Users\Hempf\Downloads\N.Y. Avatar Preset 1.s20
2014-11-26 13:26 - 2002-07-07 23:14 - 01294336 _____ (HMS hxxp://hp.vector.co.jp/authors/VA012897/) C:\Windows\SysWOW64\vorbis.acm
2014-11-26 12:33 - 2014-11-26 12:33 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\IrfanView
2014-11-26 12:33 - 2014-11-26 12:33 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-11-25 12:31 - 2014-11-25 12:31 - 00001166 _____ () C:\Users\Hempf\Desktop\FarCry4 - Verknüpfung.lnk
2014-11-25 11:20 - 2014-11-25 11:25 - 00000859 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Far Cry 4.lnk
2014-11-25 09:48 - 2014-11-25 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-11-24 14:53 - 2014-12-05 10:24 - 00000000 ____D () C:\AdwCleaner
2014-11-24 14:06 - 2014-11-24 14:06 - 00000000 __HDC () C:\ProgramData\{2E9C94ED-C152-4D5D-8E21-AAE23373844C}
2014-11-24 14:03 - 2014-11-24 14:03 - 00000000 __HDC () C:\ProgramData\{868E5822-04F1-4FBB-98CD-DC08EB82D497}
2014-11-21 06:29 - 2014-11-12 21:46 - 00615624 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-11-21 06:27 - 2014-11-13 01:20 - 31893136 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 24557712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 18514616 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 14032984 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 13944952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 13213512 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-11-21 06:27 - 2014-11-13 01:20 - 11397744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 11336432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 04292416 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 04011208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434475.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 01540424 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434475.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00964928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00935240 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00923792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00900928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00500880 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00418112 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00393024 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-11-21 06:27 - 2014-11-13 01:20 - 00348304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-11-21 06:21 - 2014-10-03 20:23 - 00038216 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-11-21 06:21 - 2014-10-03 20:23 - 00032584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-11-21 05:08 - 2014-11-21 05:08 - 00000000 __SHD () C:\Users\Hempf\AppData\Local\EmieBrowserModeList
2014-11-20 12:08 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-20 12:08 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-20 12:08 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-20 12:08 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-20 12:08 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-20 12:08 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-20 12:08 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-20 12:08 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-20 12:08 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-20 12:08 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-20 12:08 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-20 12:08 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-20 12:08 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-20 12:08 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-20 12:08 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-20 12:08 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-20 12:08 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-20 12:08 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-20 12:08 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-20 12:08 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-20 12:08 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-20 12:08 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-20 12:08 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-20 12:08 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-20 12:08 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-20 12:08 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-20 12:08 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-20 12:08 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-20 12:08 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-20 12:08 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-20 12:08 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-20 12:08 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-20 12:08 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-20 12:08 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-20 12:08 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-20 12:08 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-20 12:08 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-20 12:08 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-20 12:08 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-20 12:08 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-20 12:08 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-20 12:08 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-20 12:08 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-20 12:08 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-20 12:08 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-20 12:08 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-20 12:08 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-20 12:08 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-20 12:08 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-20 12:08 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-20 12:08 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-20 12:08 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-20 12:08 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-20 12:08 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-20 12:08 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-20 12:07 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-20 11:56 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-20 11:56 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-20 11:56 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-20 11:50 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-20 11:50 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-20 11:50 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-20 11:50 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-20 11:50 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-20 11:45 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-20 11:45 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-20 11:45 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-20 11:45 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-20 11:35 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-20 11:35 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-20 11:35 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-20 11:35 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-20 11:35 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-20 11:35 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-20 11:35 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-20 11:35 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-20 11:35 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-20 11:35 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-20 11:35 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-20 11:35 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-20 11:35 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-20 11:35 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-20 11:35 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-20 11:35 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-20 11:35 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-20 11:35 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-20 11:35 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-20 11:35 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-20 11:35 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-20 11:35 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-20 11:35 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-20 11:35 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-20 11:35 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-20 11:35 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-20 11:35 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-05 15:41 - 2014-08-27 08:09 - 00000000 ____D () C:\FRST
2014-12-05 15:36 - 2013-12-25 16:27 - 00000000 ____D () C:\Users\Hempf\AppData\Local\Google
2014-12-05 15:36 - 2013-12-25 16:27 - 00000000 ____D () C:\Program Files (x86)\Google
2014-12-05 15:29 - 2014-10-27 07:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-05 14:52 - 2014-08-08 08:05 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000UA.job
2014-12-05 13:46 - 2014-09-29 15:07 - 00023762 _____ () C:\Windows\setupact.log
2014-12-05 13:44 - 2013-12-25 18:47 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\vlc
2014-12-05 13:43 - 2011-04-12 08:43 - 00704504 _____ () C:\Windows\system32\perfh007.dat
2014-12-05 13:43 - 2011-04-12 08:43 - 00152310 _____ () C:\Windows\system32\perfc007.dat
2014-12-05 13:43 - 2009-07-14 06:13 - 01634288 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-05 10:52 - 2014-08-08 08:05 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000Core.job
2014-12-05 10:52 - 2013-12-25 16:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-05 10:51 - 2013-12-25 15:49 - 01686647 _____ () C:\Windows\WindowsUpdate.log
2014-12-05 10:46 - 2014-01-04 17:38 - 00000000 ___RD () C:\Users\Hempf\Dropbox
2014-12-05 10:41 - 2013-12-25 15:49 - 00000000 ____D () C:\Users\Hempf
2014-12-05 10:31 - 2009-07-14 05:45 - 00032864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-05 10:31 - 2009-07-14 05:45 - 00032864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-05 10:26 - 2014-01-03 10:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-05 10:24 - 2014-10-28 13:45 - 00107290 _____ () C:\Windows\PFRO.log
2014-12-05 10:24 - 2014-05-27 23:01 - 00000000 ___RD () C:\Users\Hempf\Google Drive
2014-12-05 10:24 - 2013-12-26 16:28 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Dropbox
2014-12-05 10:24 - 2013-12-25 17:17 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-05 10:24 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-05 00:10 - 2014-01-04 23:48 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-04 09:54 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-12-04 09:25 - 2014-02-27 00:30 - 00000000 ____D () C:\ProgramData\Samsung
2014-12-04 09:24 - 2014-02-27 00:36 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Samsung
2014-12-04 09:24 - 2014-02-27 00:30 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-12-04 09:21 - 2014-02-27 00:43 - 00000000 ____D () C:\Users\Hempf\Documents\SelfMV
2014-12-04 09:21 - 2014-02-10 20:11 - 00000000 ____D () C:\Users\Hempf\AppData\Local\Downloaded Installations
2014-12-04 09:21 - 2013-12-25 16:17 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-04 09:20 - 2014-02-27 00:36 - 00000000 ____D () C:\Users\Hempf\AppData\Local\Samsung
2014-12-04 06:15 - 2013-12-25 18:21 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-12-03 12:32 - 2014-06-03 17:17 - 00003852 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1388875703
2014-11-29 23:05 - 2014-02-02 23:43 - 00000000 ____D () C:\Spiele
2014-11-27 12:03 - 2013-12-26 17:44 - 00000000 ____D () C:\Users\Hempf\Documents\Movie Studio Platinum 12.0 Projekte
2014-11-26 13:26 - 2013-12-26 17:48 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2014-11-26 13:26 - 2013-12-26 17:48 - 00000000 ____D () C:\Program Files (x86)\Image-Line
2014-11-26 09:23 - 2014-10-27 07:41 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-26 09:23 - 2014-10-27 07:41 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-26 09:23 - 2014-10-27 07:41 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 11:21 - 2014-02-02 20:50 - 00000000 ____D () C:\ProgramData\Orbit
2014-11-25 10:04 - 2014-02-19 20:50 - 00000000 ____D () C:\Users\Hempf\Documents\My Games
2014-11-24 15:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Speech
2014-11-24 15:01 - 2014-02-18 17:05 - 00001061 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-24 15:01 - 2013-12-25 15:50 - 00000955 _____ () C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-24 11:12 - 2013-12-26 15:14 - 00000000 ____D () C:\Users\Hempf\Documents\Adobe
2014-11-24 11:12 - 2013-12-25 18:55 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Adobe
2014-11-22 15:52 - 2013-12-25 18:21 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-11-21 06:41 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-21 06:29 - 2013-12-25 17:17 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-11-20 18:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-11-20 17:14 - 2009-07-14 05:45 - 05027672 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-20 17:13 - 2014-05-07 05:14 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-20 13:04 - 2013-12-26 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-11-20 13:04 - 2013-12-26 16:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-20 13:02 - 2013-12-25 17:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-20 13:02 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2014-11-20 13:00 - 2013-12-25 17:20 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-20 12:23 - 2014-05-27 22:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-11-20 10:48 - 2014-08-08 08:05 - 00004090 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000UA
2014-11-20 10:47 - 2014-08-08 08:05 - 00003694 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2103675106-285616780-2124652750-1000Core
2014-11-20 10:47 - 2013-12-25 16:27 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-20 10:47 - 2013-12-25 16:27 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-20 10:47 - 2013-12-25 16:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-20 10:46 - 2014-01-04 17:37 - 00000000 ____D () C:\Users\Hempf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-11-13 01:20 - 2013-12-25 17:17 - 00074056 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-11-13 01:20 - 2013-12-25 17:17 - 00059592 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 20986592 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 19966344 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 16884632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 03262784 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 02874456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-11-13 01:20 - 2013-12-25 17:07 - 00027094 _____ () C:\Windows\system32\nvinfo.pb
2014-11-12 22:56 - 2013-12-25 17:17 - 06897352 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 03534152 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 02559808 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 00934032 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-11-12 22:56 - 2013-12-25 17:17 - 00625472 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\oemdspif.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 00386368 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-11-12 22:56 - 2013-12-25 17:17 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-11-11 11:29 - 2014-04-16 12:57 - 04100776 _____ () C:\Windows\system32\nvcoproc.bin
2014-11-06 18:06 - 2014-06-02 15:20 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-11-06 18:06 - 2014-06-02 15:20 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-11-06 18:06 - 2013-12-25 17:18 - 02800296 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-11-06 18:06 - 2013-12-25 17:18 - 02197680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

Some content of TEMP:
====================
C:\Users\Hempf\AppData\Local\Temp\c22dd91.exe
C:\Users\Hempf\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0ksjkn.dll
C:\Users\Hempf\AppData\Local\Temp\drvprosetup.exe
C:\Users\Hempf\AppData\Local\Temp\Execute2App.exe
C:\Users\Hempf\AppData\Local\Temp\msvcp90.dll
C:\Users\Hempf\AppData\Local\Temp\msvcr90.dll
C:\Users\Hempf\AppData\Local\Temp\optprosetup.exe
C:\Users\Hempf\AppData\Local\Temp\Quarantine.exe
C:\Users\Hempf\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-25 13:18

==================== End Of Log ============================
         

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
U3 kgloipoc; \??\C:\Users\Hempf\AppData\Local\Temp\kgloipoc.sys [X]
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Noch probleme?

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-12-2014 01
Ran by Hempf at 2014-12-07 08:24:58 Run:1
Running from C:\Users\Hempf\Downloads
Loaded Profile: Hempf (Available profiles: Hempf)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
U3 kgloipoc; \??\C:\Users\Hempf\AppData\Local\Temp\kgloipoc.sys [X]
Emptytemp:
*****************

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
kgloipoc => Service not found.
EmptyTemp: => Removed 835.8 MB temporary data.


The system needed a reboot. 

==== End of Fixlog ====
         

Scheint wieder alles ok zu sein!

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Du bist der Beste - alles läuft wieder. Vielen Dank!

Gern Geschehen