Hallo
Ich hab das Problem das Plötzlich diese Meldung kommt.

Und dies ist nicht gewollt.
FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-03-2015 01
Ran by ChypsoTech (administrator) on CHYPSOTECH-PC1 on 10-03-2015 20:39:24
Running from G:\Eigene Dateien\Downloads
Loaded Profiles: ChypsoTech (Available profiles: ChypsoTech)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Panda Security, S.L.) G:\Panda\PSANHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(TomTom) G:\TomTom\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe
() C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NETGEAR,Inc.) C:\Program Files (x86)\NETGEAR\A6200\A6200.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Valve Corporation) G:\Steam\Steam.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Samsung Electronics Co., Ltd.) G:\Samsung\Kies\KiesTrayAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Valve Corporation) G:\Steam\bin\steamwebhelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Valve Corporation) G:\Steam\bin\steamwebhelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\wermgr.exe
(Microsoft Corporation) C:\Windows\System32\wermgr.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [GENIE] => C:\Program Files (x86)\NETGEAR\A6200\A6200.exe [348888 2013-02-18] (NETGEAR,Inc.)
HKLM\...\Run: [LanuchApp] => C:\Program Files (x86)\NETGEAR\A6200\LanuchApp.exe [15136 2012-07-11] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295072 2012-12-26] (RealNetworks, Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => G:\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [Steam] => G:\Steam\steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [] => G:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-02-14] (Samsung)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\MountPoints2: {91c9a43c-1145-11e1-8fbf-806e6f6e6963} - D:\Setup.exe
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\MountPoints2: {d3f575a3-9264-11e2-a47f-bc5ff4092565} - F:\CMADownloader.exe
AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL => "C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL" File Not Found
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp
SearchScopes: HKLM -> {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = 
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {14B46720-510A-47D8-9427-CF9A8D86A457} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2014-03-20] (DVDVideoSoft Ltd.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2012-11-29] (RealDownloader)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2014-06-23] (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281
FF Homepage: ?type=hppp
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-03-09] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0-git -> G:\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-09] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1212152.dll [2014-05-30] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2012-02-04] (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2012-12-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-06-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-06-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2012-12-26] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2012-11-29] (RealDownloader)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: samsung.com/SamsungLinkPCPlugin -> G:\Eigene Dateien\Documents\Samsung Link\utils\npSamsungLinkPCPlugin.dll No File
FF user.js: detected! => C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\user.js [2015-03-02]
FF SearchPlugin: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\searchplugins\google-images.xml [2015-03-02]
FF SearchPlugin: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\searchplugins\google-maps.xml [2015-03-02]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-03-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-03-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2015-03-07]
FF HKLM-x32\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2012-12-26]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-06-26]

Chrome: 
=======
CHR Profile: C:\Users\ChypsoTech\AppData\Local\Google\Chrome\User Data\default
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM-x32\...\Chrome\Extension: [iomphmdalfmaifjccmagmllnicjoghhk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 cehufofi; C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp [103424 2015-03-02] () [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 NanoServiceMain; G:\Panda\PSANHost.exe [140608 2011-04-28] (Panda Security, S.L.)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 TomTomHOMEService; G:\TomTom\TomTom HOME 2\TomTomHOMEService.exe [93040 2014-06-05] (TomTom)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WNDA6200; C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe [29984 2012-09-24] ()
R2 xeqomesu; C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 A6200; C:\Windows\System32\DRIVERS\bcmwlhigh664.sys [2567984 2013-02-28] (Broadcom Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R1 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-26] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [161032 2012-01-05] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [114760 2011-04-28] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [149768 2011-11-23] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [121928 2011-04-28] (Panda Security, S.L.)
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S1 SASDIFSV; \??\G:\\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\G:\\SASKUTIL64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-10 20:39 - 2015-03-10 20:39 - 00000000 ____D () C:\FRST
2015-03-10 19:29 - 2015-03-10 19:29 - 00290320 _____ () C:\Windows\Minidump\031015-20826-01.dmp
2015-03-10 19:27 - 2015-03-10 19:27 - 00283760 _____ () C:\Windows\Minidump\031015-10654-01.dmp
2015-03-10 19:26 - 2015-03-10 19:26 - 00283376 _____ () C:\Windows\Minidump\031015-15007-01.dmp
2015-03-09 20:22 - 2015-03-09 20:22 - 00283760 _____ () C:\Windows\Minidump\030915-8970-01.dmp
2015-03-08 00:05 - 2015-03-08 00:05 - 00283760 _____ () C:\Windows\Minidump\030815-15132-01.dmp
2015-03-07 12:45 - 2015-03-07 12:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 17:17 - 2015-03-05 17:17 - 00283376 _____ () C:\Windows\Minidump\030515-9313-01.dmp
2015-03-02 23:51 - 2015-03-02 23:51 - 00283760 _____ () C:\Windows\Minidump\030215-9375-01.dmp
2015-03-02 22:35 - 2015-03-09 20:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-02 22:33 - 2015-03-02 22:33 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-02 22:33 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-02 22:33 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-02 22:33 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-02 22:32 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2015-03-02 22:32 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2015-03-02 22:20 - 2015-03-02 22:20 - 00283760 _____ () C:\Windows\Minidump\030215-13509-01.dmp
2015-03-02 20:01 - 2015-03-02 20:01 - 00283760 _____ () C:\Windows\Minidump\030215-19359-01.dmp
2015-03-02 19:40 - 2015-03-02 19:40 - 00283760 _____ () C:\Windows\Minidump\030215-8798-01.dmp
2015-03-02 19:35 - 2015-03-05 19:35 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2015-03-02 19:35 - 2015-03-03 19:35 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2015-03-02 19:35 - 2015-03-02 19:55 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2015-03-02 19:35 - 2015-03-02 19:35 - 00002838 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2015-03-02 19:35 - 2015-03-02 19:35 - 00002836 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2015-03-02 19:35 - 2015-03-02 19:35 - 00002836 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2015-03-02 19:33 - 2015-03-02 19:33 - 00613067 _____ (CMI Limited) C:\Users\ChypsoTech\AppData\Local\nsl86A7.tmp
2015-03-02 19:33 - 2015-03-02 19:33 - 00000000 __SHD () C:\Users\ChypsoTech\AppData\Roaming\AnyProtectEx
2015-03-02 19:30 - 2015-03-02 19:34 - 00000000 ____D () C:\ProgramData\2ef25f1272114645a21caf4eede15cca
2015-03-02 19:30 - 2015-03-02 19:30 - 00003184 _____ () C:\Windows\System32\Tasks\{DA6F367B-DCAF-4E59-B81E-8FA263BAEE2E}
2015-03-02 19:30 - 2015-02-24 17:05 - 00364120 _____ (Gambali OEM Software) C:\Windows\system32\Gambali64.dll
2015-03-02 19:30 - 2015-02-24 17:05 - 00318784 _____ (Gambali OEM Software) C:\Windows\SysWOW64\Gambali.dll
2015-03-02 19:29 - 2015-03-02 22:45 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-03-02 19:29 - 2015-02-24 14:51 - 00318808 _____ (OM Inc.) C:\Windows\SysWOW64\BDL.dll
2015-03-02 19:19 - 2015-03-02 19:24 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009
2015-03-02 19:07 - 2015-03-02 19:30 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009
2015-03-02 18:57 - 2015-03-02 19:42 - 00000000 ____D () C:\ProgramData\{8dbc5b3b-c216-4374-8dbc-c5b3bc216cef}
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\Opera Software
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Opera Software
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\ProgramData\8731830257723766728
2015-03-02 18:56 - 2015-03-02 18:58 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-02 17:44 - 2015-03-02 17:44 - 00283376 _____ () C:\Windows\Minidump\030215-20950-01.dmp
2015-02-27 16:42 - 2015-02-27 16:42 - 00283376 _____ () C:\Windows\Minidump\022715-8096-01.dmp
2015-02-24 19:12 - 2015-02-24 19:12 - 00283376 _____ () C:\Windows\Minidump\022415-9079-01.dmp
2015-02-21 08:14 - 2015-02-21 08:14 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Steam
2015-02-21 08:11 - 2015-02-21 08:11 - 00283376 _____ () C:\Windows\Minidump\022115-7893-01.dmp
2015-02-13 18:25 - 2015-02-13 18:25 - 00283376 _____ () C:\Windows\Minidump\021315-8377-01.dmp
2015-02-12 18:04 - 2015-02-12 18:38 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\ESS
2015-02-09 16:59 - 2015-02-09 16:59 - 00283376 _____ () C:\Windows\Minidump\020915-10062-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-10 20:39 - 2011-11-17 19:03 - 01228155 _____ () C:\Windows\WindowsUpdate.log
2015-03-10 20:04 - 2012-04-11 13:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-10 19:37 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-10 19:37 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-10 19:34 - 2011-04-12 08:43 - 14069504 _____ () C:\Windows\system32\perfh007.dat
2015-03-10 19:34 - 2011-04-12 08:43 - 04356364 _____ () C:\Windows\system32\perfc007.dat
2015-03-10 19:34 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-10 19:29 - 2012-05-03 14:35 - 00000000 ____D () C:\Windows\Minidump
2015-03-10 19:28 - 2014-05-01 14:27 - 00061609 _____ () C:\Windows\setupact.log
2015-03-10 19:28 - 2012-05-13 12:18 - 00026577 _____ () C:\Windows\SysWOW64\temp.txt
2015-03-10 19:28 - 2012-04-11 12:46 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-03-10 19:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-09 20:33 - 2014-08-21 17:31 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Adobe
2015-03-09 20:33 - 2012-04-11 13:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-09 20:33 - 2012-04-11 13:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-09 20:33 - 2011-11-17 21:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-09 19:24 - 2011-11-17 19:03 - 00000000 ____D () C:\Users\ChypsoTech
2015-03-09 19:17 - 2012-05-08 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-03-03 18:47 - 2014-04-30 16:46 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-03-03 18:47 - 2014-04-30 16:46 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-03-03 14:17 - 2010-11-21 04:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-02 23:50 - 2014-05-08 16:38 - 00036890 _____ () C:\Windows\PFRO.log
2015-03-02 22:45 - 2014-09-24 11:38 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Gameo
2015-03-02 22:23 - 2014-05-01 14:45 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2015-03-02 20:04 - 2011-11-17 21:19 - 00116872 _____ () C:\Users\ChypsoTech\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-02 20:00 - 2009-07-14 05:45 - 00424840 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-02 19:44 - 2011-11-17 19:03 - 00001427 _____ () C:\Users\ChypsoTech\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-12 18:48 - 2014-09-03 16:13 - 00002123 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-02-12 18:48 - 2014-09-03 16:13 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-02-12 18:48 - 2014-09-03 16:13 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2015-02-12 18:48 - 2014-07-05 01:41 - 00001912 _____ () C:\Windows\epplauncher.mif
2015-02-09 17:31 - 2013-10-19 08:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-09 17:30 - 2013-10-19 08:15 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-09 17:29 - 2013-10-19 08:14 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-09 17:29 - 2013-10-19 08:14 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-09 17:29 - 2013-10-19 08:14 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-09 17:29 - 2012-04-11 14:01 - 00000000 ____D () C:\Program Files (x86)\Java

==================== Files in the root of some directories =======

2012-06-08 16:31 - 2012-09-10 11:22 - 0000000 _____ () C:\Users\ChypsoTech\AppData\Roaming\FileIn.cns
2012-06-08 16:31 - 2012-09-10 11:22 - 0000000 _____ () C:\Users\ChypsoTech\AppData\Roaming\FileOut.cns
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Chords
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Morph
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Synthesizers
2013-03-09 11:51 - 2013-11-19 10:57 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Internet Services
2014-01-29 18:59 - 2014-01-29 19:00 - 0000092 _____ () C:\Users\ChypsoTech\AppData\Roaming\regsvr32.exe_log.txt
2012-05-14 17:39 - 2012-05-14 17:39 - 0008704 ___SH () C:\Users\ChypsoTech\AppData\Roaming\Thumbs.db
2012-04-11 20:37 - 2012-04-11 20:37 - 0033134 _____ () C:\Users\ChypsoTech\AppData\Roaming\UserTile.png
2015-03-02 19:33 - 2015-03-02 19:33 - 0613067 _____ (CMI Limited) C:\Users\ChypsoTech\AppData\Local\nsl86A7.tmp
2014-09-03 17:21 - 2014-09-03 17:21 - 0000017 _____ () C:\Users\ChypsoTech\AppData\Local\resmon.resmoncfg
2012-04-29 10:16 - 2012-04-29 10:16 - 0000040 ___SH () C:\ProgramData\.zreglib
2013-11-19 10:57 - 2013-11-19 10:57 - 0000000 _____ () C:\ProgramData\Graphics
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Capture
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Manipulation
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Units
2013-03-09 11:51 - 2013-11-19 10:57 - 0000268 ___RH () C:\ProgramData\Jingles
2013-03-09 11:52 - 2013-03-09 11:52 - 0000012 ___RH () C:\ProgramData\Keyboard Layouts
2013-03-09 11:52 - 2013-03-09 11:52 - 0000012 ___RH () C:\ProgramData\LaserPrinter
2013-03-09 11:51 - 2013-11-19 10:57 - 0000012 ___RH () C:\ProgramData\NetServices
2013-03-09 11:51 - 2013-11-19 10:57 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2013-03-09 11:52 - 2013-10-09 16:57 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2013-03-09 11:52 - 2013-10-09 16:42 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2013-03-09 11:52 - 2013-10-09 16:48 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT

Some content of TEMP:
====================
C:\Users\ChypsoTech\AppData\Local\Temp\avgnt.exe
C:\Users\ChypsoTech\AppData\Local\Temp\Uninstall.exe
C:\Users\ChypsoTech\AppData\Local\Temp\_isB2BB.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-05 19:56

==================== End Of Log ============================
         

--- --- ---
FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-03-2015 01
Ran by ChypsoTech at 2015-03-10 20:39:48
Running from G:\Eigene Dateien\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3DMark 11 (HKLM-x32\...\{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}) (Version: 1.0.3 - Futuremark Corporation)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.2.152 - Adobe Systems, Inc.)
Aerosoft's - Aerosoft Launcher (HKLM-x32\...\{EE11CFFC-898C-4875-8A63-8B732A9AD43B}) (Version: 1.2.0.3 - Aerosoft)
Aerosoft's - Airbus A318-A319 - FSX (HKLM-x32\...\Airbus A318-A319 - FSX) (Version: 1.10 - Aerosoft)
Aerosoft's - Airbus A320-A321 - FSX (HKLM-x32\...\Airbus A320-A321 - FSX) (Version: 1.00 - Aerosoft)
Aerosoft's - Airbus X Extended - FSX (HKLM-x32\...\Airbus X Extended - FSX) (Version: 1.15 - )
Aerosoft's - Airbus X Extended Sound Enhancement Pack 2013 - FSX (HKLM-x32\...\{43403BD5-95A2-4F4F-A3E2-E968B64854D7}) (Version: 1.00 - Aerosoft)
Aerosoft's - Bergamo X - FSX (HKLM-x32\...\Bergamo X - FSX) (Version: 1.00 - Aerosoft)
Aerosoft's - Global Air Traffic Control (HKLM-x32\...\{AE2E101D-DA19-4665-91BA-807524F872B6}) (Version: 1.1.06 - Aerosoft)
aerosoft's - Koeln-Duesseldorf (HKLM-x32\...\{D2379705-565A-40AB-B2F6-5CD70D599AE2}) (Version: 1.01 - aerosoft)
Aerosoft's - Mega Airport Zurich 2012 - FSX (HKLM-x32\...\{463A571A-B793-459B-BEA8-028DC323AAB0}) (Version: 1.01 - Aerosoft)
Aerosoft's - Night Environment - Italy - FSX (HKLM-x32\...\Night Environment - Italy - FSX) (Version: 1.00 - Aerosoft)
aerosoft's - OMSI - Addon Wien Update (HKLM-x32\...\{7194EE66-1674-4082-85F3-769B844D6BD0}) (Version: 1.02 - aerosoft)
aerosoft's - OMSI 2 - Drei Generationen (HKLM-x32\...\{C88376AA-BF64-40F4-9AD6-F8A18DA394F2}) (Version: 1.00 - aerosoft)
aerosoft's - OMSI 2 - Hamburg (HKLM-x32\...\{5BF6B590-F7F5-46B5-B5F4-B0CA93423AD6}) (Version: 2.02 - aerosoft)
ArcSoft Panorama Maker 6 (HKLM-x32\...\{DABFD34E-BE68-4BC6-9254-5D7A7FF76B99}) (Version: 6.0.8.85 - ArcSoft)
Arma 2 (HKLM-x32\...\Steam App 33910) (Version:  - Bohemia Interactive)
Arma 2: British Armed Forces (HKLM-x32\...\Steam App 65700) (Version:  - Bohemia Interactive)
Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)
Arma 2: Operation Arrowhead Beta (HKLM-x32\...\Steam App 219540) (Version:  - )
Arma 2: Private Military Company (HKLM-x32\...\Steam App 65720) (Version:  - Bohemia Interactive)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
Arma X: Anniversary Edition (HKLM-x32\...\Steam App 107430) (Version:  - Bohemia Interactive)
Arma: Cold War Assault (HKLM-x32\...\Steam App 65790) (Version:  - Bohemia Interactive)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BiH VFR for FSX (version 1) (HKLM-x32\...\BiH VFR for FSX (version 1)) (Version:  - )
Bing Bar (HKLM-x32\...\{449CE12D-E2C7-4B97-B19E-55D163EA9435}) (Version: 7.0.619.0 - Microsoft Corporation)
CameraHelperMsi (x32 Version: 13.50.854.0 - Logitech) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.18 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.4.0.3018 - CDBurnerXP)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Cheat Engine 6.2 (HKLM-x32\...\Cheat Engine 6.2_is1) (Version:  - Dark Byte)
Cheat Engine 6.4 (HKLM-x32\...\Cheat Engine 6.4_is1) (Version:  - Cheat Engine)
ChrisTrains Stadler GTW v1.0 (HKLM-x32\...\ChrisTrains Stadler GTW v1.0) (Version:  - )
Construction-Simulator 2015 (HKLM-x32\...\Steam App 289950) (Version:  - weltenbauer. Software Entwicklung GmbH)
CutePDF Writer 2.8 (HKLM\...\CutePDF Writer Installation) (Version:  - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dropbox (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
dutchpack 2.00 (HKLM-x32\...\dutchpack 2.00) (Version:  - )
EPSON Stylus SX400 Series Printer Uninstall (HKLM\...\EPSON Stylus SX400 Series) (Version:  - SEIKO EPSON Corporation)
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.96 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.96 - Etron Technology) Hidden
Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.0.2 - SCS Software)
European Ship Simulator (HKLM-x32\...\Steam App 299250) (Version:  - Excalibur)
F1 2014 (HKLM-x32\...\Steam App 226580) (Version:  - Codemasters)
F1 Race Stars (HKLM-x32\...\Steam App 203680) (Version:  - Codemasters Birmingham)
Firefighters 2014 (HKLM-x32\...\Steam App 291910) (Version:  - VIS - Visual Imagination Software)
FollowMe 2 Dev 5 (HKLM-x32\...\{0029CC63-6942-40D8-9D17-E52C0FF34107}) (Version: 2.0.20 - Disposition Software Development)
Free YouTube to MP3 Converter version 3.12.41.623 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.41.623 - DVDVideoSoft Ltd.)
FS Global Ultimate - Europe/Africa (HKLM-x32\...\FS Global Ultimate - Europe/Africa) (Version:  - )
FSDreamTeam GSX 1.7.9.8 (HKLM-x32\...\FSDreamTeam GSX_is1) (Version:  - )
FSX - Airbus A319-100 Alitalia (HKLM-x32\...\FSX - Airbus A319-100 Alitalia_is1) (Version:  - Denis Minaev)
FSX - Airbus A319-100 Basepack v2 (HKLM-x32\...\FSX - Airbus A319-100 Basepack v2_is1) (Version:  - Project Airbus)
FSX - Airbus A319-100 EasyJet (HKLM-x32\...\FSX - Airbus A319-100 EasyJet_is1) (Version:  - Bobby Pitaya)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM-x32\...\{7A25D130-4EC8-11E1-BEA4-B8AC6F97B88E}) (Version: 6.2.1.6014 - Google)
Ground Environment X Europe (HKLM-x32\...\Ground Environment X Europe2.30) (Version: 2.30 - Flight One Software)
High-Definition Video Playback (x32 Version: 7.1.13500.43.0 - Nero AG) Hidden
Inkscape 0.48.2 (HKLM-x32\...\Inkscape) (Version: 0.48.2 - )
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)
Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.00.0000 - Jasc Software Inc)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Just Trains - Three Country Corner Route (HKLM-x32\...\{861F3DB3-B2D5-4A12-B69C-6C5A81D9431E}) (Version: 1.00.0000 - Just Trains)
K-Lite Codec Pack 7.9.0 (Full) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.9.0 - )
Landwirtschafts Simulator 2013 (HKLM-x32\...\FarmingSimulator2013DE_is1) (Version: 1.0 - GIANTS Software)
LOGISTIKERV7_61 (HKLM-x32\...\LOGISTIKERV7_61) (Version:  - )
Logitech Gaming Software 5.10 (HKLM\...\{1444D2EE-C7AD-44A8-844F-2634B49353D1}) (Version: 5.10.127 - Logitech)
Logitech Webcam-Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.31 - Logitech Inc.)
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Flight Simulator X Service Pack 2 (HKLM-x32\...\{E7CC4B85-DC2F-463F-8FEB-E7398E25C19A}) (Version: 10.0.61472.0 - Microsoft Game Studios)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{6F29F195-B11C-3EAD-B883-997BB29DFA17}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
My Swisscom Assistant (HKLM-x32\...\My Swisscom Assistant) (Version: 1.0.0.66 - Swisscom (Schweiz) AG)
MyTomTom 3.1.0.530 (HKLM-x32\...\MyTomTom) (Version: 3.1.0.530 - TomTom)
Nero 10 Movie ThemePack 1 (HKLM-x32\...\{43FBAB46-5969-4200-9958-1FF81FEE506F}) (Version: 10.2.10000.11.0 - Nero AG)
Nero BurnRights 10 (HKLM-x32\...\{943CFD7D-5336-47AF-9418-E02473A5A517}) (Version: 4.2.10500.1.102 - Nero AG)
Nero CoverDesigner 10 (HKLM-x32\...\{FCF00A6E-FB58-477A-ABE9-232907105521}) (Version: 5.2.11400.11.100 - Nero AG)
Nero DiscSpeed 10 (HKLM-x32\...\{34490F4E-48D0-492E-8249-B48BECF0537C}) (Version: 6.2.10900.6.100 - Nero AG)
Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.2.11500.17.100 - Nero AG)
Nero InfoTool 10 (HKLM-x32\...\{F412B4AF-388C-4FF5-9B2F-33DB1C536953}) (Version: 7.2.10400.5.100 - Nero AG)
Nero MediaHub 10 (HKLM-x32\...\{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}) (Version: 1.2.12900.31.100 - Nero AG)
Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{ADEF1F0B-635E-4041-B50F-A510C1B4D2C5}) (Version: 10.5.11100 - Nero AG)
Nero RescueAgent 10 (HKLM-x32\...\{E337E787-CF61-4B7B-B84F-509202A54023}) (Version: 3.2.10800.9.100 - Nero AG)
Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.2.11300.12.100 - Nero AG)
NETGEAR A6200 Genie (HKLM-x32\...\{48E61F3E-61D4-42A3-9D29-D0CF40838779}) (Version: 26.0.0.0 - NETGEAR)
Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.8.0 - Nikon)
NVIDIA 3D Vision Controller-Treiber 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OMSI 2 (HKLM-x32\...\Steam App 252530) (Version:  - MR-Software GbR)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.)
Panda Cloud Antivirus (HKLM-x32\...\Panda Cloud Antivirus) (Version: 1.5.2 - Panda Security)
Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.15 - Nikon)
QualityWings Ultimate 146 Collection FSX (HKLM-x32\...\QualityWings Ultimate 146 Collection FSX) (Version:  - )
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
RAAS Professional by FS2Crew (LOCKED) (HKLM-x32\...\RAAS Professional by FS2Crew (LOCKED)) (Version:  - )
Rapture3D 2.5.1 Game (HKLM-x32\...\{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1) (Version:  - Blue Ripple Sound)
Re 620 Platinum pack v2.1  (TS2015) (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Re 620 Platinum pack v2.1  (TS2015)) (Version:  - )
RealDownloader (x32 Version: 1.3.0 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.23.623.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
RESCUE 2013 (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\RESCUE 2013) (Version: 1.10.00.00 - rondomedia GmbH)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.3.13034_9 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.3.13034_9 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.34.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Ship Simulator Extremes (HKLM-x32\...\Steam App 48800) (Version:  - )
Simtrain's - SBB Route 1 (HKLM-x32\...\{B9BA893E-E2CD-4C48-89FC-3E010B42415A}) (Version: 1.00 - Simtrain)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Solaris Urbino 12 III - Version 2.01 by CNB-Projekts - (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Solaris Urbino 12 III - Version 2.01 by CNB-Projekts -) (Version:  - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.18.9.4384 - Enigma Software Group, LLC)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold 3 (HKLM-x32\...\Steam App 47400) (Version:  - Firefly Studios)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Torino Caselle FSX (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Torino Caselle FSX) (Version:  - )
Torino Genova Rel. 3.0 per RailWorks (HKLM-x32\...\{963FF101-2513-475B-AAA8-C2A569711463}) (Version:  - )
Train Fever (HKLM-x32\...\Steam App 304730) (Version:  - Urban Games)
Train Simulator 2013 (HKLM-x32\...\Steam App 24010) (Version:  - RailSimulator.com)
TransOcean - The Shipping Company (HKLM-x32\...\Steam App 289930) (Version:  - Deck 13 Hamburg)
Tupolev TU-144 complete package 2.0 FS2004  (HKLM\...\{66EF4249-9224-4833-8B9B-082BDD441E2F}) (Version:  - Thomas Ruth, Claudio Mussner)
Ultimate Airliners -  Super 80 FSX (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Ultimate Airliners -  Super 80 FSX) (Version:  - )
vasFMC 2.1 (HKLM-x32\...\vasFMC MSFS Gauge_is1) (Version:  - VAS Project <contact@vas-project.org>)
ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.8.2 - Nikon)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

05-03-2015 19:16:09 Windows Update
07-03-2015 12:38:52 Windows Update
08-03-2015 12:51:34 Windows Update
09-03-2015 19:24:18 Windows Update
10-03-2015 19:59:32 Removed Apple Application Support

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-09-19 19:09 - 00450709 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {07EB8B4E-4935-466F-BB1E-77F6A62206DF} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {18AFF996-1080-40AC-98FA-2CD013CE3D63} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {1A466FF1-3583-437C-9A42-A6772A3371C6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {1B9A2046-586E-42F1-9F08-516CD96E4AF3} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {22468040-F01B-486D-ABFD-F6936704259C} - System32\Tasks\{0C5E4CAC-CEC6-4B8A-998E-8AB66D342024} => pcalua.exe -a C:\Users\ChypsoTech\AppData\Roaming\istartsurf\UninstallManager.exe -c  -ptid=amt
Task: {2B4B4E55-B93E-4500-B501-E7FB4B59BA2D} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {2CFF36E2-2A40-487C-A82A-CD88A80416AA} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {355138E3-83AA-411A-BA52-FF57306907E7} - System32\Tasks\{DA6F367B-DCAF-4E59-B81E-8FA263BAEE2E} => pcalua.exe -a C:\Users\ChypsoTech\AppData\Roaming\mystartsearch\UninstallManager.exe -c  -ptid=cmi
Task: {369BBA2D-BC55-4075-9E6A-4A82B234D8E0} - System32\Tasks\{22690CE1-506C-45E4-84B0-12AB910D1811} => pcalua.exe -a "G:\Eigene Dateien\Downloads\Programm\avira_free_antivirus_898de.exe" -d "G:\Eigene Dateien\Downloads\Programm"
Task: {37444177-3A8E-46B7-9C3E-F78A3A03CBA4} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exe
Task: {4E294C49-1F76-41D4-A3A5-C13103CF2EA4} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {5925C00D-D9C5-4848-AB62-4557B2369D5F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {6FD80964-9761-4A0B-888B-52BE1B69B170} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {706B4E5D-6730-4399-B7BE-6572CE7ABDE1} - System32\Tasks\{856C2CEC-008A-48E9-9D91-8D995BADC57C} => pcalua.exe -a G:\FSX\SimObjects\Airplanes\Uninstal.exe -d G:\FSX\SimObjects\Airplanes
Task: {7A50A5AD-9933-4660-BD17-70C5D833C1FF} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {7F25C5B6-4FF7-4127-BD84-3C2B371CD4A0} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {87E4D51B-7422-44C6-BB8E-396B0CB20426} - System32\Tasks\{C26218CD-C759-441B-9F14-E6097931ABD3} => pcalua.exe -a "G:\Eigene Dateien\Downloads\a319alfs\A319_Alitalia_fsp.exe" -d "G:\Eigene Dateien\Downloads\a319alfs"
Task: {8C8F853F-C3C3-48D1-91BC-1B4E9E8AB19F} - \ASP No Task File <==== ATTENTION
Task: {8C90FD59-B256-4EB2-93DF-3A8D130C288C} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {8F9FB531-16AA-45EF-A18D-BFD97C4F05A6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-09] (Adobe Systems Incorporated)
Task: {9617EFAD-7CD1-4CC9-8633-2AAA79D390B8} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {AB2B776F-E90E-4612-B157-D10C2E28E2AE} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {ABA60E8E-AA0D-4232-B0FB-A3FABFF63349} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {BC78C35B-ABBC-4F66-999E-8BD941F7EB19} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {C4E8045F-A185-4A93-BE4D-1CFFA13CB384} - System32\Tasks\{9E846974-4276-4D8C-AAFD-10C6FEBFF197} => pcalua.exe -a "G:\Eigene Dateien\Downloads\epson324602eu.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {CB9C7666-6321-47A1-9F24-2C3936A36808} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {CBB91523-E57B-4FE1-8640-BE428C017792} - System32\Tasks\{EE9CC123-1A64-4404-A27B-39F2909E39C5} => pcalua.exe -a D:\Setup.exe -d D:\
Task: {CBFF4B59-E92F-4193-AA90-B65F7EBEFFB5} - \YourFile DownloaderUpdate No Task File <==== ATTENTION
Task: {D95BDDEA-4029-4B62-9311-73D3A89F4CA8} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {DCD62F08-AA1F-4CCD-ABCF-5C53C66714A1} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {E34C2A7A-A431-421B-A036-CCA4A60BBB45} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {FDE80CF4-4C3C-4365-AB25-3D5863BD3B12} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\SpyHunter4.job => C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe

==================== Loaded Modules (whitelisted) ==============

2012-04-11 12:46 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-11-17 21:38 - 2009-11-05 08:40 - 00085504 _____ () C:\Windows\System32\cpwmon64.dll
2015-03-02 19:08 - 2015-03-02 19:08 - 00103424 _____ () C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp
2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2013-11-19 12:39 - 2012-09-24 17:28 - 00029984 _____ () C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe
2015-03-02 19:07 - 2015-03-02 19:07 - 00114176 _____ () C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-04-11 19:01 - 2012-02-17 19:55 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2014-08-20 19:14 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-08-20 19:14 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-08-20 19:14 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-08-20 19:14 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-08-20 19:14 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-11-19 12:39 - 2013-02-18 16:13 - 00106496 _____ () C:\Program Files (x86)\NETGEAR\A6200\GWlanController.dll
2013-11-19 12:39 - 2013-03-26 17:00 - 00018944 _____ () C:\Program Files (x86)\NETGEAR\A6200\GWPSController.dll
2013-03-12 17:10 - 2014-11-11 19:47 - 00774656 _____ () G:\Steam\SDL2.dll
2015-01-22 16:29 - 2014-12-02 01:29 - 05002752 _____ () G:\Steam\v8.dll
2015-01-22 16:29 - 2014-12-02 01:29 - 01612800 _____ () G:\Steam\icui18n.dll
2015-01-22 16:29 - 2014-12-02 01:29 - 01210368 _____ () G:\Steam\icuuc.dll
2014-05-21 20:10 - 2015-02-19 00:51 - 02360000 _____ () G:\Steam\video.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 02396672 _____ () G:\Steam\libavcodec-56.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 00442880 _____ () G:\Steam\libavutil-54.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 00479744 _____ () G:\Steam\libavformat-56.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 00332800 _____ () G:\Steam\libavresample-2.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 00485888 _____ () G:\Steam\libswscale-3.dll
2012-04-12 21:40 - 2015-02-19 00:51 - 00702656 _____ () G:\Steam\bin\chromehtml.DLL
2012-04-12 21:40 - 2015-01-28 02:30 - 34641288 _____ () G:\Steam\bin\libcef.dll
2014-08-14 21:33 - 2015-01-28 02:30 - 01709960 _____ () G:\Steam\bin\ffmpegsumo.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:74603393
AlternateDataStreams: C:\Users\ChypsoTech\2013-08-18 13.15.26.jpg:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\ChypsoTech\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^ChypsoTech^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: KiesHelper => G:\Samsung\Kies\KiesHelper.exe /s
MSCONFIG\startupreg: KiesPDLR => G:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesTrayAgent => G:\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: My Swisscom Assistant => C:\Program Files (x86)\Swisscom\My Swisscom Assistant\MySwisscomAssistant_Launcher.exe /auto
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: TomTomHOME.exe => "G:\TomTom HOME 2\TomTomHOMERunner.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-1981296596-178752184-4134557248-500 - Administrator - Disabled)
ChypsoTech (S-1-5-21-1981296596-178752184-4134557248-1000 - Administrator - Enabled) => C:\Users\ChypsoTech
Gast (S-1-5-21-1981296596-178752184-4134557248-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1981296596-178752184-4134557248-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: NVIDIA High Definition Audio
Description: NVIDIA High Definition Audio
Class Guid: 
Manufacturer: NVIDIA
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: SASDIFSV
Description: SASDIFSV
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: SASDIFSV
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: SASKUTIL
Description: SASKUTIL
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: SASKUTIL
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:26:19 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.


System errors:
=============
Error: (03/10/2015 07:30:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/10/2015 07:30:35 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/10/2015 07:30:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/10/2015 07:30:35 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/10/2015 07:30:35 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/10/2015 07:30:35 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/10/2015 07:30:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/10/2015 07:30:24 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/10/2015 07:30:24 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/10/2015 07:30:22 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SASDIFSV
SASKUTIL


Microsoft Office Sessions:
=========================
Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:26:19 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 19%
Total physical RAM: 16366.67 MB
Available physical RAM: 13126.41 MB
Total Pagefile: 32731.52 MB
Available Pagefile: 29453.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:111.69 GB) (Free:13.15 GB) NTFS
Drive g: (Daten 1TB) (Fixed) (Total:931.51 GB) (Free:186.57 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: BBE07B61)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 111.8 GB) (Disk ID: 9D8EB713)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-03-2015 01
Ran by ChypsoTech (administrator) on CHYPSOTECH-PC1 on 10-03-2015 20:39:24
Running from G:\Eigene Dateien\Downloads
Loaded Profiles: ChypsoTech (Available profiles: ChypsoTech)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Panda Security, S.L.) G:\Panda\PSANHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(TomTom) G:\TomTom\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe
() C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NETGEAR,Inc.) C:\Program Files (x86)\NETGEAR\A6200\A6200.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Valve Corporation) G:\Steam\Steam.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Samsung Electronics Co., Ltd.) G:\Samsung\Kies\KiesTrayAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Valve Corporation) G:\Steam\bin\steamwebhelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Valve Corporation) G:\Steam\bin\steamwebhelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\wermgr.exe
(Microsoft Corporation) C:\Windows\System32\wermgr.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [GENIE] => C:\Program Files (x86)\NETGEAR\A6200\A6200.exe [348888 2013-02-18] (NETGEAR,Inc.)
HKLM\...\Run: [LanuchApp] => C:\Program Files (x86)\NETGEAR\A6200\LanuchApp.exe [15136 2012-07-11] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295072 2012-12-26] (RealNetworks, Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => G:\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [Steam] => G:\Steam\steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [] => G:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-02-14] (Samsung)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\MountPoints2: {91c9a43c-1145-11e1-8fbf-806e6f6e6963} - D:\Setup.exe
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\MountPoints2: {d3f575a3-9264-11e2-a47f-bc5ff4092565} - F:\CMADownloader.exe
AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL => "C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL" File Not Found
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp
SearchScopes: HKLM -> {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = 
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {14B46720-510A-47D8-9427-CF9A8D86A457} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1981296596-178752184-4134557248-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098&ts=1425320950&type=default&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2014-03-20] (DVDVideoSoft Ltd.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2012-11-29] (RealDownloader)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2014-06-23] (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281
FF Homepage: ?type=hppp
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-03-09] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0-git -> G:\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-09] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1212152.dll [2014-05-30] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2012-02-04] (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2012-12-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-06-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-06-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2012-12-26] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2012-11-29] (RealDownloader)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: samsung.com/SamsungLinkPCPlugin -> G:\Eigene Dateien\Documents\Samsung Link\utils\npSamsungLinkPCPlugin.dll No File
FF user.js: detected! => C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\user.js [2015-03-02]
FF SearchPlugin: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\searchplugins\google-images.xml [2015-03-02]
FF SearchPlugin: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\searchplugins\google-maps.xml [2015-03-02]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-03-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-03-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2015-03-07]
FF HKLM-x32\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2012-12-26]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-06-26]

Chrome: 
=======
CHR Profile: C:\Users\ChypsoTech\AppData\Local\Google\Chrome\User Data\default
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM-x32\...\Chrome\Extension: [iomphmdalfmaifjccmagmllnicjoghhk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 cehufofi; C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp [103424 2015-03-02] () [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 NanoServiceMain; G:\Panda\PSANHost.exe [140608 2011-04-28] (Panda Security, S.L.)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 TomTomHOMEService; G:\TomTom\TomTom HOME 2\TomTomHOMEService.exe [93040 2014-06-05] (TomTom)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WNDA6200; C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe [29984 2012-09-24] ()
R2 xeqomesu; C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 A6200; C:\Windows\System32\DRIVERS\bcmwlhigh664.sys [2567984 2013-02-28] (Broadcom Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R1 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-26] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [161032 2012-01-05] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [114760 2011-04-28] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [149768 2011-11-23] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [121928 2011-04-28] (Panda Security, S.L.)
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S1 SASDIFSV; \??\G:\\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\G:\\SASKUTIL64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-10 20:39 - 2015-03-10 20:39 - 00000000 ____D () C:\FRST
2015-03-10 19:29 - 2015-03-10 19:29 - 00290320 _____ () C:\Windows\Minidump\031015-20826-01.dmp
2015-03-10 19:27 - 2015-03-10 19:27 - 00283760 _____ () C:\Windows\Minidump\031015-10654-01.dmp
2015-03-10 19:26 - 2015-03-10 19:26 - 00283376 _____ () C:\Windows\Minidump\031015-15007-01.dmp
2015-03-09 20:22 - 2015-03-09 20:22 - 00283760 _____ () C:\Windows\Minidump\030915-8970-01.dmp
2015-03-08 00:05 - 2015-03-08 00:05 - 00283760 _____ () C:\Windows\Minidump\030815-15132-01.dmp
2015-03-07 12:45 - 2015-03-07 12:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 17:17 - 2015-03-05 17:17 - 00283376 _____ () C:\Windows\Minidump\030515-9313-01.dmp
2015-03-02 23:51 - 2015-03-02 23:51 - 00283760 _____ () C:\Windows\Minidump\030215-9375-01.dmp
2015-03-02 22:35 - 2015-03-09 20:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-02 22:33 - 2015-03-02 22:33 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-02 22:33 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-02 22:33 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-02 22:33 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-02 22:32 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2015-03-02 22:32 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2015-03-02 22:20 - 2015-03-02 22:20 - 00283760 _____ () C:\Windows\Minidump\030215-13509-01.dmp
2015-03-02 20:01 - 2015-03-02 20:01 - 00283760 _____ () C:\Windows\Minidump\030215-19359-01.dmp
2015-03-02 19:40 - 2015-03-02 19:40 - 00283760 _____ () C:\Windows\Minidump\030215-8798-01.dmp
2015-03-02 19:35 - 2015-03-05 19:35 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2015-03-02 19:35 - 2015-03-03 19:35 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2015-03-02 19:35 - 2015-03-02 19:55 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2015-03-02 19:35 - 2015-03-02 19:35 - 00002838 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2015-03-02 19:35 - 2015-03-02 19:35 - 00002836 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2015-03-02 19:35 - 2015-03-02 19:35 - 00002836 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2015-03-02 19:33 - 2015-03-02 19:33 - 00613067 _____ (CMI Limited) C:\Users\ChypsoTech\AppData\Local\nsl86A7.tmp
2015-03-02 19:33 - 2015-03-02 19:33 - 00000000 __SHD () C:\Users\ChypsoTech\AppData\Roaming\AnyProtectEx
2015-03-02 19:30 - 2015-03-02 19:34 - 00000000 ____D () C:\ProgramData\2ef25f1272114645a21caf4eede15cca
2015-03-02 19:30 - 2015-03-02 19:30 - 00003184 _____ () C:\Windows\System32\Tasks\{DA6F367B-DCAF-4E59-B81E-8FA263BAEE2E}
2015-03-02 19:30 - 2015-02-24 17:05 - 00364120 _____ (Gambali OEM Software) C:\Windows\system32\Gambali64.dll
2015-03-02 19:30 - 2015-02-24 17:05 - 00318784 _____ (Gambali OEM Software) C:\Windows\SysWOW64\Gambali.dll
2015-03-02 19:29 - 2015-03-02 22:45 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-03-02 19:29 - 2015-02-24 14:51 - 00318808 _____ (OM Inc.) C:\Windows\SysWOW64\BDL.dll
2015-03-02 19:19 - 2015-03-02 19:24 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009
2015-03-02 19:07 - 2015-03-02 19:30 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009
2015-03-02 18:57 - 2015-03-02 19:42 - 00000000 ____D () C:\ProgramData\{8dbc5b3b-c216-4374-8dbc-c5b3bc216cef}
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\Opera Software
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Opera Software
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\ProgramData\8731830257723766728
2015-03-02 18:56 - 2015-03-02 18:58 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-02 17:44 - 2015-03-02 17:44 - 00283376 _____ () C:\Windows\Minidump\030215-20950-01.dmp
2015-02-27 16:42 - 2015-02-27 16:42 - 00283376 _____ () C:\Windows\Minidump\022715-8096-01.dmp
2015-02-24 19:12 - 2015-02-24 19:12 - 00283376 _____ () C:\Windows\Minidump\022415-9079-01.dmp
2015-02-21 08:14 - 2015-02-21 08:14 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Steam
2015-02-21 08:11 - 2015-02-21 08:11 - 00283376 _____ () C:\Windows\Minidump\022115-7893-01.dmp
2015-02-13 18:25 - 2015-02-13 18:25 - 00283376 _____ () C:\Windows\Minidump\021315-8377-01.dmp
2015-02-12 18:04 - 2015-02-12 18:38 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\ESS
2015-02-09 16:59 - 2015-02-09 16:59 - 00283376 _____ () C:\Windows\Minidump\020915-10062-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-10 20:39 - 2011-11-17 19:03 - 01228155 _____ () C:\Windows\WindowsUpdate.log
2015-03-10 20:04 - 2012-04-11 13:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-10 19:37 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-10 19:37 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-10 19:34 - 2011-04-12 08:43 - 14069504 _____ () C:\Windows\system32\perfh007.dat
2015-03-10 19:34 - 2011-04-12 08:43 - 04356364 _____ () C:\Windows\system32\perfc007.dat
2015-03-10 19:34 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-10 19:29 - 2012-05-03 14:35 - 00000000 ____D () C:\Windows\Minidump
2015-03-10 19:28 - 2014-05-01 14:27 - 00061609 _____ () C:\Windows\setupact.log
2015-03-10 19:28 - 2012-05-13 12:18 - 00026577 _____ () C:\Windows\SysWOW64\temp.txt
2015-03-10 19:28 - 2012-04-11 12:46 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-03-10 19:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-09 20:33 - 2014-08-21 17:31 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Adobe
2015-03-09 20:33 - 2012-04-11 13:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-09 20:33 - 2012-04-11 13:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-09 20:33 - 2011-11-17 21:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-09 19:24 - 2011-11-17 19:03 - 00000000 ____D () C:\Users\ChypsoTech
2015-03-09 19:17 - 2012-05-08 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-03-03 18:47 - 2014-04-30 16:46 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-03-03 18:47 - 2014-04-30 16:46 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-03-03 14:17 - 2010-11-21 04:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-02 23:50 - 2014-05-08 16:38 - 00036890 _____ () C:\Windows\PFRO.log
2015-03-02 22:45 - 2014-09-24 11:38 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Gameo
2015-03-02 22:23 - 2014-05-01 14:45 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2015-03-02 20:04 - 2011-11-17 21:19 - 00116872 _____ () C:\Users\ChypsoTech\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-02 20:00 - 2009-07-14 05:45 - 00424840 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-02 19:44 - 2011-11-17 19:03 - 00001427 _____ () C:\Users\ChypsoTech\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-12 18:48 - 2014-09-03 16:13 - 00002123 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-02-12 18:48 - 2014-09-03 16:13 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-02-12 18:48 - 2014-09-03 16:13 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2015-02-12 18:48 - 2014-07-05 01:41 - 00001912 _____ () C:\Windows\epplauncher.mif
2015-02-09 17:31 - 2013-10-19 08:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-09 17:30 - 2013-10-19 08:15 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-09 17:29 - 2013-10-19 08:14 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-09 17:29 - 2013-10-19 08:14 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-09 17:29 - 2013-10-19 08:14 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-09 17:29 - 2012-04-11 14:01 - 00000000 ____D () C:\Program Files (x86)\Java

==================== Files in the root of some directories =======

2012-06-08 16:31 - 2012-09-10 11:22 - 0000000 _____ () C:\Users\ChypsoTech\AppData\Roaming\FileIn.cns
2012-06-08 16:31 - 2012-09-10 11:22 - 0000000 _____ () C:\Users\ChypsoTech\AppData\Roaming\FileOut.cns
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Chords
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Morph
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Synthesizers
2013-03-09 11:51 - 2013-11-19 10:57 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Internet Services
2014-01-29 18:59 - 2014-01-29 19:00 - 0000092 _____ () C:\Users\ChypsoTech\AppData\Roaming\regsvr32.exe_log.txt
2012-05-14 17:39 - 2012-05-14 17:39 - 0008704 ___SH () C:\Users\ChypsoTech\AppData\Roaming\Thumbs.db
2012-04-11 20:37 - 2012-04-11 20:37 - 0033134 _____ () C:\Users\ChypsoTech\AppData\Roaming\UserTile.png
2015-03-02 19:33 - 2015-03-02 19:33 - 0613067 _____ (CMI Limited) C:\Users\ChypsoTech\AppData\Local\nsl86A7.tmp
2014-09-03 17:21 - 2014-09-03 17:21 - 0000017 _____ () C:\Users\ChypsoTech\AppData\Local\resmon.resmoncfg
2012-04-29 10:16 - 2012-04-29 10:16 - 0000040 ___SH () C:\ProgramData\.zreglib
2013-11-19 10:57 - 2013-11-19 10:57 - 0000000 _____ () C:\ProgramData\Graphics
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Capture
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Manipulation
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Units
2013-03-09 11:51 - 2013-11-19 10:57 - 0000268 ___RH () C:\ProgramData\Jingles
2013-03-09 11:52 - 2013-03-09 11:52 - 0000012 ___RH () C:\ProgramData\Keyboard Layouts
2013-03-09 11:52 - 2013-03-09 11:52 - 0000012 ___RH () C:\ProgramData\LaserPrinter
2013-03-09 11:51 - 2013-11-19 10:57 - 0000012 ___RH () C:\ProgramData\NetServices
2013-03-09 11:51 - 2013-11-19 10:57 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2013-03-09 11:52 - 2013-10-09 16:57 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2013-03-09 11:52 - 2013-10-09 16:42 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2013-03-09 11:52 - 2013-10-09 16:48 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT

Some content of TEMP:
====================
C:\Users\ChypsoTech\AppData\Local\Temp\avgnt.exe
C:\Users\ChypsoTech\AppData\Local\Temp\Uninstall.exe
C:\Users\ChypsoTech\AppData\Local\Temp\_isB2BB.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-05 19:56

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-03-2015 01
Ran by ChypsoTech at 2015-03-10 20:39:48
Running from G:\Eigene Dateien\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3DMark 11 (HKLM-x32\...\{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}) (Version: 1.0.3 - Futuremark Corporation)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.2.152 - Adobe Systems, Inc.)
Aerosoft's - Aerosoft Launcher (HKLM-x32\...\{EE11CFFC-898C-4875-8A63-8B732A9AD43B}) (Version: 1.2.0.3 - Aerosoft)
Aerosoft's - Airbus A318-A319 - FSX (HKLM-x32\...\Airbus A318-A319 - FSX) (Version: 1.10 - Aerosoft)
Aerosoft's - Airbus A320-A321 - FSX (HKLM-x32\...\Airbus A320-A321 - FSX) (Version: 1.00 - Aerosoft)
Aerosoft's - Airbus X Extended - FSX (HKLM-x32\...\Airbus X Extended - FSX) (Version: 1.15 - )
Aerosoft's - Airbus X Extended Sound Enhancement Pack 2013 - FSX (HKLM-x32\...\{43403BD5-95A2-4F4F-A3E2-E968B64854D7}) (Version: 1.00 - Aerosoft)
Aerosoft's - Bergamo X - FSX (HKLM-x32\...\Bergamo X - FSX) (Version: 1.00 - Aerosoft)
Aerosoft's - Global Air Traffic Control (HKLM-x32\...\{AE2E101D-DA19-4665-91BA-807524F872B6}) (Version: 1.1.06 - Aerosoft)
aerosoft's - Koeln-Duesseldorf (HKLM-x32\...\{D2379705-565A-40AB-B2F6-5CD70D599AE2}) (Version: 1.01 - aerosoft)
Aerosoft's - Mega Airport Zurich 2012 - FSX (HKLM-x32\...\{463A571A-B793-459B-BEA8-028DC323AAB0}) (Version: 1.01 - Aerosoft)
Aerosoft's - Night Environment - Italy - FSX (HKLM-x32\...\Night Environment - Italy - FSX) (Version: 1.00 - Aerosoft)
aerosoft's - OMSI - Addon Wien Update (HKLM-x32\...\{7194EE66-1674-4082-85F3-769B844D6BD0}) (Version: 1.02 - aerosoft)
aerosoft's - OMSI 2 - Drei Generationen (HKLM-x32\...\{C88376AA-BF64-40F4-9AD6-F8A18DA394F2}) (Version: 1.00 - aerosoft)
aerosoft's - OMSI 2 - Hamburg (HKLM-x32\...\{5BF6B590-F7F5-46B5-B5F4-B0CA93423AD6}) (Version: 2.02 - aerosoft)
ArcSoft Panorama Maker 6 (HKLM-x32\...\{DABFD34E-BE68-4BC6-9254-5D7A7FF76B99}) (Version: 6.0.8.85 - ArcSoft)
Arma 2 (HKLM-x32\...\Steam App 33910) (Version:  - Bohemia Interactive)
Arma 2: British Armed Forces (HKLM-x32\...\Steam App 65700) (Version:  - Bohemia Interactive)
Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)
Arma 2: Operation Arrowhead Beta (HKLM-x32\...\Steam App 219540) (Version:  - )
Arma 2: Private Military Company (HKLM-x32\...\Steam App 65720) (Version:  - Bohemia Interactive)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
Arma X: Anniversary Edition (HKLM-x32\...\Steam App 107430) (Version:  - Bohemia Interactive)
Arma: Cold War Assault (HKLM-x32\...\Steam App 65790) (Version:  - Bohemia Interactive)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BiH VFR for FSX (version 1) (HKLM-x32\...\BiH VFR for FSX (version 1)) (Version:  - )
Bing Bar (HKLM-x32\...\{449CE12D-E2C7-4B97-B19E-55D163EA9435}) (Version: 7.0.619.0 - Microsoft Corporation)
CameraHelperMsi (x32 Version: 13.50.854.0 - Logitech) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.18 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.4.0.3018 - CDBurnerXP)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Cheat Engine 6.2 (HKLM-x32\...\Cheat Engine 6.2_is1) (Version:  - Dark Byte)
Cheat Engine 6.4 (HKLM-x32\...\Cheat Engine 6.4_is1) (Version:  - Cheat Engine)
ChrisTrains Stadler GTW v1.0 (HKLM-x32\...\ChrisTrains Stadler GTW v1.0) (Version:  - )
Construction-Simulator 2015 (HKLM-x32\...\Steam App 289950) (Version:  - weltenbauer. Software Entwicklung GmbH)
CutePDF Writer 2.8 (HKLM\...\CutePDF Writer Installation) (Version:  - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dropbox (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
dutchpack 2.00 (HKLM-x32\...\dutchpack 2.00) (Version:  - )
EPSON Stylus SX400 Series Printer Uninstall (HKLM\...\EPSON Stylus SX400 Series) (Version:  - SEIKO EPSON Corporation)
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.96 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.96 - Etron Technology) Hidden
Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.0.2 - SCS Software)
European Ship Simulator (HKLM-x32\...\Steam App 299250) (Version:  - Excalibur)
F1 2014 (HKLM-x32\...\Steam App 226580) (Version:  - Codemasters)
F1 Race Stars (HKLM-x32\...\Steam App 203680) (Version:  - Codemasters Birmingham)
Firefighters 2014 (HKLM-x32\...\Steam App 291910) (Version:  - VIS - Visual Imagination Software)
FollowMe 2 Dev 5 (HKLM-x32\...\{0029CC63-6942-40D8-9D17-E52C0FF34107}) (Version: 2.0.20 - Disposition Software Development)
Free YouTube to MP3 Converter version 3.12.41.623 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.41.623 - DVDVideoSoft Ltd.)
FS Global Ultimate - Europe/Africa (HKLM-x32\...\FS Global Ultimate - Europe/Africa) (Version:  - )
FSDreamTeam GSX 1.7.9.8 (HKLM-x32\...\FSDreamTeam GSX_is1) (Version:  - )
FSX - Airbus A319-100 Alitalia (HKLM-x32\...\FSX - Airbus A319-100 Alitalia_is1) (Version:  - Denis Minaev)
FSX - Airbus A319-100 Basepack v2 (HKLM-x32\...\FSX - Airbus A319-100 Basepack v2_is1) (Version:  - Project Airbus)
FSX - Airbus A319-100 EasyJet (HKLM-x32\...\FSX - Airbus A319-100 EasyJet_is1) (Version:  - Bobby Pitaya)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM-x32\...\{7A25D130-4EC8-11E1-BEA4-B8AC6F97B88E}) (Version: 6.2.1.6014 - Google)
Ground Environment X Europe (HKLM-x32\...\Ground Environment X Europe2.30) (Version: 2.30 - Flight One Software)
High-Definition Video Playback (x32 Version: 7.1.13500.43.0 - Nero AG) Hidden
Inkscape 0.48.2 (HKLM-x32\...\Inkscape) (Version: 0.48.2 - )
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)
Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.00.0000 - Jasc Software Inc)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Just Trains - Three Country Corner Route (HKLM-x32\...\{861F3DB3-B2D5-4A12-B69C-6C5A81D9431E}) (Version: 1.00.0000 - Just Trains)
K-Lite Codec Pack 7.9.0 (Full) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.9.0 - )
Landwirtschafts Simulator 2013 (HKLM-x32\...\FarmingSimulator2013DE_is1) (Version: 1.0 - GIANTS Software)
LOGISTIKERV7_61 (HKLM-x32\...\LOGISTIKERV7_61) (Version:  - )
Logitech Gaming Software 5.10 (HKLM\...\{1444D2EE-C7AD-44A8-844F-2634B49353D1}) (Version: 5.10.127 - Logitech)
Logitech Webcam-Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.31 - Logitech Inc.)
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Flight Simulator X Service Pack 2 (HKLM-x32\...\{E7CC4B85-DC2F-463F-8FEB-E7398E25C19A}) (Version: 10.0.61472.0 - Microsoft Game Studios)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{6F29F195-B11C-3EAD-B883-997BB29DFA17}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
My Swisscom Assistant (HKLM-x32\...\My Swisscom Assistant) (Version: 1.0.0.66 - Swisscom (Schweiz) AG)
MyTomTom 3.1.0.530 (HKLM-x32\...\MyTomTom) (Version: 3.1.0.530 - TomTom)
Nero 10 Movie ThemePack 1 (HKLM-x32\...\{43FBAB46-5969-4200-9958-1FF81FEE506F}) (Version: 10.2.10000.11.0 - Nero AG)
Nero BurnRights 10 (HKLM-x32\...\{943CFD7D-5336-47AF-9418-E02473A5A517}) (Version: 4.2.10500.1.102 - Nero AG)
Nero CoverDesigner 10 (HKLM-x32\...\{FCF00A6E-FB58-477A-ABE9-232907105521}) (Version: 5.2.11400.11.100 - Nero AG)
Nero DiscSpeed 10 (HKLM-x32\...\{34490F4E-48D0-492E-8249-B48BECF0537C}) (Version: 6.2.10900.6.100 - Nero AG)
Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.2.11500.17.100 - Nero AG)
Nero InfoTool 10 (HKLM-x32\...\{F412B4AF-388C-4FF5-9B2F-33DB1C536953}) (Version: 7.2.10400.5.100 - Nero AG)
Nero MediaHub 10 (HKLM-x32\...\{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}) (Version: 1.2.12900.31.100 - Nero AG)
Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{ADEF1F0B-635E-4041-B50F-A510C1B4D2C5}) (Version: 10.5.11100 - Nero AG)
Nero RescueAgent 10 (HKLM-x32\...\{E337E787-CF61-4B7B-B84F-509202A54023}) (Version: 3.2.10800.9.100 - Nero AG)
Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.2.11300.12.100 - Nero AG)
NETGEAR A6200 Genie (HKLM-x32\...\{48E61F3E-61D4-42A3-9D29-D0CF40838779}) (Version: 26.0.0.0 - NETGEAR)
Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.8.0 - Nikon)
NVIDIA 3D Vision Controller-Treiber 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OMSI 2 (HKLM-x32\...\Steam App 252530) (Version:  - MR-Software GbR)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.)
Panda Cloud Antivirus (HKLM-x32\...\Panda Cloud Antivirus) (Version: 1.5.2 - Panda Security)
Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.15 - Nikon)
QualityWings Ultimate 146 Collection FSX (HKLM-x32\...\QualityWings Ultimate 146 Collection FSX) (Version:  - )
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
RAAS Professional by FS2Crew (LOCKED) (HKLM-x32\...\RAAS Professional by FS2Crew (LOCKED)) (Version:  - )
Rapture3D 2.5.1 Game (HKLM-x32\...\{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1) (Version:  - Blue Ripple Sound)
Re 620 Platinum pack v2.1  (TS2015) (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Re 620 Platinum pack v2.1  (TS2015)) (Version:  - )
RealDownloader (x32 Version: 1.3.0 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.23.623.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
RESCUE 2013 (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\RESCUE 2013) (Version: 1.10.00.00 - rondomedia GmbH)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.3.13034_9 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.3.13034_9 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.34.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Ship Simulator Extremes (HKLM-x32\...\Steam App 48800) (Version:  - )
Simtrain's - SBB Route 1 (HKLM-x32\...\{B9BA893E-E2CD-4C48-89FC-3E010B42415A}) (Version: 1.00 - Simtrain)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Solaris Urbino 12 III - Version 2.01 by CNB-Projekts - (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Solaris Urbino 12 III - Version 2.01 by CNB-Projekts -) (Version:  - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.18.9.4384 - Enigma Software Group, LLC)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold 3 (HKLM-x32\...\Steam App 47400) (Version:  - Firefly Studios)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Torino Caselle FSX (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Torino Caselle FSX) (Version:  - )
Torino Genova Rel. 3.0 per RailWorks (HKLM-x32\...\{963FF101-2513-475B-AAA8-C2A569711463}) (Version:  - )
Train Fever (HKLM-x32\...\Steam App 304730) (Version:  - Urban Games)
Train Simulator 2013 (HKLM-x32\...\Steam App 24010) (Version:  - RailSimulator.com)
TransOcean - The Shipping Company (HKLM-x32\...\Steam App 289930) (Version:  - Deck 13 Hamburg)
Tupolev TU-144 complete package 2.0 FS2004  (HKLM\...\{66EF4249-9224-4833-8B9B-082BDD441E2F}) (Version:  - Thomas Ruth, Claudio Mussner)
Ultimate Airliners -  Super 80 FSX (HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Ultimate Airliners -  Super 80 FSX) (Version:  - )
vasFMC 2.1 (HKLM-x32\...\vasFMC MSFS Gauge_is1) (Version:  - VAS Project <contact@vas-project.org>)
ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.8.2 - Nikon)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1981296596-178752184-4134557248-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

05-03-2015 19:16:09 Windows Update
07-03-2015 12:38:52 Windows Update
08-03-2015 12:51:34 Windows Update
09-03-2015 19:24:18 Windows Update
10-03-2015 19:59:32 Removed Apple Application Support

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-09-19 19:09 - 00450709 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {07EB8B4E-4935-466F-BB1E-77F6A62206DF} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {18AFF996-1080-40AC-98FA-2CD013CE3D63} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {1A466FF1-3583-437C-9A42-A6772A3371C6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {1B9A2046-586E-42F1-9F08-516CD96E4AF3} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {22468040-F01B-486D-ABFD-F6936704259C} - System32\Tasks\{0C5E4CAC-CEC6-4B8A-998E-8AB66D342024} => pcalua.exe -a C:\Users\ChypsoTech\AppData\Roaming\istartsurf\UninstallManager.exe -c  -ptid=amt
Task: {2B4B4E55-B93E-4500-B501-E7FB4B59BA2D} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {2CFF36E2-2A40-487C-A82A-CD88A80416AA} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {355138E3-83AA-411A-BA52-FF57306907E7} - System32\Tasks\{DA6F367B-DCAF-4E59-B81E-8FA263BAEE2E} => pcalua.exe -a C:\Users\ChypsoTech\AppData\Roaming\mystartsearch\UninstallManager.exe -c  -ptid=cmi
Task: {369BBA2D-BC55-4075-9E6A-4A82B234D8E0} - System32\Tasks\{22690CE1-506C-45E4-84B0-12AB910D1811} => pcalua.exe -a "G:\Eigene Dateien\Downloads\Programm\avira_free_antivirus_898de.exe" -d "G:\Eigene Dateien\Downloads\Programm"
Task: {37444177-3A8E-46B7-9C3E-F78A3A03CBA4} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exe
Task: {4E294C49-1F76-41D4-A3A5-C13103CF2EA4} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {5925C00D-D9C5-4848-AB62-4557B2369D5F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {6FD80964-9761-4A0B-888B-52BE1B69B170} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {706B4E5D-6730-4399-B7BE-6572CE7ABDE1} - System32\Tasks\{856C2CEC-008A-48E9-9D91-8D995BADC57C} => pcalua.exe -a G:\FSX\SimObjects\Airplanes\Uninstal.exe -d G:\FSX\SimObjects\Airplanes
Task: {7A50A5AD-9933-4660-BD17-70C5D833C1FF} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {7F25C5B6-4FF7-4127-BD84-3C2B371CD4A0} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {87E4D51B-7422-44C6-BB8E-396B0CB20426} - System32\Tasks\{C26218CD-C759-441B-9F14-E6097931ABD3} => pcalua.exe -a "G:\Eigene Dateien\Downloads\a319alfs\A319_Alitalia_fsp.exe" -d "G:\Eigene Dateien\Downloads\a319alfs"
Task: {8C8F853F-C3C3-48D1-91BC-1B4E9E8AB19F} - \ASP No Task File <==== ATTENTION
Task: {8C90FD59-B256-4EB2-93DF-3A8D130C288C} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {8F9FB531-16AA-45EF-A18D-BFD97C4F05A6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-09] (Adobe Systems Incorporated)
Task: {9617EFAD-7CD1-4CC9-8633-2AAA79D390B8} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {AB2B776F-E90E-4612-B157-D10C2E28E2AE} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {ABA60E8E-AA0D-4232-B0FB-A3FABFF63349} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {BC78C35B-ABBC-4F66-999E-8BD941F7EB19} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {C4E8045F-A185-4A93-BE4D-1CFFA13CB384} - System32\Tasks\{9E846974-4276-4D8C-AAFD-10C6FEBFF197} => pcalua.exe -a "G:\Eigene Dateien\Downloads\epson324602eu.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {CB9C7666-6321-47A1-9F24-2C3936A36808} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {CBB91523-E57B-4FE1-8640-BE428C017792} - System32\Tasks\{EE9CC123-1A64-4404-A27B-39F2909E39C5} => pcalua.exe -a D:\Setup.exe -d D:\
Task: {CBFF4B59-E92F-4193-AA90-B65F7EBEFFB5} - \YourFile DownloaderUpdate No Task File <==== ATTENTION
Task: {D95BDDEA-4029-4B62-9311-73D3A89F4CA8} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {DCD62F08-AA1F-4CCD-ABCF-5C53C66714A1} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1981296596-178752184-4134557248-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {E34C2A7A-A431-421B-A036-CCA4A60BBB45} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {FDE80CF4-4C3C-4365-AB25-3D5863BD3B12} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\SpyHunter4.job => C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe

==================== Loaded Modules (whitelisted) ==============

2012-04-11 12:46 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-11-17 21:38 - 2009-11-05 08:40 - 00085504 _____ () C:\Windows\System32\cpwmon64.dll
2015-03-02 19:08 - 2015-03-02 19:08 - 00103424 _____ () C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp
2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2013-11-19 12:39 - 2012-09-24 17:28 - 00029984 _____ () C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe
2015-03-02 19:07 - 2015-03-02 19:07 - 00114176 _____ () C:\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-04-11 19:01 - 2012-02-17 19:55 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2014-08-20 19:14 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-08-20 19:14 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-08-20 19:14 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-08-20 19:14 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-08-20 19:14 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-11-19 12:39 - 2013-02-18 16:13 - 00106496 _____ () C:\Program Files (x86)\NETGEAR\A6200\GWlanController.dll
2013-11-19 12:39 - 2013-03-26 17:00 - 00018944 _____ () C:\Program Files (x86)\NETGEAR\A6200\GWPSController.dll
2013-03-12 17:10 - 2014-11-11 19:47 - 00774656 _____ () G:\Steam\SDL2.dll
2015-01-22 16:29 - 2014-12-02 01:29 - 05002752 _____ () G:\Steam\v8.dll
2015-01-22 16:29 - 2014-12-02 01:29 - 01612800 _____ () G:\Steam\icui18n.dll
2015-01-22 16:29 - 2014-12-02 01:29 - 01210368 _____ () G:\Steam\icuuc.dll
2014-05-21 20:10 - 2015-02-19 00:51 - 02360000 _____ () G:\Steam\video.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 02396672 _____ () G:\Steam\libavcodec-56.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 00442880 _____ () G:\Steam\libavutil-54.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 00479744 _____ () G:\Steam\libavformat-56.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 00332800 _____ () G:\Steam\libavresample-2.dll
2014-08-29 16:06 - 2014-12-01 22:31 - 00485888 _____ () G:\Steam\libswscale-3.dll
2012-04-12 21:40 - 2015-02-19 00:51 - 00702656 _____ () G:\Steam\bin\chromehtml.DLL
2012-04-12 21:40 - 2015-01-28 02:30 - 34641288 _____ () G:\Steam\bin\libcef.dll
2014-08-14 21:33 - 2015-01-28 02:30 - 01709960 _____ () G:\Steam\bin\ffmpegsumo.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:74603393
AlternateDataStreams: C:\Users\ChypsoTech\2013-08-18 13.15.26.jpg:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\ChypsoTech\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^ChypsoTech^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: KiesHelper => G:\Samsung\Kies\KiesHelper.exe /s
MSCONFIG\startupreg: KiesPDLR => G:\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesTrayAgent => G:\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: My Swisscom Assistant => C:\Program Files (x86)\Swisscom\My Swisscom Assistant\MySwisscomAssistant_Launcher.exe /auto
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: TomTomHOME.exe => "G:\TomTom HOME 2\TomTomHOMERunner.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-1981296596-178752184-4134557248-500 - Administrator - Disabled)
ChypsoTech (S-1-5-21-1981296596-178752184-4134557248-1000 - Administrator - Enabled) => C:\Users\ChypsoTech
Gast (S-1-5-21-1981296596-178752184-4134557248-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1981296596-178752184-4134557248-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: NVIDIA High Definition Audio
Description: NVIDIA High Definition Audio
Class Guid: 
Manufacturer: NVIDIA
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: SASDIFSV
Description: SASDIFSV
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: SASDIFSV
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: SASKUTIL
Description: SASKUTIL
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: SASKUTIL
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/09/2015 08:26:19 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.


System errors:
=============
Error: (03/10/2015 07:30:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/10/2015 07:30:35 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/10/2015 07:30:35 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/10/2015 07:30:35 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/10/2015 07:30:35 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/10/2015 07:30:35 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/10/2015 07:30:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/10/2015 07:30:24 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/10/2015 07:30:24 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/10/2015 07:30:22 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SASDIFSV
SASKUTIL


Microsoft Office Sessions:
=========================
Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/10/2015 07:34:55 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:34:48 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:31:58 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/09/2015 08:26:19 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 19%
Total physical RAM: 16366.67 MB
Available physical RAM: 13126.41 MB
Total Pagefile: 32731.52 MB
Available Pagefile: 29453.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:111.69 GB) (Free:13.15 GB) NTFS
Drive g: (Daten 1TB) (Fixed) (Total:931.51 GB) (Free:186.57 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: BBE07B61)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 111.8 GB) (Disk ID: 9D8EB713)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ComboFix 15-03-09.01 - ChypsoTech 12.03.2015  20:19:42.1.8 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.41.1031.18.16367.13854 [GMT 1:00]
ausgeführt von:: g:\eigene dateien\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\8731830257723766728
c:\programdata\8731830257723766728\cd5b15e575e1c3d0eb25e4d779e4f9ea.ini
c:\users\ChypsoTech\AppData\Local\Microsoft\Windows\Temporary Internet Files\AdvanceElite_iels
c:\users\ChypsoTech\AppData\Local\nsl86A7.tmp
c:\users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009
c:\users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp
c:\users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs
c:\users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\rnsl57CC.exe
c:\users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\Uninstall.exe
c:\users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\vnsgE977.tmp
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx\installer\ab.test.json
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx\installer\tempfile.t
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx\language\de.xml
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx\language\en.xml
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx\language\fr.xml
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx\scan_results\aps.scan.quick.results
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx\scan_results\aps.scan.results
c:\users\ChypsoTech\AppData\Roaming\AnyProtectEx\swf\mov01.swf
c:\users\ChypsoTech\AppData\Roaming\regsvr32.exe_log.txt
c:\users\ChypsoTech\AppData\Roaming\Roaming
c:\users\ChypsoTech\AppData\Roaming\Roaming\Quest3D\ShipSimExtreme\channels.lst
c:\windows\SysWow64\.txt
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
c:\windows\wininit.ini
g:\eigene dateien\Desktop\Internet Explorer.lnk
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NETHFDRV
-------\Legacy_NPF
-------\Service_NPF
-------\Service_cehufofi
-------\Service_xeqomesu
-------\Service_cehufofi
-------\Service_xeqomesu
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-02-12 bis 2015-03-12  ))))))))))))))))))))))))))))))
.
.
2015-03-12 19:22 . 2015-03-12 19:22	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-03-11 20:16 . 2015-01-29 09:07	11910896	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9CA6A20D-2D82-47AA-8F8D-1468CB7CBF23}\mpengine.dll
2015-03-10 19:39 . 2015-03-10 19:40	--------	d-----w-	C:\FRST
2015-03-10 19:25 . 2015-01-29 09:07	11910896	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-03-02 21:35 . 2015-03-12 19:14	129752	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-03-02 21:33 . 2015-03-02 21:33	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2015-03-02 21:33 . 2015-03-02 21:33	--------	d-----w-	c:\programdata\Malwarebytes
2015-03-02 21:33 . 2014-11-21 05:14	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2015-03-02 21:33 . 2014-11-21 05:14	93400	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-03-02 21:33 . 2014-11-21 05:14	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2015-03-02 21:32 . 2011-03-25 18:42	338432	----a-w-	c:\windows\SysWow64\sqlite36_engine.dll
2015-03-02 21:32 . 2011-05-13 10:16	493056	----a-w-	c:\windows\SysWow64\dhRichClient3.dll
2015-03-02 18:30 . 2015-02-24 16:05	318784	----a-w-	c:\windows\SysWow64\Gambali.dll
2015-03-02 18:30 . 2015-02-24 16:05	364120	----a-w-	c:\windows\system32\Gambali64.dll
2015-03-02 18:30 . 2015-03-02 18:34	--------	d-----w-	c:\programdata\2ef25f1272114645a21caf4eede15cca
2015-03-02 18:29 . 2015-03-02 21:45	--------	d-----w-	c:\program files (x86)\XTab
2015-03-02 18:29 . 2015-02-24 13:51	318808	----a-w-	c:\windows\SysWow64\BDL.dll
2015-03-02 18:19 . 2015-03-02 18:24	--------	d-----w-	c:\users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009
2015-03-02 17:57 . 2015-03-02 18:42	--------	d-----w-	c:\programdata\{8dbc5b3b-c216-4374-8dbc-c5b3bc216cef}
2015-03-02 17:57 . 2015-03-02 17:57	--------	d-----w-	c:\users\ChypsoTech\AppData\Roaming\Opera Software
2015-03-02 17:57 . 2015-03-02 17:57	--------	d-----w-	c:\users\ChypsoTech\AppData\Local\Opera Software
2015-03-02 17:56 . 2015-03-02 17:58	--------	d-----w-	c:\program files (x86)\Opera
2015-02-22 09:35 . 2014-09-18 09:26	1188440	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C6DD4CF8-8799-4E8A-9982-F4439C1CC789}\gapaengine.dll
2015-02-21 07:14 . 2015-02-21 07:14	--------	d-----w-	c:\users\ChypsoTech\AppData\Local\Steam
2015-02-12 17:04 . 2015-02-12 17:38	--------	d-----w-	c:\users\ChypsoTech\AppData\Roaming\ESS
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-11 20:21 . 2014-07-10 14:57	163504	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2015-03-09 19:33 . 2012-04-11 12:59	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-03-09 19:33 . 2011-11-17 20:36	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-03-03 13:17 . 2010-11-21 03:27	295552	------w-	c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-06-23 18:49	297128	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	131480	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	131480	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	131480	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	131480	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	131480	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	131480	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	131480	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	131480	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2013-04-22 720064]
"Steam"="g:\steam\steam.exe" [2015-02-18 2874048]
"Spybot-S&D Cleaning"="c:\program files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" [2014-06-24 4566952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2012-12-26 295072]
"KiesTrayAgent"="g:\samsung\Kies\KiesTrayAgent.exe" [2014-02-14 311616]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2014-06-24 4101576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
2;2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
R1 SASDIFSV;SASDIFSV;g:\\SASDIFSV64.SYS;g:\\SASDIFSV64.SYS [x]
R1 SASKUTIL;SASKUTIL;g:\\SASKUTIL64.SYS;g:\\SASKUTIL64.SYS [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 A6200;NETGEAR A6200 WiFi Adapter Driver;c:\windows\system32\DRIVERS\bcmwlhigh664.sys;c:\windows\SYSNATIVE\DRIVERS\bcmwlhigh664.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS;c:\windows\SYSNATIVE\drivers\BVRPMPR5a64.SYS [x]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys;c:\windows\SYSNATIVE\drivers\dgderdrv.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;Logitech Webcam 300(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\DRIVERS\nvstusb.sys;c:\windows\SYSNATIVE\DRIVERS\nvstusb.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys;c:\windows\SYSNATIVE\DRIVERS\psinknc.sys [x]
S2 NanoServiceMain;Panda Cloud Antivirus Service;g:\panda\PSANHost.exe;g:\panda\PSANHost.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys;c:\windows\SYSNATIVE\DRIVERS\PSINAflt.sys [x]
S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys;c:\windows\SYSNATIVE\DRIVERS\PSINFile.sys [x]
S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys;c:\windows\SYSNATIVE\DRIVERS\PSINProc.sys [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;g:\tomtom\TomTom HOME 2\TomTomHOMEService.exe;g:\tomtom\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 WNDA6200;NETGEAR A6200 Service;c:\program files (x86)\NETGEAR\A6200\WifiService.exe;c:\program files (x86)\NETGEAR\A6200\WifiService.exe [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2015-03-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 19:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-03-20 16:08	357432	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	164760	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	164760	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	164760	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	164760	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	164760	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	164760	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	164760	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08	164760	----a-w-	c:\users\ChypsoTech\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-04 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-04 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-04 418328]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
"GENIE"="c:\program files (x86)\NETGEAR\A6200\A6200.exe" [2013-02-18 348888]
"LanuchApp"="c:\program files (x86)\NETGEAR\A6200\LanuchApp.exe" [2012-07-11 15136]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-10-18 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 190536]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-01-30 1332296]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = ?type=hppp
uDefault_Search_URL = web/?type=dspp&q={searchTerms}
mDefault_Search_URL = web/?type=dspp&q={searchTerms}
mDefault_Page_URL = ?type=hppp
mStart Page = ?type=hppp
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = web/?type=dspp&q={searchTerms}
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\
FF - prefs.js: browser.startup.homepage - ?type=hppp
# Mozilla User Preferences
/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */
FF - user.js: browser.startup.homepage - ?type=hppp
FF - user.js: browser.startup.page - 1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
Notify-SDWinLogon - SDWinLogon.dll
Toolbar-10 - (no file)
AddRemove-LOGISTIKERV7_61 - c:\windows\system32\BXSetups\LogistikerIni07.exe
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}\bm_installer.exe
AddRemove-RESCUE 2013 - g:\rescue2013\uninstall.exe
AddRemove-Solaris Urbino 12 III - Version 2.01 by CNB-Projekts - - g:\eigene dateien\Downloads\CNB_SU12_v2.01_install\Uninstal.exe
AddRemove-Torino Caselle FSX - 0:\fsx\Uninstal.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
g:\steam\bin\steamwebhelper.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-03-12  20:27:18 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-03-12 19:27
.
Vor Suchlauf: 19 Verzeichnis(se), 13'400'391'680 Bytes frei
Nach Suchlauf: 27 Verzeichnis(se), 11'936'985'088 Bytes frei
.
- - End Of File - - B2BE99FEA292EC718FB68A6C75545A10
A36C5E4F47E84449FF07ED3517B43A31
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo
Hier die txt:

# AdwCleaner v4.112 - Bericht erstellt 14/03/2015 um 07:45:33
# Aktualisiert 09/03/2015 von Xplode
# Datenbank : 2015-03-05.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : ChypsoTech - CHYPSOTECH-PC1
# Gestarted von : G:\Eigene Dateien\Downloads\AdwCleaner_4.112.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Trymedia
Ordner Gelöscht : C:\Program Files (x86)\XTab
Ordner Gelöscht : C:\Users\ChypsoTech\AppData\Local\Gameo
Ordner Gelöscht : C:\Users\ChypsoTech\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\SendSpace
Ordner Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\WebExtend
Ordner Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\MailUpdate
Datei Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\821g70mr.default\user.js
Datei Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\user.js
Datei Gelöscht : C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\o7jx1ich.default\user.js

***** [ Geplante Tasks ] *****

Task Gelöscht : ASP
Task Gelöscht : LaunchSignup
Task Gelöscht : YourFile DownloaderUpdate

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\iomphmdalfmaifjccmagmllnicjoghhk
Schlüssel Gelöscht : HKCU\Software\Classes\pokki
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKCU\Software\Mozilla\Extends
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99E29823-2F67-41C3-8AA5-6425097A771F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4613B1C1-FBC0-43C3-A4B9-B1D6CD360BB3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{A25AC313-DD19-4238-ACA2-401D6BEE4321}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A25AC313-DD19-4238-ACA2-401D6BEE4321}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{14B46720-510A-47D8-9427-CF9A8D86A457}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\ClickConnect
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\simplytech
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\gameo
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SpeeditUp
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Myfree Codec
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Trymedia Systems
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue
Schlüssel Gelöscht : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\B696D3C37BD0D6C33A65D38BEC459181
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\B696D3C37BD0D6C33A65D38BEC459181
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B696D3C37BD0D6C33A65D38BEC459181

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17207


-\\ Mozilla Firefox v36.0.1 (x86 de)

[8qwaiwrj.default-1398932871281\prefs.js] - Zeile Gelöscht : user_pref("extensions.XPoAH23ys25ACoZi.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjg4qdnGrda6pdCFqTk8rjaFrTs\")>-1){return;}}catch(e){}try{var d=[[\"acebook\",\"flybrain.com\",\"[...]
[8qwaiwrj.default-1398932871281\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[8qwaiwrj.default-1398932871281\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

-\\ Google Chrome v


-\\ Opera v0.0.0.0


*************************

AdwCleaner[R0].txt - [8419 Bytes] - [14/03/2015 07:42:51]
AdwCleaner[S0].txt - [6956 Bytes] - [14/03/2015 07:45:33]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7015  Bytes] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 7 Professional x64
Ran by ChypsoTech on 14.03.2015 at  7:49:59.72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\ChypsoTech\appdata\local\{F643903C-386E-41CF-9BC0-F432B896D776}



~~~ FireFox

Successfully deleted the following from C:\Users\ChypsoTech\AppData\Roaming\mozilla\firefox\profiles\8qwaiwrj.default-1398932871281\prefs.js

user_pref("browser.search.searchEnginesURL", "www.google.ch");
user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");
user_pref("browser.search.searchengine.ptid", "cmi");
user_pref("browser.search.searchengine.uid", "WDCXWD10EZRX-00A8LB0_WD-WMC1U266409864098");
user_pref("extensions.XPoAH23ys25ACoZi.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjg4qdnGrda6pdCFqTk8rjaFrTs\")>-1){return;}}catch(e){}try{var d=[[\"aceb
Emptied folder: C:\Users\ChypsoTech\AppData\Roaming\mozilla\firefox\profiles\8qwaiwrj.default-1398932871281\minidumps [19 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.03.2015 at  7:52:02.84
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Malwarebytes? Frisches FRST Log?

Also ich hab nur noch das bekommen.
Seit dem letzten Programm kommt dies nicht mehr vor.

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by ChypsoTech (administrator) on CHYPSOTECH-PC1 on 17-03-2015 18:32:41
Running from G:\Eigene Dateien\Downloads\Programm
Loaded Profiles: ChypsoTech (Available profiles: ChypsoTech)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Panda Security, S.L.) G:\Panda\PSANHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NETGEAR,Inc.) C:\Program Files (x86)\NETGEAR\A6200\A6200.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Valve Corporation) G:\Steam\Steam.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Samsung Electronics Co., Ltd.) G:\Samsung\Kies\KiesTrayAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(TomTom) G:\TomTom\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Valve Corporation) G:\Steam\bin\steamwebhelper.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\wermgr.exe
(Microsoft Corporation) C:\Windows\System32\wermgr.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [GENIE] => C:\Program Files (x86)\NETGEAR\A6200\A6200.exe [348888 2013-02-18] (NETGEAR,Inc.)
HKLM\...\Run: [LanuchApp] => C:\Program Files (x86)\NETGEAR\A6200\LanuchApp.exe [15136 2012-07-11] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295072 2012-12-26] (RealNetworks, Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => G:\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [Steam] => G:\Steam\steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1981296596-178752184-4134557248-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2012-11-29] (RealDownloader)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281
FF Homepage: https://www.google.ch/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-03-09] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0-git -> G:\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-09] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1212152.dll [2014-05-30] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2012-02-04] (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2012-12-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-06-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-06-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2012-12-26] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2012-11-29] (RealDownloader)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: samsung.com/SamsungLinkPCPlugin -> G:\Eigene Dateien\Documents\Samsung Link\utils\npSamsungLinkPCPlugin.dll No File
FF SearchPlugin: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\searchplugins\google-images.xml [2015-03-02]
FF SearchPlugin: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\searchplugins\google-maps.xml [2015-03-02]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-03-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-03-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2015-03-07]
FF HKLM-x32\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2012-12-26]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-06-26]

Chrome: 
=======
CHR Profile: C:\Users\ChypsoTech\AppData\Local\Google\Chrome\User Data\default
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 NanoServiceMain; G:\Panda\PSANHost.exe [140608 2011-04-28] (Panda Security, S.L.)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 TomTomHOMEService; G:\TomTom\TomTom HOME 2\TomTomHOMEService.exe [93040 2014-06-05] (TomTom)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WNDA6200; C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe [29984 2012-09-24] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 A6200; C:\Windows\System32\DRIVERS\bcmwlhigh664.sys [2567984 2013-02-28] (Broadcom Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [161032 2012-01-05] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [114760 2011-04-28] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [149768 2011-11-23] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [121928 2011-04-28] (Panda Security, S.L.)
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S1 SASDIFSV; \??\G:\\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\G:\\SASKUTIL64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-17 18:16 - 2015-03-17 18:16 - 00283376 _____ () C:\Windows\Minidump\031715-9406-01.dmp
2015-03-15 13:03 - 2015-03-15 13:03 - 00283376 _____ () C:\Windows\Minidump\031515-9453-01.dmp
2015-03-14 10:25 - 2015-03-14 10:25 - 00283760 _____ () C:\Windows\Minidump\031415-10186-01.dmp
2015-03-14 07:35 - 2015-03-14 07:35 - 00283760 _____ () C:\Windows\Minidump\031415-8221-01.dmp
2015-03-14 07:27 - 2015-03-14 07:27 - 00283376 _____ () C:\Windows\Minidump\031415-7690-01.dmp
2015-03-14 07:15 - 2015-03-14 07:45 - 00000000 ____D () C:\AdwCleaner
2015-03-14 07:10 - 2015-03-14 07:10 - 00283376 _____ () C:\Windows\Minidump\031415-8127-01.dmp
2015-03-12 20:27 - 2015-03-12 20:27 - 00029748 _____ () C:\ComboFix.txt
2015-03-12 20:24 - 2015-03-12 20:24 - 00283376 _____ () C:\Windows\Minidump\031215-8658-01.dmp
2015-03-12 20:18 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-12 20:18 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-12 20:18 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-12 20:16 - 2015-03-12 20:27 - 00000000 ____D () C:\Qoobox
2015-03-12 20:16 - 2015-03-12 20:26 - 00000000 ____D () C:\Windows\erdnt
2015-03-11 20:16 - 2015-03-11 20:16 - 00283760 _____ () C:\Windows\Minidump\031115-12823-01.dmp
2015-03-11 20:15 - 2015-03-11 20:15 - 00283376 _____ () C:\Windows\Minidump\031115-16255-01.dmp
2015-03-10 20:39 - 2015-03-17 18:32 - 00000000 ____D () C:\FRST
2015-03-10 19:29 - 2015-03-10 19:29 - 00290320 _____ () C:\Windows\Minidump\031015-20826-01.dmp
2015-03-10 19:27 - 2015-03-10 19:27 - 00283760 _____ () C:\Windows\Minidump\031015-10654-01.dmp
2015-03-10 19:26 - 2015-03-10 19:26 - 00283376 _____ () C:\Windows\Minidump\031015-15007-01.dmp
2015-03-09 20:22 - 2015-03-09 20:22 - 00283760 _____ () C:\Windows\Minidump\030915-8970-01.dmp
2015-03-08 00:05 - 2015-03-08 00:05 - 00283760 _____ () C:\Windows\Minidump\030815-15132-01.dmp
2015-03-07 12:45 - 2015-03-07 12:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 17:17 - 2015-03-05 17:17 - 00283376 _____ () C:\Windows\Minidump\030515-9313-01.dmp
2015-03-02 23:51 - 2015-03-02 23:51 - 00283760 _____ () C:\Windows\Minidump\030215-9375-01.dmp
2015-03-02 22:35 - 2015-03-14 07:36 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-02 22:33 - 2015-03-02 22:33 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-02 22:33 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-02 22:33 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-02 22:33 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-02 22:32 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2015-03-02 22:32 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2015-03-02 22:20 - 2015-03-02 22:20 - 00283760 _____ () C:\Windows\Minidump\030215-13509-01.dmp
2015-03-02 20:01 - 2015-03-02 20:01 - 00283760 _____ () C:\Windows\Minidump\030215-19359-01.dmp
2015-03-02 19:40 - 2015-03-02 19:40 - 00283760 _____ () C:\Windows\Minidump\030215-8798-01.dmp
2015-03-02 19:30 - 2015-03-02 19:34 - 00000000 ____D () C:\ProgramData\2ef25f1272114645a21caf4eede15cca
2015-03-02 19:30 - 2015-03-02 19:30 - 00003184 _____ () C:\Windows\System32\Tasks\{DA6F367B-DCAF-4E59-B81E-8FA263BAEE2E}
2015-03-02 19:29 - 2015-02-24 14:51 - 00318808 _____ (OM Inc.) C:\Windows\SysWOW64\BDL.dll
2015-03-02 19:19 - 2015-03-02 19:24 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009
2015-03-02 18:57 - 2015-03-02 19:42 - 00000000 ____D () C:\ProgramData\{8dbc5b3b-c216-4374-8dbc-c5b3bc216cef}
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\Opera Software
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Opera Software
2015-03-02 18:56 - 2015-03-02 18:58 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-02 17:44 - 2015-03-02 17:44 - 00283376 _____ () C:\Windows\Minidump\030215-20950-01.dmp
2015-02-27 16:42 - 2015-02-27 16:42 - 00283376 _____ () C:\Windows\Minidump\022715-8096-01.dmp
2015-02-24 19:12 - 2015-02-24 19:12 - 00283376 _____ () C:\Windows\Minidump\022415-9079-01.dmp
2015-02-21 08:14 - 2015-02-21 08:14 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Steam
2015-02-21 08:11 - 2015-02-21 08:11 - 00283376 _____ () C:\Windows\Minidump\022115-7893-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-17 18:26 - 2011-11-17 19:03 - 01259055 _____ () C:\Windows\WindowsUpdate.log
2015-03-17 18:25 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-17 18:25 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-17 18:23 - 2011-04-12 08:43 - 14231314 _____ () C:\Windows\system32\perfh007.dat
2015-03-17 18:23 - 2011-04-12 08:43 - 04407910 _____ () C:\Windows\system32\perfc007.dat
2015-03-17 18:23 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-17 18:16 - 2014-05-01 14:27 - 00065137 _____ () C:\Windows\setupact.log
2015-03-17 18:16 - 2012-05-13 12:18 - 00026577 _____ () C:\Windows\SysWOW64\temp.txt
2015-03-17 18:16 - 2012-05-03 14:35 - 00000000 ____D () C:\Windows\Minidump
2015-03-17 18:16 - 2012-04-11 12:46 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-03-17 18:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-15 13:04 - 2012-04-11 13:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-14 07:42 - 2012-10-28 11:44 - 00393216 ___SH () C:\Users\ChypsoTech\Thumbs.db
2015-03-14 07:35 - 2014-05-08 16:38 - 00038304 _____ () C:\Windows\PFRO.log
2015-03-12 21:00 - 2012-04-21 14:10 - 00000000 ___RD () C:\Users\ChypsoTech\Dropbox
2015-03-12 20:56 - 2012-04-21 14:08 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-12 20:56 - 2012-04-21 14:08 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\Dropbox
2015-03-12 20:27 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-03-12 20:25 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-03-12 20:23 - 2009-07-14 03:34 - 95944704 _____ () C:\Windows\system32\config\software.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 66584576 _____ () C:\Windows\system32\config\system.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 44040192 _____ () C:\Windows\system32\config\components.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 05505024 _____ () C:\Windows\system32\config\default.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2015-03-12 20:21 - 2013-09-16 15:10 - 00000000 ____D () C:\ProgramData\TEMP
2015-03-12 20:18 - 2014-08-20 19:14 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-03-09 20:33 - 2014-08-21 17:31 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Adobe
2015-03-09 20:33 - 2012-04-11 13:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-09 20:33 - 2012-04-11 13:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-09 20:33 - 2011-11-17 21:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-09 19:24 - 2011-11-17 19:03 - 00000000 ____D () C:\Users\ChypsoTech
2015-03-09 19:17 - 2012-05-08 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-03-03 18:47 - 2014-04-30 16:46 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-03-03 18:47 - 2014-04-30 16:46 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-03-03 14:17 - 2010-11-21 04:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-02 22:23 - 2014-05-01 14:45 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2015-03-02 20:04 - 2011-11-17 21:19 - 00116872 _____ () C:\Users\ChypsoTech\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-02 20:00 - 2009-07-14 05:45 - 00424840 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-02 19:44 - 2011-11-17 19:03 - 00001427 _____ () C:\Users\ChypsoTech\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

==================== Files in the root of some directories =======

2012-06-08 16:31 - 2012-09-10 11:22 - 0000000 _____ () C:\Users\ChypsoTech\AppData\Roaming\FileIn.cns
2012-06-08 16:31 - 2012-09-10 11:22 - 0000000 _____ () C:\Users\ChypsoTech\AppData\Roaming\FileOut.cns
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Chords
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Morph
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Synthesizers
2013-03-09 11:51 - 2013-11-19 10:57 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Internet Services
2012-05-14 17:39 - 2012-05-14 17:39 - 0008704 ___SH () C:\Users\ChypsoTech\AppData\Roaming\Thumbs.db
2012-04-11 20:37 - 2012-04-11 20:37 - 0033134 _____ () C:\Users\ChypsoTech\AppData\Roaming\UserTile.png
2014-09-03 17:21 - 2014-09-03 17:21 - 0000017 _____ () C:\Users\ChypsoTech\AppData\Local\resmon.resmoncfg
2012-04-29 10:16 - 2012-04-29 10:16 - 0000040 ___SH () C:\ProgramData\.zreglib
2013-11-19 10:57 - 2013-11-19 10:57 - 0000000 _____ () C:\ProgramData\Graphics
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Capture
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Manipulation
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Units
2013-03-09 11:51 - 2013-11-19 10:57 - 0000268 ___RH () C:\ProgramData\Jingles
2013-03-09 11:52 - 2013-03-09 11:52 - 0000012 ___RH () C:\ProgramData\Keyboard Layouts
2013-03-09 11:52 - 2013-03-09 11:52 - 0000012 ___RH () C:\ProgramData\LaserPrinter
2013-03-09 11:51 - 2013-11-19 10:57 - 0000012 ___RH () C:\ProgramData\NetServices
2013-03-09 11:51 - 2013-11-19 10:57 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2013-03-09 11:52 - 2013-10-09 16:57 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2013-03-09 11:52 - 2013-10-09 16:42 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2013-03-09 11:52 - 2013-10-09 16:48 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT

Some content of TEMP:
====================
C:\Users\ChypsoTech\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpugo8vc.dll
C:\Users\ChypsoTech\AppData\Local\Temp\Quarantine.exe
C:\Users\ChypsoTech\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-05 19:56

==================== End Of Log ============================
         

--- --- ---

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 17.03.2015
Suchlauf-Zeit: 18:34:09
Logdatei: 1.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.17.06
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: ChypsoTech

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 381938
Verstrichene Zeit: 6 Min, 48 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Hallo
Nein jetzt geht alles wie es muss besten Dank für die Hilfe

mach trotzdem obige Sachen bitte

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=6ecac1c5c067df4e91fedb8c807d123f
# engine=22986
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-20 01:38:58
# local_time=2015-03-20 02:38:58 (+0100, Mitteleuropäische Zeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Panda Cloud Antivirus'
# compatibility_mode=1552 16777213 62 51 89907641 255368627 0 0
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 3052253 49799532 0 0
# scanned=978386
# found=18
# cleaned=16
# scan_time=29856
sh=5F0546EC86F3E27F0EEC4D5D5451EDC630907654 ft=1 fh=c71c001198f425ea vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{A877E93B-B09A-46B7-A45C-F8B87394CBCD}\Custom.dll"
sh=2BEC3A89EB5BF0BED90AD0923C7D12D44AEB3111 ft=1 fh=169012abcb12da52 vn="Win32/SuspLibLoad.B Trojaner" ac=I fn="C:\Windows\SysWOW64\flt1chk4.dll"
sh=F91E422A1957748E2459D0F06EA177AFC3840E52 ft=1 fh=7cc70ecb4dbc4f60 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Panda\Tools\PandaSecurityTb.exe"
sh=5F0546EC86F3E27F0EEC4D5D5451EDC630907654 ft=1 fh=c71c001198f425ea vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\ProgramData\InstallMate\{A877E93B-B09A-46B7-A45C-F8B87394CBCD}\Custom.dll"
sh=E780478F47E923EBE919918D475B5A4F4B1FBA26 ft=1 fh=fe85c3d959983663 vn="Win32/VOPackage.BC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Local\nsl86A7.tmp.vir"
sh=2A00E55E20E5E990198487B1DBB286F1F11873FD ft=1 fh=6ae3532747ebe69d vn="Variante von Win32/Adware.ConvertAd.CA Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp.vir"
sh=9181CFEF4289509FC0CDADFEC2D4F0C3560EF2C7 ft=1 fh=cf31ee3bf884122e vn="Variante von Win32/Adware.ConvertAd.BR Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs.vir"
sh=3D8DFCFD50CBAEC88F3FD03BC41051951EA54749 ft=1 fh=6d22dfbed69d8a93 vn="Variante von Win32/Adware.ConvertAd.BQ Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\rnsl57CC.exe.vir"
sh=C977746FBD78413E3235665A270124BEF2BA815B ft=1 fh=ac74c4de1eba167d vn="Win32/Adware.ConvertAd.BS Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\Uninstall.exe.vir"
sh=88F0A978AECDB35BDD654EE8285A9E1B348121CA ft=1 fh=3dd71bde7b4dfff5 vn="Win32/Adware.ConvertAd.BS Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\vnsgE977.tmp.vir"
sh=D794A56AF7698559DB003855BA6CCC7E3053AEF8 ft=1 fh=c71c0011af32ee7b vn="Variante von Win32/Adware.ConvertAd.BH Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009\onsq9FFC.tmp"
sh=3D8DFCFD50CBAEC88F3FD03BC41051951EA54749 ft=1 fh=6d22dfbed69d8a93 vn="Variante von Win32/Adware.ConvertAd.BQ Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009\rnsq9FFB.exe"
sh=6047B95E401E3E12ED551C8980CBC3E6EC6EBB95 ft=1 fh=be590a4afa4bdc0b vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\ChypsoTech\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1CDFIZWT\Setup[2].exe"
sh=2C10B9C81CAF34A35D11194C8028A4E568C5D90F ft=1 fh=5acc72dbb0395480 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\ChypsoTech\AppData\Roaming\Flight One Software\GEX\GEXInterface.exe"
sh=2BEC3A89EB5BF0BED90AD0923C7D12D44AEB3111 ft=1 fh=169012abcb12da52 vn="Win32/SuspLibLoad.B Trojaner (Gesäubert - in Quarantäne kopiert)" ac=C fn="C:\Windows\System32\flt1chk4.dll"
sh=A94C08A49E7477B3267BB83E5556296860AC7AC0 ft=1 fh=96656d0df0d3eaee vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="G:\Eigene Dateien\Downloads\Programm\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe"
sh=AE05BBCFA551A3BE53C8666F9F339088E399D840 ft=1 fh=a19c984a6b762bd5 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="G:\Eigene Dateien\Downloads\Programm\SpyBot Search Destroy - CHIP-Installer.exe"
sh=F91E422A1957748E2459D0F06EA177AFC3840E52 ft=1 fh=7cc70ecb4dbc4f60 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="G:\Panda\Tools\PandaSecurityTb.exe"
         

 Results of screen317's Security Check version 0.99.97  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Microsoft Security Essentials   
 Antivirus up to date!  
`````````Anti-malware/Other Utilities Check:````````` 
 SpyHunter 4    
 Spybot - Search & Destroy 
  Java 64-bit 8 Update 31  
 Adobe Flash Player 17.0.0.134  
 Adobe Reader XI  
 Mozilla Firefox (36.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe 
 Microsoft Security Essentials msseces.exe 
 Spybot Teatimer.exe is disabled! 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by ChypsoTech (administrator) on CHYPSOTECH-PC1 on 20-03-2015 06:20:20
Running from G:\Eigene Dateien\Downloads\Programm
Loaded Profiles: ChypsoTech (Available profiles: ChypsoTech)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Panda Security, S.L.) G:\Panda\PSANHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NETGEAR,Inc.) C:\Program Files (x86)\NETGEAR\A6200\A6200.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Valve Corporation) G:\Steam\Steam.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Samsung Electronics Co., Ltd.) G:\Samsung\Kies\KiesTrayAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(TomTom) G:\TomTom\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Valve Corporation) G:\Steam\bin\steamwebhelper.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Valve Corporation) G:\Steam\bin\steamwebhelper.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [GENIE] => C:\Program Files (x86)\NETGEAR\A6200\A6200.exe [348888 2013-02-18] (NETGEAR,Inc.)
HKLM\...\Run: [LanuchApp] => C:\Program Files (x86)\NETGEAR\A6200\LanuchApp.exe [15136 2012-07-11] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295072 2012-12-26] (RealNetworks, Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => G:\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [Steam] => G:\Steam\steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1981296596-178752184-4134557248-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1981296596-178752184-4134557248-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.ch/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2012-11-29] (RealDownloader)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281
FF Homepage: https://www.google.ch/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-18] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0-git -> G:\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-18] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1212152.dll [2014-05-30] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2012-02-04] (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2012-12-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-06-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-06-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2012-12-26] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2012-11-29] (RealDownloader)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: samsung.com/SamsungLinkPCPlugin -> G:\Eigene Dateien\Documents\Samsung Link\utils\npSamsungLinkPCPlugin.dll No File
FF SearchPlugin: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\searchplugins\google-images.xml [2015-03-02]
FF SearchPlugin: C:\Users\ChypsoTech\AppData\Roaming\Mozilla\Firefox\Profiles\8qwaiwrj.default-1398932871281\searchplugins\google-maps.xml [2015-03-02]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-03-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-03-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2015-03-07]
FF HKLM-x32\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2012-12-26]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKU\S-1-5-21-1981296596-178752184-4134557248-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-06-26]

Chrome: 
=======
CHR Profile: C:\Users\ChypsoTech\AppData\Local\Google\Chrome\User Data\default
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 NanoServiceMain; G:\Panda\PSANHost.exe [140608 2011-04-28] (Panda Security, S.L.)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 TomTomHOMEService; G:\TomTom\TomTom HOME 2\TomTomHOMEService.exe [93040 2014-06-05] (TomTom)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WNDA6200; C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe [29984 2012-09-24] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 A6200; C:\Windows\System32\DRIVERS\bcmwlhigh664.sys [2567984 2013-02-28] (Broadcom Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [161032 2012-01-05] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [114760 2011-04-28] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [149768 2011-11-23] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [121928 2011-04-28] (Panda Security, S.L.)
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S1 SASDIFSV; \??\G:\\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\G:\\SASKUTIL64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-19 18:10 - 2015-03-19 18:10 - 00283376 _____ () C:\Windows\Minidump\031915-9110-01.dmp
2015-03-17 18:50 - 2015-03-17 18:50 - 00000866 _____ () C:\Users\Public\Desktop\Advanced Omnibus Driver.lnk
2015-03-17 18:50 - 2015-03-17 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Omnibus Driver
2015-03-17 18:50 - 2015-03-17 18:50 - 00000000 ____D () C:\PeDePe Software
2015-03-17 18:16 - 2015-03-17 18:16 - 00283376 _____ () C:\Windows\Minidump\031715-9406-01.dmp
2015-03-15 13:03 - 2015-03-15 13:03 - 00283376 _____ () C:\Windows\Minidump\031515-9453-01.dmp
2015-03-14 10:25 - 2015-03-14 10:25 - 00283760 _____ () C:\Windows\Minidump\031415-10186-01.dmp
2015-03-14 07:35 - 2015-03-14 07:35 - 00283760 _____ () C:\Windows\Minidump\031415-8221-01.dmp
2015-03-14 07:27 - 2015-03-14 07:27 - 00283376 _____ () C:\Windows\Minidump\031415-7690-01.dmp
2015-03-14 07:15 - 2015-03-14 07:45 - 00000000 ____D () C:\AdwCleaner
2015-03-14 07:10 - 2015-03-14 07:10 - 00283376 _____ () C:\Windows\Minidump\031415-8127-01.dmp
2015-03-12 20:27 - 2015-03-12 20:27 - 00029748 _____ () C:\ComboFix.txt
2015-03-12 20:24 - 2015-03-12 20:24 - 00283376 _____ () C:\Windows\Minidump\031215-8658-01.dmp
2015-03-12 20:18 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-12 20:18 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-12 20:18 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-12 20:18 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-12 20:16 - 2015-03-12 20:27 - 00000000 ____D () C:\Qoobox
2015-03-12 20:16 - 2015-03-12 20:26 - 00000000 ____D () C:\Windows\erdnt
2015-03-11 20:16 - 2015-03-11 20:16 - 00283760 _____ () C:\Windows\Minidump\031115-12823-01.dmp
2015-03-11 20:15 - 2015-03-11 20:15 - 00283376 _____ () C:\Windows\Minidump\031115-16255-01.dmp
2015-03-10 20:39 - 2015-03-20 06:20 - 00000000 ____D () C:\FRST
2015-03-10 19:29 - 2015-03-10 19:29 - 00290320 _____ () C:\Windows\Minidump\031015-20826-01.dmp
2015-03-10 19:27 - 2015-03-10 19:27 - 00283760 _____ () C:\Windows\Minidump\031015-10654-01.dmp
2015-03-10 19:26 - 2015-03-10 19:26 - 00283376 _____ () C:\Windows\Minidump\031015-15007-01.dmp
2015-03-09 20:22 - 2015-03-09 20:22 - 00283760 _____ () C:\Windows\Minidump\030915-8970-01.dmp
2015-03-08 00:05 - 2015-03-08 00:05 - 00283760 _____ () C:\Windows\Minidump\030815-15132-01.dmp
2015-03-07 12:45 - 2015-03-07 12:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 17:17 - 2015-03-05 17:17 - 00283376 _____ () C:\Windows\Minidump\030515-9313-01.dmp
2015-03-02 23:51 - 2015-03-02 23:51 - 00283760 _____ () C:\Windows\Minidump\030215-9375-01.dmp
2015-03-02 22:35 - 2015-03-17 18:43 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-02 22:33 - 2015-03-02 22:33 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-02 22:33 - 2015-03-02 22:33 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-02 22:33 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-02 22:33 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-02 22:33 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-02 22:32 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2015-03-02 22:32 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2015-03-02 22:20 - 2015-03-02 22:20 - 00283760 _____ () C:\Windows\Minidump\030215-13509-01.dmp
2015-03-02 20:01 - 2015-03-02 20:01 - 00283760 _____ () C:\Windows\Minidump\030215-19359-01.dmp
2015-03-02 19:40 - 2015-03-02 19:40 - 00283760 _____ () C:\Windows\Minidump\030215-8798-01.dmp
2015-03-02 19:30 - 2015-03-02 19:34 - 00000000 ____D () C:\ProgramData\2ef25f1272114645a21caf4eede15cca
2015-03-02 19:30 - 2015-03-02 19:30 - 00003184 _____ () C:\Windows\System32\Tasks\{DA6F367B-DCAF-4E59-B81E-8FA263BAEE2E}
2015-03-02 19:29 - 2015-02-24 14:51 - 00318808 _____ (OM Inc.) C:\Windows\SysWOW64\BDL.dll
2015-03-02 19:19 - 2015-03-20 02:38 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009
2015-03-02 18:57 - 2015-03-02 19:42 - 00000000 ____D () C:\ProgramData\{8dbc5b3b-c216-4374-8dbc-c5b3bc216cef}
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\Opera Software
2015-03-02 18:57 - 2015-03-02 18:57 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Opera Software
2015-03-02 18:56 - 2015-03-02 18:58 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-02 17:44 - 2015-03-02 17:44 - 00283376 _____ () C:\Windows\Minidump\030215-20950-01.dmp
2015-02-27 16:42 - 2015-02-27 16:42 - 00283376 _____ () C:\Windows\Minidump\022715-8096-01.dmp
2015-02-24 19:12 - 2015-02-24 19:12 - 00283376 _____ () C:\Windows\Minidump\022415-9079-01.dmp
2015-02-21 08:14 - 2015-02-21 08:14 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Steam
2015-02-21 08:11 - 2015-02-21 08:11 - 00283376 _____ () C:\Windows\Minidump\022115-7893-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-20 06:04 - 2012-04-11 13:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-20 05:23 - 2011-11-17 19:03 - 01432172 _____ () C:\Windows\WindowsUpdate.log
2015-03-19 18:18 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-19 18:18 - 2009-07-14 05:45 - 00032080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-19 18:16 - 2011-04-12 08:43 - 14260734 _____ () C:\Windows\system32\perfh007.dat
2015-03-19 18:16 - 2011-04-12 08:43 - 04417282 _____ () C:\Windows\system32\perfc007.dat
2015-03-19 18:16 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-19 18:10 - 2014-05-01 14:27 - 00065641 _____ () C:\Windows\setupact.log
2015-03-19 18:10 - 2012-05-13 12:18 - 00026577 _____ () C:\Windows\SysWOW64\temp.txt
2015-03-19 18:10 - 2012-05-03 14:35 - 00000000 ____D () C:\Windows\Minidump
2015-03-19 18:10 - 2012-04-11 12:46 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-03-19 18:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-18 17:57 - 2014-08-21 17:31 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Local\Adobe
2015-03-18 17:57 - 2012-04-11 13:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-18 17:56 - 2012-04-11 13:59 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-18 17:56 - 2011-11-17 21:36 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-14 07:42 - 2012-10-28 11:44 - 00393216 ___SH () C:\Users\ChypsoTech\Thumbs.db
2015-03-14 07:35 - 2014-05-08 16:38 - 00038304 _____ () C:\Windows\PFRO.log
2015-03-12 21:00 - 2012-04-21 14:10 - 00000000 ___RD () C:\Users\ChypsoTech\Dropbox
2015-03-12 20:56 - 2012-04-21 14:08 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-12 20:56 - 2012-04-21 14:08 - 00000000 ____D () C:\Users\ChypsoTech\AppData\Roaming\Dropbox
2015-03-12 20:27 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-03-12 20:25 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-03-12 20:23 - 2009-07-14 03:34 - 95944704 _____ () C:\Windows\system32\config\software.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 66584576 _____ () C:\Windows\system32\config\system.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 44040192 _____ () C:\Windows\system32\config\components.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 05505024 _____ () C:\Windows\system32\config\default.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2015-03-12 20:23 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2015-03-12 20:21 - 2013-09-16 15:10 - 00000000 ____D () C:\ProgramData\TEMP
2015-03-12 20:18 - 2014-08-20 19:14 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-03-09 19:24 - 2011-11-17 19:03 - 00000000 ____D () C:\Users\ChypsoTech
2015-03-09 19:17 - 2012-05-08 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-03-03 18:47 - 2014-04-30 16:46 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-03-03 18:47 - 2014-04-30 16:46 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-03-03 14:17 - 2010-11-21 04:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-02 22:23 - 2014-05-01 14:45 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2015-03-02 20:04 - 2011-11-17 21:19 - 00116872 _____ () C:\Users\ChypsoTech\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-02 20:00 - 2009-07-14 05:45 - 00424840 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-02 19:44 - 2011-11-17 19:03 - 00001427 _____ () C:\Users\ChypsoTech\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

==================== Files in the root of some directories =======

2012-06-08 16:31 - 2012-09-10 11:22 - 0000000 _____ () C:\Users\ChypsoTech\AppData\Roaming\FileIn.cns
2012-06-08 16:31 - 2012-09-10 11:22 - 0000000 _____ () C:\Users\ChypsoTech\AppData\Roaming\FileOut.cns
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Chords
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Morph
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Hybrid Synthesizers
2013-03-09 11:51 - 2013-11-19 10:57 - 0000268 ___RH () C:\Users\ChypsoTech\AppData\Roaming\Internet Services
2012-05-14 17:39 - 2012-05-14 17:39 - 0008704 ___SH () C:\Users\ChypsoTech\AppData\Roaming\Thumbs.db
2012-04-11 20:37 - 2012-04-11 20:37 - 0033134 _____ () C:\Users\ChypsoTech\AppData\Roaming\UserTile.png
2014-09-03 17:21 - 2014-09-03 17:21 - 0000017 _____ () C:\Users\ChypsoTech\AppData\Local\resmon.resmoncfg
2012-04-29 10:16 - 2012-04-29 10:16 - 0000040 ___SH () C:\ProgramData\.zreglib
2013-11-19 10:57 - 2013-11-19 10:57 - 0000000 _____ () C:\ProgramData\Graphics
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Capture
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Manipulation
2013-03-09 11:52 - 2013-03-09 11:52 - 0000268 ___RH () C:\ProgramData\Image Units
2013-03-09 11:51 - 2013-11-19 10:57 - 0000268 ___RH () C:\ProgramData\Jingles
2013-03-09 11:52 - 2013-03-09 11:52 - 0000012 ___RH () C:\ProgramData\Keyboard Layouts
2013-03-09 11:52 - 2013-03-09 11:52 - 0000012 ___RH () C:\ProgramData\LaserPrinter
2013-03-09 11:51 - 2013-11-19 10:57 - 0000012 ___RH () C:\ProgramData\NetServices
2013-03-09 11:51 - 2013-11-19 10:57 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2013-03-09 11:52 - 2013-10-09 16:57 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2013-03-09 11:52 - 2013-10-09 16:42 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2013-03-09 11:52 - 2013-10-09 16:48 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT

Some content of TEMP:
====================
C:\Users\ChypsoTech\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpugo8vc.dll
C:\Users\ChypsoTech\AppData\Local\Temp\Quarantine.exe
C:\Users\ChypsoTech\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-20 03:01

==================== End Of Log ============================
         

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\Users\All Users\InstallMate\{A877E93B-B09A-46B7-A45C-F8B87394CBCD}\Custom.dll

C:\Windows\SysWOW64\flt1chk4.dll

C:\Panda\Tools\PandaSecurityTb.exe

C:\ProgramData\InstallMate\{A877E93B-B09A-46B7-A45C-F8B87394CBCD}\Custom.dll

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Local\nsl86A7.tmp.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\rnsl57CC.exe.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\Uninstall.exe.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\vnsgE977.tmp.vir

C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009\onsq9FFC.tmp

C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009\rnsq9FFB.exe

C:\Users\ChypsoTech\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1CDFIZWT\Setup[2].exe

C:\Users\ChypsoTech\AppData\Roaming\Flight One Software\GEX\GEXInterface.exe

C:\Windows\System32\flt1chk4.dll

G:\Eigene Dateien\Downloads\Programm\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

G:\Eigene Dateien\Downloads\Programm\SpyBot Search Destroy - CHIP-Installer.exe

G:\Panda\Tools\PandaSecurityTb.exe

HKU\S-1-5-21-1981296596-178752184-4134557248-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Noch Probleme?

Ich hoffe ist das wo du meinst:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by ChypsoTech at 2015-03-20 23:28:31 Run:1
Running from G:\Eigene Dateien\Downloads\Programm
Loaded Profiles: ChypsoTech (Available profiles: ChypsoTech)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\All Users\InstallMate\{A877E93B-B09A-46B7-A45C-F8B87394CBCD}\Custom.dll

C:\Windows\SysWOW64\flt1chk4.dll

C:\Panda\Tools\PandaSecurityTb.exe

C:\ProgramData\InstallMate\{A877E93B-B09A-46B7-A45C-F8B87394CBCD}\Custom.dll

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Local\nsl86A7.tmp.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\rnsl57CC.exe.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\Uninstall.exe.vir

C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\vnsgE977.tmp.vir

C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009\onsq9FFC.tmp

C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009\rnsq9FFB.exe

C:\Users\ChypsoTech\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1CDFIZWT\Setup[2].exe

C:\Users\ChypsoTech\AppData\Roaming\Flight One Software\GEX\GEXInterface.exe

C:\Windows\System32\flt1chk4.dll

G:\Eigene Dateien\Downloads\Programm\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

G:\Eigene Dateien\Downloads\Programm\SpyBot Search Destroy - CHIP-Installer.exe

G:\Panda\Tools\PandaSecurityTb.exe

HKU\S-1-5-21-1981296596-178752184-4134557248-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
Emptytemp:
*****************

"C:\Users\All Users\InstallMate\{A877E93B-B09A-46B7-A45C-F8B87394CBCD}\Custom.dll" => File/Directory not found.
C:\Windows\SysWOW64\flt1chk4.dll => Moved successfully.
"C:\Panda\Tools\PandaSecurityTb.exe" => File/Directory not found.
"C:\ProgramData\InstallMate\{A877E93B-B09A-46B7-A45C-F8B87394CBCD}\Custom.dll" => File/Directory not found.
"C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Local\nsl86A7.tmp.vir" => File/Directory not found.
"C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\jnsw6181.tmp.vir" => File/Directory not found.
"C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\nsb2A74.tmpfs.vir" => File/Directory not found.
"C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\rnsl57CC.exe.vir" => File/Directory not found.
"C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\Uninstall.exe.vir" => File/Directory not found.
"C:\Qoobox\Quarantine\C\Users\ChypsoTech\AppData\Roaming\03000200-1425323245-0500-0006-000700080009\vnsgE977.tmp.vir" => File/Directory not found.
"C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009\onsq9FFC.tmp" => File/Directory not found.
"C:\Users\ChypsoTech\AppData\Local\03000200-1425323944-0500-0006-000700080009\rnsq9FFB.exe" => File/Directory not found.
"C:\Users\ChypsoTech\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1CDFIZWT\Setup[2].exe" => File/Directory not found.
"C:\Users\ChypsoTech\AppData\Roaming\Flight One Software\GEX\GEXInterface.exe" => File/Directory not found.
"C:\Windows\System32\flt1chk4.dll" => File/Directory not found.
"G:\Eigene Dateien\Downloads\Programm\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe" => File/Directory not found.
"G:\Eigene Dateien\Downloads\Programm\SpyBot Search Destroy - CHIP-Installer.exe" => File/Directory not found.
"G:\Panda\Tools\PandaSecurityTb.exe" => File/Directory not found.
"HKU\S-1-5-21-1981296596-178752184-4134557248-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
EmptyTemp: => Removed 648.8 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 23:28:44 ====