Anfänger sucht Hilfe bei Virenproblem

NeedHelpX27 · 14.03.2015, 00:29

Hey,

habe seit längerer Zeit Probleme mit Viren, mein PC wird immer langsamer, kann kaum ein Program öffnen, hab tausende Ads egal welchen Browser ich öffne &' es öffnet sich jedes mal "Der und der Skript möchte auf das Programm zugreifen"

Kann mir da jemand helfen?

Mit freundlichen Grüßen,

Needhelpx27

cosinus · 14.03.2015, 00:42

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

NeedHelpX27 · 14.03.2015, 01:17

Hey,

danke für deine schnelle Antwort hier die FRST, hab leider keine logdateien von davor

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by User (administrator) on USER-PC on 14-03-2015 01:06:23
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\Windows\SysWOW64\nethtsrv.exe
() C:\Program Files (x86)\Re-markit\Re-markit155.exe
() C:\Windows\SysWOW64\netupdsrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft) C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
() C:\Program Files (x86)\Re-markit\Re-markit_wd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Spotify Ltd) C:\Users\User\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Yontoo LLC) C:\Users\User\AppData\Roaming\Yontoo\YontooDesktop.exe
() C:\Users\User\AppData\Local\Lollipop\lollipop_07231510.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
() C:\Program Files (x86)\Bench\BService\1.1\bservice.exe
() C:\Program Files (x86)\Bench\Wd\wd.exe
() C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Users\User\AppData\Roaming\Opvau\qeelg.exe
(Piriform Ltd) C:\Users\User\Desktop\CCleaner64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Piriform Ltd) C:\Users\User\Desktop\CCleaner64.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-04-15] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [766656 2014-01-09] ()
HKLM-x32\...\Run: [BService] => C:\Program Files (x86)\Bench\BService\1.1\bservice.exe [52736 2014-08-20] ()
HKLM-x32\...\Run: [Wd] => C:\Program Files (x86)\Bench\Wd\wd.exe [92672 2014-08-20] ()
HKLM-x32\...\Run: [BService64] => C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe [110592 2014-08-20] ()
HKLM-x32\...\RunOnce: [Savings Wizard-repairJob] => wscript.exe "C:\Users\User\AppData\Local\Savings Wizard\repair.js" "Savings Wizard-repairJob"
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3619160 2015-01-27] (Electronic Arts)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Google Update] => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-05-16] (Google Inc.)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Spotify Web Helper] => C:\Users\User\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1959992 2015-03-12] (Spotify Ltd)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Yontoo Desktop] => C:\Users\User\AppData\Roaming\Yontoo\YontooDesktop.exe [47392 2013-05-21] (Yontoo LLC)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [NextLive] => C:\Windows\SysWOW64\rundll32.exe "C:\Users\User\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Syvoqomaek] => C:\Users\User\AppData\Roaming\Opvau\qeelg.exe [250880 2013-12-13] ()
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [lollipop_07231510] => c:\users\user\appdata\local\lollipop\lollipop_07231510.exe [3443200 2014-07-23] ()
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31346784 2015-02-26] (Skype Technologies S.A.)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Spotify] => C:\Users\User\AppData\Roaming\Spotify\Spotify.exe [6611512 2015-03-12] (Spotify Ltd)
AppInit_DLLs: c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll => c:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\loader.dll [1958880 2013-11-18] ()
AppInit_DLLs:  c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [S-1-5-21-131629521-1761861761-2204564278-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-131629521-1761861761-2204564278-1000] => http=127.0.0.1:13828
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390940167&from=amt&uid=ST1000DM003-1CH162_Z1D4B160XXXXZ1D4B160
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390940167&from=amt&uid=ST1000DM003-1CH162_Z1D4B160XXXXZ1D4B160
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.dell.com
URLSearchHook: HKU\S-1-5-21-131629521-1761861761-2204564278-1000 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKU\S-1-5-21-131629521-1761861761-2204564278-1000 -> DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-131629521-1761861761-2204564278-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-131629521-1761861761-2204564278-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-131629521-1761861761-2204564278-1000 -> {4357FCA8-9F0A-4C98-90A8-B02A802F3430} URL = hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=96F394DE800FD85C
SearchScopes: HKU\S-1-5-21-131629521-1761861761-2204564278-1000 -> {EF7DD3C7-485D-4E0D-B132-7156F3F20890} URL = hxxp://www.search.ask.com/web?tpid=ORJ&o=100000027&pf=V7&p2=%5EU3%5EOSJ000%5EYY%5EDE&gct=sb&itbv=12.10.3.24&apn_uid=7B7F33F3-5C48-425D-AF0E-A1902FBC934E&apn_ptnrs=%5EU3&apn_dtid=%5EOSJ000%5EYY%5EDE&apn_dbr=cr_27.0.1453.94&doi=2014-01-27&trgb=IE,CR&q={searchTerms}&psv=
BHO: DP1815 -> {11111111-1111-1111-1111-110411721120} -> C:\Program Files (x86)\DP1815\DP1815-bho64.dll [2014-01-24] (mrlmedia)
BHO: Savings Wizard BHO -> {5682CA62-1A80-40AE-82A0-B67833CE75FF} -> C:\Program Files (x86)\Savings Wizard\FrameworkBHO64.dll [2014-10-23] ()
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: ValueApps -> {93DBF2BB-A2B3-4683-A92E-57E60751F346} -> C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll [2013-12-22] (Conduit Ltd.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: No Name -> {D4027C7F-154A-4066-A1AD-4243D8127440} ->  No File
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: DP1815 -> {11111111-1111-1111-1111-110411721120} -> C:\Program Files (x86)\DP1815\DP1815-bho.dll [2014-01-24] (mrlmedia)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2013-05-06] (DivX, LLC)
BHO-x32: Savings Wizard BHO -> {5682CA62-1A80-40AE-82A0-B67833CE75FF} -> C:\Program Files (x86)\Savings Wizard\FrameworkBHO.dll [2014-10-23] ()
BHO-x32: No Name -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-06-04] (Oracle Corporation)
BHO-x32: ValueApps -> {93DBF2BB-A2B3-4683-A92E-57E60751F346} -> C:\Program Files (x86)\Conduit\ValueApps\IE\ValueAppsLoader.dll [2013-12-22] (Conduit Ltd.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-06-04] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-131629521-1761861761-2204564278-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Hosts: 54.225.95.126	ajakpekbmnkgnjbpajgkdhimcbeoocam
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default
FF SearchEngineOrder.3: Bing 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-07] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-07] ()
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2013-05-06] (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-06-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-06-04] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll [2011-11-17] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin HKU\S-1-5-21-131629521-1761861761-2204564278-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll [2011-12-01] ( )
FF Plugin HKU\S-1-5-21-131629521-1761861761-2204564278-1000: @tools.google.com/Google Update;version=3 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin HKU\S-1-5-21-131629521-1761861761-2204564278-1000: @tools.google.com/Google Update;version=9 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin HKU\S-1-5-21-131629521-1761861761-2204564278-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\user.js [2014-10-17]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\searchplugins\bingp.xml [2014-09-18]
FF Extension: Widget context - C:\Users\User\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-22]
FF Extension: DP1815 - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\Extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com [2015-01-15]
FF Extension: McAfee Security Scan Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8} [2014-06-13]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-15]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-05-22]
FF HKLM-x32\...\Firefox\Extensions: [ext@flashenhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha5513.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha5513\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewerV1alpha148.net] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha148\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha1748.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1748\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha203.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha203\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaWatchV1home45.net] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home45\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaBuzzV1mode5614.net] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode5614\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@RichMediaViewV1release483.net] - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release483\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@RichMediaViewV1release5902.net] - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release5902\ff
FF HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Firefox\Extensions: [{13b2a6cd-c8be-4191-a05b-b843a6b780cb}] - C:\Program Files (x86)\Re-markit\155.xpi
FF Extension: Re-markit - C:\Program Files (x86)\Re-markit\155.xpi [2014-02-18]
FF HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Savings Wizard) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajakpekbmnkgnjbpajgkdhimcbeoocam [2015-03-13]
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-03-13]
CHR Extension: (MSN Homepage & Bing Search Engine) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd [2015-01-07]
CHR Extension: (DP1815) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjllbogbaogimpilgdginhalhhbmhiob [2015-03-13]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]
CHR Extension: (Skype Click to Call) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-01-07]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-23]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2014-05-23]
CHR HKU\S-1-5-21-131629521-1761861761-2204564278-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06]
StartMenuInternet: Google Chrome.G4AI6EQVRWUWFUFYCXWDO5CMGY - C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-28] (Advanced Micro Devices, Inc.) [File not signed]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2015-01-12] (Hi-Rez Studios) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 NetHttpService; C:\Windows\SysWOW64\nethtsrv.exe [339456 2015-02-15] () [File not signed]
R2 Re-markit; C:\Program Files (x86)\Re-markit\Re-markit155.exe [182272 2014-02-18] () [File not signed] <==== ATTENTION
R2 ServiceUpdater; C:\Windows\SysWOW64\netupdsrv.exe [190976 2015-02-15] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 Yontoo Desktop Updater; C:\Users\User\AppData\Roaming\Yontoo\YontooDesktop.exe [47392 2013-05-21] (Yontoo LLC)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [22128 2012-03-08] ()
R1 nethfdrv; C:\Windows\system32\drivers\nethfdrv.sys [46160 2015-02-15] (nethfdrv)
S3 RdpVideoMiniport; C:\Windows\System32\drivers\rdpvideominiport.sys [19456 2012-08-23] (Microsoft Corporation) [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-14 01:06 - 2015-03-14 01:06 - 00022763 _____ () C:\Users\User\Desktop\FRST.txt
2015-03-14 01:06 - 2015-03-14 01:06 - 00000000 ____D () C:\FRST
2015-03-14 01:04 - 2015-03-14 01:04 - 02095616 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-03-13 23:41 - 2015-03-13 23:41 - 00000000 ____D () C:\Users\User\Desktop\Neuer Ordner
2015-03-13 19:20 - 2015-03-13 19:20 - 00000687 _____ () C:\awh5DA9.tmp
2015-03-12 19:25 - 2015-03-12 19:26 - 00053214 _____ () C:\Users\User\Documents\cc_20150312_192532.reg
2015-03-12 19:20 - 2015-03-13 22:59 - 00000000 ____D () C:\Program Files\CCleaner
2015-03-12 19:20 - 2015-03-12 19:20 - 00002770 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-03-12 19:19 - 2015-03-12 19:19 - 04197696 _____ (Piriform Ltd) C:\Users\User\Downloads\ccsetup503_slim.exe
2015-03-12 10:59 - 2015-03-12 10:59 - 00000687 _____ () C:\awh5225.tmp
2015-03-11 19:16 - 2015-03-06 06:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 19:16 - 2015-03-06 06:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 19:16 - 2015-03-06 06:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 19:16 - 2015-03-06 06:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 19:16 - 2015-03-06 06:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 19:16 - 2015-03-06 06:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 19:16 - 2015-03-06 06:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 19:16 - 2015-03-06 06:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 19:16 - 2015-03-06 06:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 19:16 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 19:16 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 19:16 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 19:16 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 19:16 - 2015-02-26 04:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 19:16 - 2015-02-20 05:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 19:16 - 2015-02-20 05:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 19:16 - 2015-02-20 05:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 19:16 - 2015-02-20 05:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 19:16 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 19:16 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 19:16 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 19:16 - 2015-02-20 05:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 19:16 - 2015-02-20 04:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 19:16 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 19:16 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 19:16 - 2015-02-13 06:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 19:16 - 2015-02-10 17:44 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 19:16 - 2015-02-10 17:43 - 01539584 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 19:16 - 2015-02-10 17:43 - 00610816 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 19:16 - 2015-02-10 17:43 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 12297728 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 09059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 02468864 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00495616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 19:16 - 2015-02-10 17:41 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 19:16 - 2015-02-10 17:41 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-11 19:16 - 2015-02-10 17:41 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-11 19:16 - 2015-02-10 17:40 - 01538048 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 19:16 - 2015-02-10 17:21 - 01267712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-11 19:16 - 2015-02-10 17:21 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-11 19:16 - 2015-02-10 17:21 - 00428544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-11 19:16 - 2015-02-10 17:21 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 11026432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 06030336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 02087424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00345600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-11 19:16 - 2015-02-10 17:19 - 01466368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-11 19:16 - 2015-02-10 17:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-11 19:16 - 2015-02-10 17:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-03-11 19:16 - 2015-02-10 17:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-03-11 19:16 - 2015-02-10 16:21 - 00482816 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-11 19:16 - 2015-02-10 15:59 - 00386048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-03-11 19:16 - 2015-02-10 14:50 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 19:16 - 2015-02-10 14:21 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-11 19:16 - 2015-02-04 04:16 - 00392192 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 19:16 - 2015-02-04 03:54 - 00318464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 19:16 - 2015-02-03 04:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 19:16 - 2015-02-03 04:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 19:16 - 2015-02-03 04:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 19:16 - 2015-02-03 04:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 19:16 - 2015-02-03 04:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 02644992 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 19:16 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 19:16 - 2015-02-03 04:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll

Hier Teil 2 von FRST :

Code:

ATTFilter

2015-03-11 19:16 - 2015-02-03 04:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 19:16 - 2015-02-03 04:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 19:16 - 2015-02-03 04:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 19:16 - 2015-02-03 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 19:16 - 2015-02-03 04:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 19:16 - 2015-02-03 04:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 19:16 - 2015-02-03 04:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 19:16 - 2015-02-03 04:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 02135040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 01011200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 19:16 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 19:16 - 2015-02-03 04:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 19:16 - 2015-02-03 04:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 19:16 - 2015-02-03 04:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 19:16 - 2015-02-03 04:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 19:16 - 2015-02-03 04:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 19:16 - 2015-02-03 03:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 19:16 - 2015-01-31 00:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 19:16 - 2015-01-17 03:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 19:16 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-11 19:16 - 2014-10-31 23:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 19:16 - 2014-06-28 01:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-11 19:16 - 2014-06-28 01:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-11 19:06 - 2015-03-11 19:06 - 00000687 _____ () C:\awh3255.tmp
2015-03-10 22:01 - 2015-03-10 22:01 - 00000063 _____ () C:\Users\User\Desktop\K.I.Z..url
2015-03-10 14:03 - 2015-03-10 14:03 - 00000687 _____ () C:\awhBA3.tmp
2015-03-09 20:10 - 2015-03-09 20:10 - 00000687 _____ () C:\awh50F.tmp
2015-03-09 16:25 - 2015-03-09 16:25 - 00000687 _____ () C:\awh12C4.tmp
2015-03-08 20:22 - 2015-03-08 20:22 - 00000687 _____ () C:\awh4A87.tmp
2015-03-08 20:21 - 2015-03-08 20:21 - 00000000 ____D () C:\Users\User\Tracing
2015-03-07 11:05 - 2015-03-07 11:05 - 00000687 _____ () C:\awh3CB1.tmp
2015-03-03 16:28 - 2015-03-03 16:28 - 00000687 _____ () C:\awhFE2C.tmp
2015-03-02 21:48 - 2015-03-02 21:48 - 00000687 _____ () C:\awh39B5.tmp
2015-03-01 15:55 - 2015-03-01 15:55 - 00000687 _____ () C:\awh517A.tmp
2015-02-28 18:40 - 2015-02-28 18:40 - 00000687 _____ () C:\awh991.tmp
2015-02-20 21:32 - 2015-02-20 21:32 - 00000687 _____ () C:\awhC976.tmp
2015-02-20 21:31 - 2015-02-20 21:31 - 01203488 _____ () C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer (1).exe
2015-02-20 21:19 - 2015-02-20 21:19 - 00000000 ____D () C:\Users\User\AppData\Roaming\vlc
2015-02-20 21:17 - 2015-02-20 21:17 - 00004006 _____ () C:\Windows\System32\Tasks\LaunchSignup
2015-02-20 21:17 - 2015-02-20 21:17 - 00001066 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-02-20 21:17 - 2015-02-20 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-02-20 21:17 - 2015-02-20 21:17 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2015-02-20 21:16 - 2015-02-20 21:16 - 01203488 _____ () C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer.exe
2015-02-20 21:16 - 2015-02-20 21:16 - 00001452 _____ () C:\Users\User\Desktop\Goodgame Empire.lnk
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\Users\User\AppData\Roaming\DesktopIconGoodgame
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\Users\User\AppData\Roaming\Abelssoft
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\Users\User\AppData\Local\Abelssoft
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2015-02-20 17:18 - 2015-02-20 17:18 - 00000687 _____ () C:\awhC34E.tmp
2015-02-19 17:40 - 2015-02-19 17:40 - 07416088 _____ (Piriform Ltd) C:\Users\User\Desktop\CCleaner64.exe
2015-02-19 15:53 - 2015-02-19 15:53 - 00000000 ____D () C:\Users\User\AppData\Local\Steam
2015-02-15 21:42 - 2015-02-15 21:42 - 00000000 ____D () C:\Users\User\Desktop\mc txp
2015-02-15 19:19 - 2015-02-15 19:19 - 00339456 _____ () C:\Windows\SysWOW64\nethtsrv.exe
2015-02-15 19:19 - 2015-02-15 19:19 - 00190976 _____ () C:\Windows\SysWOW64\netupdsrv.exe
2015-02-15 19:19 - 2015-02-15 19:19 - 00140288 _____ () C:\Windows\SysWOW64\installd.exe
2015-02-15 19:19 - 2015-02-15 19:19 - 00108544 _____ () C:\Windows\SysWOW64\hfnapi.dll
2015-02-15 19:19 - 2015-02-15 19:19 - 00046160 _____ (nethfdrv) C:\Windows\system32\Drivers\nethfdrv.sys
2015-02-15 19:18 - 2015-02-15 19:18 - 00438272 _____ () C:\Windows\SysWOW64\hfpapi.dll
2015-02-15 16:15 - 2015-02-15 16:15 - 00000687 _____ () C:\awh3330.tmp
2015-02-14 14:05 - 2015-02-14 14:05 - 00000687 _____ () C:\awh17C4.tmp
2015-02-13 19:23 - 2015-02-13 19:23 - 00000687 _____ () C:\awhAD7D.tmp
2015-02-12 16:14 - 2015-02-12 16:14 - 00000687 _____ () C:\awh1812.tmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-14 01:06 - 2014-05-23 11:29 - 00002019 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lollipop.lnk
2015-03-14 01:04 - 2014-01-15 18:07 - 00000000 ____D () C:\Users\User\AppData\Local\Lollipop
2015-03-14 01:02 - 2013-12-14 10:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-14 00:54 - 2013-05-16 14:01 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000UA.job
2015-03-14 00:41 - 2014-02-14 20:41 - 00000288 _____ () C:\Windows\Tasks\Digital Sites.job
2015-03-14 00:41 - 2013-08-03 13:41 - 00000094 _____ () C:\Users\User\AppData\Roaming\WB.CFG
2015-03-14 00:41 - 2013-05-22 20:41 - 00000282 _____ () C:\Windows\Tasks\DSite.job
2015-03-13 23:36 - 2014-01-24 23:31 - 00001932 _____ () C:\Windows\Tasks\DP1815-chromeinstaller.job
2015-03-13 23:31 - 2014-01-24 23:31 - 00002030 _____ () C:\Windows\Tasks\DP1815-updater.job
2015-03-13 23:31 - 2014-01-24 23:31 - 00001968 _____ () C:\Windows\Tasks\DP1815-firefoxinstaller.job
2015-03-13 23:31 - 2014-01-24 23:31 - 00001198 _____ () C:\Windows\Tasks\DP1815-codedownloader.job
2015-03-13 23:31 - 2014-01-24 23:31 - 00001098 _____ () C:\Windows\Tasks\DP1815-enabler.job
2015-03-13 23:11 - 2014-01-15 18:13 - 00000000 ____D () C:\Program Files (x86)\AmiExt
2015-03-13 23:11 - 2013-08-31 20:10 - 00000000 ____D () C:\Users\User\AppData\Local\Ubisoft Game Launcher
2015-03-13 23:11 - 2013-08-31 20:10 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2015-03-13 23:10 - 2013-05-22 16:05 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-03-13 23:10 - 2013-05-16 21:02 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-13 23:09 - 2013-05-22 20:43 - 00000000 ____D () C:\Program Files (x86)\Xvid
2015-03-13 23:09 - 2013-05-22 20:43 - 00000000 ____D () C:\Program Files (x86)\DSP-worx
2015-03-13 23:06 - 2014-02-26 19:55 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2015-03-13 23:03 - 2013-11-15 14:42 - 00000000 ____D () C:\Windows\Minidump
2015-03-13 23:03 - 2013-11-11 03:10 - 00000000 ____D () C:\Windows\Panther
2015-03-13 23:01 - 2013-05-17 12:31 - 00000000 ____D () C:\Users\User\AppData\Local\Spotify
2015-03-13 23:01 - 2013-05-16 17:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2015-03-13 22:35 - 2014-01-28 21:15 - 00000342 _____ () C:\Windows\Tasks\bench-sys.job
2015-03-13 22:20 - 2013-05-22 20:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\Yontoo
2015-03-13 21:45 - 2014-01-28 21:15 - 00000342 _____ () C:\Windows\Tasks\bench-S-1-5-21-131629521-1761861761-2204564278-1000.job
2015-03-13 21:36 - 2013-05-17 12:31 - 00000000 ____D () C:\Users\User\AppData\Roaming\Spotify
2015-03-13 20:49 - 2013-11-10 18:34 - 01116205 ____N () C:\Windows\WindowsUpdate.log
2015-03-13 19:24 - 2013-08-04 20:10 - 00000000 ____D () C:\ProgramData\Origin
2015-03-13 19:22 - 2009-07-14 05:45 - 00029664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-13 19:22 - 2009-07-14 05:45 - 00029664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-13 19:21 - 2014-01-15 18:07 - 00000358 _____ () C:\Windows\Tasks\AmiUpdXp.job
2015-03-13 19:20 - 2014-02-18 13:52 - 00000382 _____ () C:\Windows\Tasks\Re-markit Update.job
2015-03-13 19:20 - 2014-02-18 13:52 - 00000368 _____ () C:\Windows\Tasks\Re-markit_wd.job
2015-03-13 19:20 - 2014-01-15 18:13 - 00000000 ____D () C:\Users\User\AppData\Roaming\newnext.me
2015-03-13 19:20 - 2013-08-04 20:09 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-03-13 19:15 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-12 12:23 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-03-12 11:06 - 2013-06-13 13:14 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-12 10:55 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-12 10:54 - 2009-07-14 05:45 - 00275272 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 10:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-12 10:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-11 19:55 - 2013-05-16 14:02 - 00002350 _____ () C:\Users\User\Desktop\Google Chrome.lnk
2015-03-11 19:12 - 2014-01-24 23:34 - 00000000 ____D () C:\Users\User\Documents\RegistryDr
2015-03-11 19:07 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-10 14:10 - 2014-12-17 21:37 - 00003850 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1418848675
2015-03-08 20:20 - 2014-03-15 09:49 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-08 20:20 - 2013-05-16 17:27 - 00000000 ____D () C:\ProgramData\Skype
2015-02-24 03:17 - 2010-11-21 04:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-20 21:28 - 2013-11-10 18:49 - 00060056 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-20 21:17 - 2013-11-11 03:08 - 00697276 _____ () C:\Windows\system32\perfh007.dat
2015-02-20 21:17 - 2013-11-11 03:08 - 00148314 _____ () C:\Windows\system32\perfc007.dat
2015-02-20 21:17 - 2009-07-14 06:13 - 01614852 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-19 15:51 - 2013-05-16 14:01 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000Core.job
2015-02-15 22:08 - 2013-06-04 17:50 - 00000000 ____D () C:\Users\User\AppData\Roaming\.minecraft
2015-02-15 21:39 - 2015-02-07 23:46 - 00000000 ____D () C:\Program Files (x86)\Minecraft

==================== Files in the root of some directories =======

2014-08-24 17:41 - 2014-08-24 17:41 - 0000039 _____ () C:\Users\User\AppData\Roaming\TheHunterSettings_steam_live.cfg
2015-02-08 00:03 - 2015-02-08 00:03 - 0035328 ___SH () C:\Users\User\AppData\Roaming\Thumbs.db
2013-08-03 13:41 - 2015-03-14 00:41 - 0000094 _____ () C:\Users\User\AppData\Roaming\WB.CFG
2013-06-15 10:48 - 2014-01-31 10:41 - 0000005 _____ () C:\Users\User\AppData\Roaming\WBPU-TTL.DAT

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\DealPlyUpdateVer.exe
C:\Users\User\AppData\Local\Temp\uninst1.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-10 14:28

==================== End Of Log ============================

--- --- ---

--- --- ---

Hier ist noch die Addition :

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by User at 2015-03-14 01:07:15
Running from C:\Users\User\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
Black & White® 2 (HKLM-x32\...\{D9E52CD1-9DF1-4A8A-9BDC-1E5E53982F2B}) (Version: 1.00.0000 - Lionhead Studios)
Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32\...\Steam App 10190) (Version:  - Infinity Ward)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version:  - Infinity Ward - Sledgehammer Games)
Call of Duty: Modern Warfare 3 (HKLM-x32\...\Steam App 42680) (Version:  - Infinity Ward)
CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.0.3717 - CDBurnerXP)
Codec Pack Packages (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Codec Pack Packages) (Version:  - ) <==== ATTENTION
Company of Heroes 2 – OPEN BETA (HKLM-x32\...\Steam App 231430) (Version:  - )
Cube World version 0.0.1 (HKLM-x32\...\{D692A0E0-1BBB-4E9C-826E-4254EE330830}_is1) (Version: 0.0.1 - Picroma)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
DealPly (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\DealPly) (Version:  - ) <==== ATTENTION
Desktopicon amazon.de (HKLM\...\DesktopIconAmazon) (Version: 1.0.1 - )
DirectVobSub 2.40.4209 (HKLM-x32\...\vsfilter_is1) (Version: 2.40.4209 - MPC-HC Team)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.8 - DivX, LLC)
DP1815 (HKLM-x32\...\DP1815) (Version: 1.32.153.0 - mrlmedia) <==== ATTENTION
Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology) Hidden
ffdshow v1.1.4399 [2012-03-22] (HKLM-x32\...\ffdshow_is1) (Version: 1.1.4399.0 - )
FUSSBALL MANAGER 13 (HKLM-x32\...\{80AF0300-866F-400F-A350-D53E3C3E34E0}) (Version: 1.0.4.0 - Electronic Arts)
Google Chrome (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Java 7 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217021FF}) (Version: 7.0.210 - Oracle)
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version:  - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Lightspark 0.5.3-git (HKLM-x32\...\Lightspark) (Version: 0.5.3-git - Lightspark Team)
Lollipop (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\lollipop_07231510) (Version:  - Lollipop Network, S.L.) <==== ATTENTION
ManiaPlanet (HKLM-x32\...\ManiaPlanet_is1) (Version:  - Nadeo)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\{0E3DAF3D-FF69-345A-A99E-1FED304CA083}) (Version:  - )
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.6109.5003 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mobogenie (HKLM-x32\...\Mobogenie) (Version:  - Mobogenie.com) <==== ATTENTION
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
OffersWizard Network System Driver (HKLM-x32\...\inethnfd) (Version: 1.0.0.3001 - ) <==== ATTENTION
ON_OFF Charge B12.0308.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
OpenSource Flash Video Splitter 1.0.0.5 (HKLM-x32\...\OpenSource Flash Video Splitter) (Version: 1.0.0.5 - )
Opera 12.15 (HKLM-x32\...\Opera 12.15.1748) (Version: 12.15.1748 - Opera Software ASA)
Opera Stable 28.0.1750.40 (HKLM-x32\...\Opera 28.0.1750.40) (Version: 28.0.1750.40 - Opera Software ASA)
Origin (HKLM-x32\...\Origin) (Version: 9.3.1.4482 - Electronic Arts, Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6650 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Registry Dr (HKLM-x32\...\{13F65354-29C2-41B0-B0FE-E858FB622FDD}) (Version: 2.4.7 - EuroTrade A.L. Ltd) <==== ATTENTION!
Re-markit (HKLM-x32\...\d3d35679-b737-410b-b7b7-f11c6d1a8fe8) (Version:  - Re-markit Software) <==== ATTENTION
Savings Wizard (HKLM-x32\...\38906_Savings Wizard) (Version: 1.0 - Gratifying Apps) <==== ATTENTION
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.2 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.2.103 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2531.0 - Hi-Rez Studios)
Software Version Updater (HKLM-x32\...\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}) (Version: 1.1.4.2 - ) <==== ATTENTION
Spotify (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Spotify) (Version: 1.0.1.1060.gc75ebdfd - Spotify AB)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
Update for Codec Pack (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\DSite) (Version:  - ) <==== ATTENTION
ValueApps (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\ValueApps) (Version: 1.4.0.3 - Conduit) <==== ATTENTION
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
War Thunder Launcher 1.0.1.269 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version:  - 2013 Gaijin Entertainment Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Yontoo 2.053 (HKLM\...\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 2.053 - Yontoo LLC) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-131629521-1761861761-2204564278-1000_Classes\CLSID\{939A0D04-0E07-48FE-A463-6623B70C3A96}\localserver32 -> C:\Users\User\AppData\Local\Conduit\ValueApps\IE\64\ValueApps.exe (Conduit Ltd.)
CustomCLSID: HKU\S-1-5-21-131629521-1761861761-2204564278-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-131629521-1761861761-2204564278-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)

==================== Restore Points  =========================

10-03-2015 22:01:54 Windows Update
12-03-2015 00:50:56 Windows Update
13-03-2015 19:19:34 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-01-12 14:53 - 00000872 ____A C:\Windows\system32\Drivers\etc\hosts
54.225.95.126	ajakpekbmnkgnjbpajgkdhimcbeoocam

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0EFCB515-CA2B-44BC-AB8A-D7911745CB13} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {15BE5816-10FB-4727-AC75-459F1FD32AEF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000Core => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-16] (Google Inc.)
Task: {1A0EE860-9E2C-4E08-BB5C-C2DF0EBE12A5} - System32\Tasks\Re-markit_wd => C:\Program Files (x86)\Re-markit\Re-markit_wd.exe [2014-02-18] () <==== ATTENTION
Task: {1D7075E4-00E8-4AC7-A883-D123CC815F7F} - System32\Tasks\DSite => C:\Users\User\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe [2013-05-22] () <==== ATTENTION
Task: {245C061E-1617-4C3F-A0A6-B9D83B402DB4} - System32\Tasks\RegistryDr_Popup => C:\Program Files (x86)\Registry Dr\Splash.exe [2014-01-22] () <==== ATTENTION
Task: {26BFB48D-2A3D-4C25-A992-5582D13E8588} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)
Task: {366CD661-2D5D-44B7-9C71-126D5B372FA3} - System32\Tasks\AmiUpdXp => C:\Users\User\AppData\Local\16147\Updater.exe [2014-10-07] () <==== ATTENTION
Task: {38350C35-9197-4987-8D1E-52BBC873F4CF} - System32\Tasks\DP1815-enabler => C:\Program Files (x86)\DP1815\DP1815-enabler.exe [2014-01-24] (mrlmedia) <==== ATTENTION
Task: {51241761-DEE6-4B70-8E1B-500F1983043D} - System32\Tasks\DP1815-chromeinstaller => C:\Program Files (x86)\DP1815\DP1815-chromeinstaller.exe [2014-01-24] (mrlmedia) <==== ATTENTION
Task: {575C9190-AB37-45DC-A454-4EF6ED57B5C8} - System32\Tasks\bench-sys => C:\Program Files (x86)\Bench\Updater\updater.exe [2014-01-22] () <==== ATTENTION
Task: {5AD2D783-DCF8-4DA0-A3D6-60254C0903A1} - System32\Tasks\bench-S-1-5-21-131629521-1761861761-2204564278-1000 => C:\Program Files (x86)\Bench\Updater\updater.exe [2014-01-22] () <==== ATTENTION
Task: {5C058BBD-37A3-43DD-A05C-9FDCCB52B039} - System32\Tasks\RegistryDr_Start => C:\Program Files (x86)\Registry Dr\RegistryDr.exe [2014-01-22] () <==== ATTENTION
Task: {7EC6EDCB-D6AE-4120-9667-7D56D28D3276} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {880A4198-B203-4137-BB5D-E051A2AE4EAA} - System32\Tasks\Re-markit Update => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe [2014-02-18] () <==== ATTENTION
Task: {897380C7-16AE-4AE2-9F83-E625F7E4815A} - System32\Tasks\DP1815-updater => C:\Program Files (x86)\DP1815\DP1815-updater.exe [2014-01-24] (mrlmedia) <==== ATTENTION
Task: {960D2CEA-5A5D-4F06-A285-3449696717B8} - System32\Tasks\Digital Sites => C:\Users\User\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {9986A6A8-148C-49FF-B987-FAD94115BCDB} - \CPU Grid Computing No Task File <==== ATTENTION
Task: {9EA5B54F-9E54-412C-9B62-D16EFBCD3C17} - System32\Tasks\DP1815-firefoxinstaller => C:\Program Files (x86)\DP1815\DP1815-firefoxinstaller.exe [2014-01-24] (mrlmedia) <==== ATTENTION
Task: {A7BCD601-5912-467B-BBF4-ED83D9E42DA1} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000UA => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-16] (Google Inc.)
Task: {AB1C4A9D-6B83-49D7-AC87-553576381515} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTION
Task: {AC7E4E08-B6A2-49E0-84AC-FCDF8689BE1D} - System32\Tasks\Opera scheduled Autoupdate 1418848675 => C:\Program Files (x86)\Opera\launcher.exe [2015-03-05] (Opera Software)
Task: {BBBB5C12-3A3C-4508-83BB-FCD43F36C578} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\JustCloud\Signup Wizard.exe
Task: {C75F75D6-CA4C-4ABA-9200-7DE0E7BD9EFE} - System32\Tasks\DP1815-codedownloader => C:\Program Files (x86)\DP1815\DP1815-codedownloader.exe [2014-01-24] (mrlmedia) <==== ATTENTION
Task: {C9788B77-4B0F-45AC-9A8F-B9927434755B} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION
Task: {D4D7D9BA-2AE0-4D97-ABB1-55C714CFBA21} - System32\Tasks\DealPly => C:\Users\User\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe [2013-02-27] () <==== ATTENTION
Task: {D5FA2FD1-31A7-498D-973E-21BE2E705207} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-07] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\User\AppData\Local\16147\Updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\bench-S-1-5-21-131629521-1761861761-2204564278-1000.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\User\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\DP1815-chromeinstaller.job => C:\Program Files (x86)\DP1815\DP1815-chromeinstaller.exe)/installcrx /crxinstalltype=0 /agentregpath='DP1815' /extensionfilepath C:\Program Files (x86)\DP1815\47220.crx' /appid=47220 /srcid='000741' /subid='0' /zdata='0' /bic=C5C876C37B694C5996C80A780539397BIE /verifier=b8fc1d02536d75d06e7820aa2c72cd7e /installerversion=1_32_153 /installerfullversion=1.32.153.0 /installationtime=1390602691 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\Windows\Tasks\DP1815-codedownloader.job => C:\Program Files (x86)\DP1815\DP1815-codedownloader.exe»/reinstallapp /agentregpath='DP1815' /appid=47220 /srcid='000741' /subid='0' /zdata='0' /bic=C5C876C37B694C5996C80A780539397BIE /verifier=b8fc1d02536d75d06e7820aa2c72cd7e /installerversion=1_32_153 /installerfullversion=1.32.153.0 /installationtime=1390602691 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /codedownloaddomain=http:/app-static.crossrider.com <==== ATTENTION
Task: C:\Windows\Tasks\DP1815-enabler.job => C:\Program Files (x86)\DP1815\DP1815-enabler.exe‘/enablebho /agentregpath='DP1815' /appid=47220 /srcid='000741' /subid='0' /zdata='0' /bic=C5C876C37B694C5996C80A780539397BIE /verifier=b8fc1d02536d75d06e7820aa2c72cd7e /installerversion=1_32_153 /installationtime=1390602691 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\Windows\Tasks\DP1815-firefoxinstaller.job => C:\Program Files (x86)\DP1815\DP1815-firefoxinstaller.exe:/installxpi /agentregpath='DP1815' /extensionfilepath C:\Program Files (x86)\DP1815\47220.xpi' /appid=47220 /srcid='000741' /subid='0' /zdata='0' /bic=C5C876C37B694C5996C80A780539397BIE /verifier=b8fc1d02536d75d06e7820aa2c72cd7e /installerversion=1_32_153 /installerfullversion=1.32.153.0 /installationtime=1390602691 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /waitforbrowser=300 /extensionid=858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com /extensionversion=0.93 /prefsbranch=a858a779a4bec47f4ac06ed86e2daad75d82626c3adcb475bb77d9a1e67c4fd2acom47220 /updateurl=https:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/47220.rdf <==== ATTENTION
Task: C:\Windows\Tasks\DP1815-updater.job => C:\Program Files (x86)\DP1815\DP1815-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\DSite.job => C:\Users\User\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000Core.job => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000UA.job => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Re-markit Update.job => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe <==== ATTENTION
Task: C:\Windows\Tasks\Re-markit_wd.job => C:\Program Files (x86)\Re-markit\Re-markit_wd.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) ==============

2013-11-22 11:22 - 2013-11-18 15:32 - 01958880 _____ () c:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\loader.dll
2013-03-28 21:31 - 2013-03-28 21:31 - 00210944 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2012-09-23 12:53 - 2012-09-23 12:53 - 00748544 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2012-09-23 12:53 - 2012-09-23 12:53 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2015-02-15 19:19 - 2015-02-15 19:19 - 00339456 _____ () C:\Windows\SysWOW64\nethtsrv.exe
2014-02-18 13:51 - 2014-02-18 13:51 - 00182272 _____ () C:\Program Files (x86)\Re-markit\Re-markit155.exe
2015-02-15 19:19 - 2015-02-15 19:19 - 00190976 _____ () C:\Windows\SysWOW64\netupdsrv.exe
2014-08-20 16:20 - 2014-08-20 16:20 - 00110592 _____ () C:\Program Files (x86)\Bench\BService\1.1\bhelper64.dll
2014-02-18 13:51 - 2014-02-18 13:51 - 00093184 _____ () C:\Program Files (x86)\Re-markit\Re-markit_wd.exe
2014-07-23 16:10 - 2014-07-23 16:10 - 03443200 _____ () C:\Users\User\AppData\Local\Lollipop\lollipop_07231510.exe
2013-02-13 03:37 - 2013-02-13 03:37 - 01263952 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2014-01-15 18:13 - 2014-01-09 09:01 - 00766656 _____ () C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
2014-08-20 16:20 - 2014-08-20 16:20 - 00052736 _____ () C:\Program Files (x86)\Bench\BService\1.1\bservice.exe
2014-08-20 16:20 - 2014-08-20 16:20 - 00092672 _____ () C:\Program Files (x86)\Bench\Wd\wd.exe
2014-08-20 16:20 - 2014-08-20 16:20 - 00110592 _____ () C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe
2013-12-13 23:13 - 2013-12-13 23:13 - 00250880 _____ () C:\Users\User\AppData\Roaming\Opvau\qeelg.exe
2015-02-19 22:40 - 2015-02-19 22:40 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2013-03-28 21:30 - 2013-03-28 21:30 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2015-02-15 19:19 - 2015-02-15 19:19 - 00108544 _____ () C:\Windows\SysWOW64\hfnapi.dll
2015-02-15 19:18 - 2015-02-15 19:18 - 00438272 _____ () C:\Windows\SysWOW64\hfpapi.dll
2014-08-20 16:20 - 2014-08-20 16:20 - 00053248 _____ () C:\Program Files (x86)\Bench\BService\1.1\bhelper.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 01007104 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00024576 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00216576 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00261120 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00019456 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00337408 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2013-05-22 20:42 - 2015-03-13 19:20 - 00013600 _____ () C:\Users\User\AppData\Roaming\Yontoo\dat\Desktop.OS.Plugin.dll
2013-02-13 03:38 - 2013-02-13 03:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-01-15 18:13 - 2014-01-09 08:50 - 00061440 _____ () C:\Program Files (x86)\Mobogenie\Device.dll
2014-01-15 18:13 - 2014-01-27 16:08 - 00471040 _____ () C:\Program Files (x86)\Mobogenie\DCR.dll
2015-02-07 14:02 - 2015-02-07 14:02 - 16852144 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00835584 _____ () C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00093696 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioconvert.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00094208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioresample.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00057344 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstautodetect.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00096256 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreplugins.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00062976 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdecodebin2.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00067072 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00158208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00312832 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstoggdec.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00038912 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwaveform.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00073728 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwavparse.dll
2013-06-13 13:14 - 2015-03-12 11:06 - 00101888 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwebmdec.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-131629521-1761861761-2204564278-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-131629521-1761861761-2204564278-500 - Administrator - Disabled)
Gast (S-1-5-21-131629521-1761861761-2204564278-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-131629521-1761861761-2204564278-1005 - Limited - Enabled)
User (S-1-5-21-131629521-1761861761-2204564278-1000 - Administrator - Enabled) => C:\Users\User

==================== Faulty Device Manager Devices =============

Name: USB camera
Description: USB camera
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/13/2015 07:46:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: opera.exe, Version: 12.15.1748.0, Zeitstempel: 0x515ac406
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00032f24
ID des fehlerhaften Prozesses: 0x1984
Startzeit der fehlerhaften Anwendung: 0xopera.exe0
Pfad der fehlerhaften Anwendung: opera.exe1
Pfad des fehlerhaften Moduls: opera.exe2
Berichtskennung: opera.exe3

Error: (03/13/2015 07:38:21 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (03/13/2015 07:19:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_CryptSvc, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: msxml3.dll, Version: 8.110.7601.18576, Zeitstempel: 0x53f59493
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000039024
ID des fehlerhaften Prozesses: 0x4fc
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_CryptSvc0
Pfad der fehlerhaften Anwendung: svchost.exe_CryptSvc1
Pfad des fehlerhaften Moduls: svchost.exe_CryptSvc2
Berichtskennung: svchost.exe_CryptSvc3

Error: (03/13/2015 07:17:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/13/2015 07:15:51 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Die Aktion kann nicht abgeschlossen werden. Versuchen Sie es erneut. Wenden Sie sich bei Fortbestehen des Problems an den Microsoft-Produktsupport.

Error: (03/12/2015 10:59:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wcp.dll, Version: 6.1.7601.17592, Zeitstempel: 0x4da00342
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000a4542
ID des fehlerhaften Prozesses: 0x408
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (03/12/2015 10:55:31 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/12/2015 10:54:18 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Die Aktion kann nicht abgeschlossen werden. Versuchen Sie es erneut. Wenden Sie sich bei Fortbestehen des Problems an den Microsoft-Produktsupport.

Error: (03/12/2015 00:30:30 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (03/11/2015 07:08:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (03/13/2015 11:07:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Computer Backup (JustCloud)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/13/2015 07:22:45 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme

Error: (03/13/2015 07:21:33 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "DNS-Client" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (03/13/2015 07:19:33 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NLA (Network Location Awareness)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/13/2015 07:19:33 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Arbeitsstationsdienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/13/2015 07:19:33 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "DNS-Client" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/13/2015 07:19:33 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Kryptografiedienste" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/12/2015 11:01:12 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Modules Installer" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (03/12/2015 10:59:42 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}

Error: (03/12/2015 10:59:12 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (03/13/2015 07:46:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: opera.exe12.15.1748.0515ac406ntdll.dll6.1.7601.18247521ea8e7c000000500032f24198401d05dbb6ba8ea06C:\Program Files (x86)\Opera\opera.exeC:\Windows\SysWOW64\ntdll.dll443ff4a4-c9b1-11e4-a9df-94de800fd85c

Error: (03/13/2015 07:38:21 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\Steam\steamapps\common\thehunter\launcher\launcher.exe

Error: (03/13/2015 07:19:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_CryptSvc6.1.7600.163854a5bc3c1msxml3.dll8.110.7601.1857653f59493c000000500000000000390244fc01d05db9b1fe8412C:\Windows\system32\svchost.exeC:\Windows\System32\msxml3.dll7daba150-c9ad-11e4-a9df-94de800fd85c

Error: (03/13/2015 07:17:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/13/2015 07:15:51 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Die Aktion kann nicht abgeschlossen werden. Versuchen Sie es erneut. Wenden Sie sich bei Fortbestehen des Problems an den Microsoft-Produktsupport.

Error: (03/12/2015 10:59:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: TrustedInstaller.exe6.1.7601.175144ce7989bwcp.dll6.1.7601.175924da00342c000000500000000000a454240801d05caa7b93d004C:\Windows\servicing\TrustedInstaller.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_672ce6c3de2cb17f\wcp.dll69f5800f-c89e-11e4-a61c-94de800fd85c

Error: (03/12/2015 10:55:31 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/12/2015 10:54:18 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Die Aktion kann nicht abgeschlossen werden. Versuchen Sie es erneut. Wenden Sie sich bei Fortbestehen des Problems an den Microsoft-Produktsupport.

Error: (03/12/2015 00:30:30 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\Steam\steamapps\common\thehunter\launcher\launcher.exe

Error: (03/11/2015 07:08:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2015-02-13 19:16:49.446
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-13 19:16:49.430
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:15:57.403
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:15:57.348
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:09:39.288
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:09:39.257
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:08:38.210
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:08:38.179
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 18:44:56.179
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 18:44:56.120
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: AMD FX(tm)-6200 Six-Core Processor 
Percentage of memory in use: 34%
Total physical RAM: 8162.55 MB
Available physical RAM: 5326.02 MB
Total Pagefile: 16323.29 MB
Available Pagefile: 11817.35 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:772.48 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 58382C81)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 14.03.2015, 01:19

Voll mit Adware

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Codec Pack Packages

DealPly

DP1815

Lollipop

Mobogenie

OffersWizard Network System Driver

Registry Dr

Re-markit

Savings Wizard

Software Version Updater

Update for Codec Pack

ValueApps

Yontoo 2.053
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

NeedHelpX27 · 14.03.2015, 02:20

Hey,

danke für deine Hilfe (:

Die Advertisements sind weg, habe ich noch andere schädliche Programme auf meinem Computer, da mir "lightspark" , "Haali Media Splitter" etc. auch suspekt erscheint.

Mit freundlichen Grüßen

cosinus · 14.03.2015, 02:25

Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

NeedHelpX27 · 14.03.2015, 02:53

1.

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v4.112 - Bericht erstellt 14/03/2015 um 02:36:58
# Aktualisiert 09/03/2015 von Xplode
# Datenbank : 2015-03-05.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : User - USER-PC
# Gestarted von : C:\Users\User\Desktop\AdwCleaner_4.112.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : Yontoo Desktop Updater

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
[!] Ordner Gelöscht : C:\ProgramData\BitGuard
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightspark 0.5.3-git
Ordner Gelöscht : C:\Program Files (x86)\AmiExt
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\Bench
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\Lightspark 0.5.3-git
Ordner Gelöscht : C:\Program Files (x86)\Yontoo
Ordner Gelöscht : C:\Windows\SysWOW64\BitGuard
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Users\User\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\User\AppData\Local\genienext
Ordner Gelöscht : C:\Users\User\AppData\Local\lollipop
Ordner Gelöscht : C:\Users\User\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\User\AppData\Local\RegistryDr
Ordner Gelöscht : C:\Users\User\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\User\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\User\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\User\AppData\Roaming\DealPly
Ordner Gelöscht : C:\Users\User\AppData\Roaming\DigitalSites
Ordner Gelöscht : C:\Users\User\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\User\AppData\Roaming\file scout
Ordner Gelöscht : C:\Users\User\AppData\Roaming\newnext.me
Ordner Gelöscht : C:\Users\User\AppData\Roaming\ValueApps
Ordner Gelöscht : C:\Users\User\AppData\Roaming\Yontoo
Ordner Gelöscht : C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
Ordner Gelöscht : C:\Users\User\Documents\RegistryDr
Ordner Gelöscht : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Windows\SysWOW64\installd.exe
Datei Gelöscht : C:\Users\User\daemonprocess.txt
Datei Gelöscht : C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Goodgame Empire.lnk
Datei Gelöscht : C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Goodgame Empire.lnk
Datei Gelöscht : C:\Users\User\Desktop\Goodgame Empire.lnk
Datei Gelöscht : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\invalidprefs.js
Datei Gelöscht : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\searchplugins\bingp.xml
Datei Gelöscht : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\user.js
Datei Gelöscht : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences
Datei Gelöscht : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gelöscht : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.boostsaves.com_0.localstorage
Datei Gelöscht : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.boostsaves.com_0.localstorage-journal
Datei Gelöscht : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\bprotector web data

***** [ Geplante Tasks ] *****

Task Gelöscht : Dealply
Task Gelöscht : Digital Sites
Task Gelöscht : LaunchSignup
Task Gelöscht : CPU Grid Computing
Task Gelöscht : RegistryDr_Popup
Task Gelöscht : RegistryDr_Start

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [ext@flashenhancer.com]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\lollipop.exe
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Yontoo Desktop]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\*\shell\filescout
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Updater.AmiUpd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Updater.AmiUpd.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs [bProtectTabs]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\ask.com
Schlüssel Gelöscht : HKCU\Software\52088dab36fe840
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99E29823-2F67-41C3-8AA5-6425097A771F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5682CA62-1A80-40AE-82A0-B67833CE75FF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5A60B6BB-FA81-4EFA-AB9C-A820E2143736}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{93DBF2BB-A2B3-4683-A92E-57E60751F346}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF7BD87A-8024-11E2-F316-F3E56188709B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5682CA62-1A80-40AE-82A0-B67833CE75FF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5A60B6BB-FA81-4EFA-AB9C-A820E2143736}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{93DBF2BB-A2B3-4683-A92E-57E60751F346}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF7BD87A-8024-11E2-F316-F3E56188709B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{93DBF2BB-A2B3-4683-A92E-57E60751F346}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{93DBF2BB-A2B3-4683-A92E-57E60751F346}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{4357FCA8-9F0A-4C98-90A8-B02A802F3430}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EF7DD3C7-485D-4E0D-B132-7156F3F20890}
Schlüssel Gelöscht : HKCU\Software\AmiExt
Schlüssel Gelöscht : HKCU\Software\BABSOLUTION
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\RegistryDrLanguage
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Re_Markit
Schlüssel Gelöscht : HKLM\SOFTWARE\AdvertisingSupport
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Lightspark Team
Schlüssel Gelöscht : HKLM\SOFTWARE\MediaBuzzV1
Schlüssel Gelöscht : HKLM\SOFTWARE\MediaPlayerV1
Schlüssel Gelöscht : HKLM\SOFTWARE\MediaViewerV1
Schlüssel Gelöscht : HKLM\SOFTWARE\MediaViewV1
Schlüssel Gelöscht : HKLM\SOFTWARE\MediaWatchV1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Lightspark
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E

***** [ Internetbrowser ] *****

-\\ Internet Explorer v8.0.7601.18751

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [bProtectTabs]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v31.0 (x86 de)

[cwmpb8fd.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.a858a779a4bec47f4ac06ed86e2daad75d82626c3adcb475bb77d9a1e67c4fd2acom47220.47220.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssf[...]
[cwmpb8fd.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossrider.bic", "1447319573b75f267446f0e353ba3628");

-\\ Google Chrome v


-\\ Opera v28.0.1750.40


*************************

AdwCleaner[R0].txt - [16749 Bytes] - [14/03/2015 02:35:19]
AdwCleaner[S0].txt - [15405 Bytes] - [14/03/2015 02:36:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15465  Bytes] ##########

--- --- ---

2.

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 7 Home Premium x64
Ran by User on 14.03.2015 at  2:45:08,46
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted [Registry Value] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\bProtectTabs



~~~ Registry Keys

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C680BAE-655C-4E3D-8FC4-E6A520C3D928}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{6C680BAE-655C-4E3D-8FC4-E6A520C3D928}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C680BAE-655C-4E3D-8FC4-E6A520C3D928}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{6C680BAE-655C-4E3D-8FC4-E6A520C3D928}



~~~ Files

Successfully deleted: [File] C:\Windows\Tasks\DP1815-chromeinstaller.job
Successfully deleted: [File] C:\Windows\Tasks\DP1815-codedownloader.job
Successfully deleted: [File] C:\Windows\Tasks\DP1815-enabler.job
Successfully deleted: [File] C:\Windows\Tasks\DP1815-firefoxinstaller.job
Successfully deleted: [File] C:\Windows\Tasks\DP1815-updater.job



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Emptied folder: C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\cwmpb8fd.default\minidumps [9 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.03.2015 at  2:47:58,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3.

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by User (administrator) on USER-PC on 14-03-2015 02:51:04
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Spotify Ltd) C:\Users\User\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Spotify Ltd) C:\Users\User\AppData\Roaming\Spotify\Spotify.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Users\User\AppData\Roaming\Opvau\qeelg.exe
(Spotify Ltd) C:\Users\User\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Spotify Ltd) C:\Users\User\AppData\Roaming\Spotify\Spotify.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Spotify Ltd) C:\Users\User\AppData\Roaming\Spotify\Spotify.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-04-15] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3619160 2015-01-27] (Electronic Arts)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Google Update] => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-05-16] (Google Inc.)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Spotify Web Helper] => C:\Users\User\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1959992 2015-03-12] (Spotify Ltd)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Syvoqomaek] => C:\Users\User\AppData\Roaming\Opvau\qeelg.exe [250880 2013-12-13] ()
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31346784 2015-02-26] (Skype Technologies S.A.)
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Run: [Spotify] => C:\Users\User\AppData\Roaming\Spotify\Spotify.exe [6611512 2015-03-12] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
HKU\S-1-5-21-131629521-1761861761-2204564278-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.dell.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: DP1815 -> {11111111-1111-1111-1111-110411721120} -> C:\Program Files (x86)\DP1815\DP1815-bho64.dll No File
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2013-05-06] (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-06-04] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-06-04] (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default
FF SearchEngineOrder.3: Bing 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-07] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-07] ()
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2013-05-06] (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-06-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-06-04] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll [2011-11-17] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin HKU\S-1-5-21-131629521-1761861761-2204564278-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin HKU\S-1-5-21-131629521-1761861761-2204564278-1000: @tools.google.com/Google Update;version=3 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin HKU\S-1-5-21-131629521-1761861761-2204564278-1000: @tools.google.com/Google Update;version=9 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin HKU\S-1-5-21-131629521-1761861761-2204564278-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Extension: Widget context - C:\Users\User\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-22]
FF Extension: DP1815 - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\Extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com [2015-01-15]
FF Extension: McAfee Security Scan Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8} [2014-06-13]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-15]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-05-22]
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha5513.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha5513\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewerV1alpha148.net] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha148\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha1748.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1748\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha203.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha203\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaWatchV1home45.net] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home45\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@MediaBuzzV1mode5614.net] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode5614\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@RichMediaViewV1release483.net] - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release483\ff
FF HKLM-x32\...\Firefox\Extensions: [ext@RichMediaViewV1release5902.net] - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release5902\ff
FF HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-03-13]
CHR Extension: (DP1815) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjllbogbaogimpilgdginhalhhbmhiob [2015-03-13]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]
CHR Extension: (Skype Click to Call) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-01-07]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-23]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2014-05-23]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06]
StartMenuInternet: Google Chrome.G4AI6EQVRWUWFUFYCXWDO5CMGY - C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-28] (Advanced Micro Devices, Inc.) [File not signed]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2015-01-12] (Hi-Rez Studios) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [22128 2012-03-08] ()
S3 RdpVideoMiniport; C:\Windows\System32\drivers\rdpvideominiport.sys [19456 2012-08-23] (Microsoft Corporation) [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-14 02:51 - 2015-03-14 02:51 - 00016985 _____ () C:\Users\User\Desktop\FRST.txt
2015-03-14 02:47 - 2015-03-14 02:47 - 00001893 _____ () C:\Users\User\Desktop\JRT.txt
2015-03-14 02:44 - 2015-03-14 02:44 - 01388333 _____ (Thisisu) C:\Users\User\Desktop\JRT.exe
2015-03-14 02:38 - 2015-03-14 02:38 - 00043490 _____ () C:\Windows\setupact.log
2015-03-14 02:38 - 2015-03-14 02:38 - 00004964 _____ () C:\Windows\PFRO.log
2015-03-14 02:38 - 2015-03-14 02:38 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-14 02:34 - 2015-03-14 02:37 - 00000000 ____D () C:\AdwCleaner
2015-03-14 02:32 - 2015-03-14 02:32 - 02171392 _____ () C:\Users\User\Desktop\AdwCleaner_4.112.exe
2015-03-14 01:48 - 2015-03-14 01:48 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User\Desktop\revosetup95.exe
2015-03-14 01:48 - 2015-03-14 01:48 - 00001264 _____ () C:\Users\User\Desktop\Revo Uninstaller.lnk
2015-03-14 01:48 - 2015-03-14 01:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-14 01:06 - 2015-03-14 02:51 - 00000000 ____D () C:\FRST
2015-03-14 01:04 - 2015-03-14 01:04 - 02095616 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-03-13 23:41 - 2015-03-13 23:41 - 00000000 ____D () C:\Users\User\Desktop\Neuer Ordner
2015-03-12 19:25 - 2015-03-12 19:26 - 00053214 _____ () C:\Users\User\Documents\cc_20150312_192532.reg
2015-03-12 19:20 - 2015-03-13 22:59 - 00000000 ____D () C:\Program Files\CCleaner
2015-03-12 19:20 - 2015-03-12 19:20 - 00002770 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-03-12 19:19 - 2015-03-12 19:19 - 04197696 _____ (Piriform Ltd) C:\Users\User\Downloads\ccsetup503_slim.exe
2015-03-12 10:59 - 2015-03-12 10:59 - 00000687 _____ () C:\awh5225.tmp
2015-03-11 19:16 - 2015-03-06 06:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 19:16 - 2015-03-06 06:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 19:16 - 2015-03-06 06:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 19:16 - 2015-03-06 06:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 19:16 - 2015-03-06 06:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 19:16 - 2015-03-06 06:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 19:16 - 2015-03-06 06:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 19:16 - 2015-03-06 06:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 19:16 - 2015-03-06 06:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 19:16 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 19:16 - 2015-03-06 06:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 19:16 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 19:16 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 19:16 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 19:16 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 19:16 - 2015-02-26 04:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 19:16 - 2015-02-20 05:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 19:16 - 2015-02-20 05:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 19:16 - 2015-02-20 05:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 19:16 - 2015-02-20 05:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 19:16 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 19:16 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 19:16 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 19:16 - 2015-02-20 05:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 19:16 - 2015-02-20 04:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 19:16 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 19:16 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 19:16 - 2015-02-13 06:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 19:16 - 2015-02-10 17:44 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 19:16 - 2015-02-10 17:43 - 01539584 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 19:16 - 2015-02-10 17:43 - 00610816 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 19:16 - 2015-02-10 17:43 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 12297728 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 09059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 02468864 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00495616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-11 19:16 - 2015-02-10 17:42 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 19:16 - 2015-02-10 17:41 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 19:16 - 2015-02-10 17:41 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-11 19:16 - 2015-02-10 17:41 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-11 19:16 - 2015-02-10 17:40 - 01538048 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 19:16 - 2015-02-10 17:21 - 01267712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-11 19:16 - 2015-02-10 17:21 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-11 19:16 - 2015-02-10 17:21 - 00428544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-11 19:16 - 2015-02-10 17:21 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 11026432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 06030336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 02087424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00345600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-03-11 19:16 - 2015-02-10 17:20 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-11 19:16 - 2015-02-10 17:19 - 01466368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-11 19:16 - 2015-02-10 17:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-11 19:16 - 2015-02-10 17:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-03-11 19:16 - 2015-02-10 17:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-03-11 19:16 - 2015-02-10 16:21 - 00482816 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-11 19:16 - 2015-02-10 15:59 - 00386048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-03-11 19:16 - 2015-02-10 14:50 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 19:16 - 2015-02-10 14:21 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-11 19:16 - 2015-02-04 04:16 - 00392192 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 19:16 - 2015-02-04 03:54 - 00318464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 19:16 - 2015-02-03 04:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 19:16 - 2015-02-03 04:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 19:16 - 2015-02-03 04:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 19:16 - 2015-02-03 04:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 19:16 - 2015-02-03 04:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 02644992 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 19:16 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 19:16 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 19:16 - 2015-02-03 04:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 19:16 - 2015-02-03 04:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 19:16 - 2015-02-03 04:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 19:16 - 2015-02-03 04:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 19:16 - 2015-02-03 04:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 19:16 - 2015-02-03 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 19:16 - 2015-02-03 04:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 19:16 - 2015-02-03 04:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 19:16 - 2015-02-03 04:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 19:16 - 2015-02-03 04:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 02135040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 01011200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 19:16 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 19:16 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 19:16 - 2015-02-03 04:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 19:16 - 2015-02-03 04:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 19:16 - 2015-02-03 04:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 19:16 - 2015-02-03 04:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 19:16 - 2015-02-03 04:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 19:16 - 2015-02-03 03:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 19:16 - 2015-01-31 00:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 19:16 - 2015-01-17 03:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 19:16 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-11 19:16 - 2014-10-31 23:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 19:16 - 2014-06-28 01:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-11 19:16 - 2014-06-28 01:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-11 19:06 - 2015-03-11 19:06 - 00000687 _____ () C:\awh3255.tmp
2015-03-10 22:01 - 2015-03-10 22:01 - 00000063 _____ () C:\Users\User\Desktop\K.I.Z..url
2015-03-10 14:03 - 2015-03-10 14:03 - 00000687 _____ () C:\awhBA3.tmp
2015-03-09 20:10 - 2015-03-09 20:10 - 00000687 _____ () C:\awh50F.tmp
2015-03-09 16:25 - 2015-03-09 16:25 - 00000687 _____ () C:\awh12C4.tmp
2015-03-08 20:22 - 2015-03-08 20:22 - 00000687 _____ () C:\awh4A87.tmp
2015-03-08 20:21 - 2015-03-08 20:21 - 00000000 ____D () C:\Users\User\Tracing
2015-03-07 11:05 - 2015-03-07 11:05 - 00000687 _____ () C:\awh3CB1.tmp
2015-03-03 16:28 - 2015-03-03 16:28 - 00000687 _____ () C:\awhFE2C.tmp
2015-03-02 21:48 - 2015-03-02 21:48 - 00000687 _____ () C:\awh39B5.tmp
2015-03-01 15:55 - 2015-03-01 15:55 - 00000687 _____ () C:\awh517A.tmp
2015-02-28 18:40 - 2015-02-28 18:40 - 00000687 _____ () C:\awh991.tmp
2015-02-20 21:32 - 2015-02-20 21:32 - 00000687 _____ () C:\awhC976.tmp
2015-02-20 21:31 - 2015-02-20 21:31 - 01203488 _____ () C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer (1).exe
2015-02-20 21:19 - 2015-02-20 21:19 - 00000000 ____D () C:\Users\User\AppData\Roaming\vlc
2015-02-20 21:17 - 2015-02-20 21:17 - 00001066 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-02-20 21:17 - 2015-02-20 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-02-20 21:17 - 2015-02-20 21:17 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2015-02-20 21:16 - 2015-02-20 21:16 - 01203488 _____ () C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer.exe
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\Users\User\AppData\Roaming\DesktopIconGoodgame
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\Users\User\AppData\Roaming\Abelssoft
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\Users\User\AppData\Local\Abelssoft
2015-02-20 21:16 - 2015-02-20 21:16 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2015-02-20 17:18 - 2015-02-20 17:18 - 00000687 _____ () C:\awhC34E.tmp
2015-02-19 17:40 - 2015-02-19 17:40 - 07416088 _____ (Piriform Ltd) C:\Users\User\Desktop\CCleaner64.exe
2015-02-19 15:53 - 2015-02-19 15:53 - 00000000 ____D () C:\Users\User\AppData\Local\Steam
2015-02-15 21:42 - 2015-02-15 21:42 - 00000000 ____D () C:\Users\User\Desktop\mc txp
2015-02-15 16:15 - 2015-02-15 16:15 - 00000687 _____ () C:\awh3330.tmp
2015-02-14 14:05 - 2015-02-14 14:05 - 00000687 _____ () C:\awh17C4.tmp
2015-02-13 19:23 - 2015-02-13 19:23 - 00000687 _____ () C:\awhAD7D.tmp
2015-02-12 16:14 - 2015-02-12 16:14 - 00000687 _____ () C:\awh1812.tmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-14 02:46 - 2009-07-14 05:45 - 00029664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-14 02:46 - 2009-07-14 05:45 - 00029664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-14 02:42 - 2013-11-10 18:34 - 01136119 _____ () C:\Windows\WindowsUpdate.log
2015-03-14 02:40 - 2013-05-17 12:31 - 00000000 ____D () C:\Users\User\AppData\Roaming\Spotify
2015-03-14 02:40 - 2013-05-17 12:31 - 00000000 ____D () C:\Users\User\AppData\Local\Spotify
2015-03-14 02:40 - 2013-05-16 17:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2015-03-14 02:38 - 2013-08-04 20:09 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-03-14 02:38 - 2013-05-22 20:43 - 00000000 ____D () C:\Program Files (x86)\Xvid
2015-03-14 02:38 - 2013-05-16 21:02 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-14 02:38 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-14 02:11 - 2014-01-28 21:15 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2015-03-14 02:02 - 2013-12-14 10:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-14 01:54 - 2013-05-16 14:01 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000UA.job
2015-03-14 00:41 - 2013-08-03 13:41 - 00000094 _____ () C:\Users\User\AppData\Roaming\WB.CFG
2015-03-13 23:11 - 2013-08-31 20:10 - 00000000 ____D () C:\Users\User\AppData\Local\Ubisoft Game Launcher
2015-03-13 23:11 - 2013-08-31 20:10 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2015-03-13 23:10 - 2013-05-22 16:05 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-03-13 23:09 - 2013-05-22 20:43 - 00000000 ____D () C:\Program Files (x86)\DSP-worx
2015-03-13 23:03 - 2013-11-15 14:42 - 00000000 ____D () C:\Windows\Minidump
2015-03-13 23:03 - 2013-11-11 03:10 - 00000000 ____D () C:\Windows\Panther
2015-03-13 19:24 - 2013-08-04 20:10 - 00000000 ____D () C:\ProgramData\Origin
2015-03-12 12:23 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-03-12 11:06 - 2013-06-13 13:14 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-12 10:55 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-12 10:54 - 2009-07-14 05:45 - 00275272 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 10:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-12 10:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-11 19:55 - 2013-05-16 14:02 - 00002350 _____ () C:\Users\User\Desktop\Google Chrome.lnk
2015-03-11 19:07 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-10 14:10 - 2014-12-17 21:37 - 00003850 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1418848675
2015-03-08 20:20 - 2014-03-15 09:49 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-08 20:20 - 2013-05-16 17:27 - 00000000 ____D () C:\ProgramData\Skype
2015-02-24 03:17 - 2010-11-21 04:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-20 21:28 - 2013-11-10 18:49 - 00060056 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-20 21:17 - 2013-11-11 03:08 - 00697276 _____ () C:\Windows\system32\perfh007.dat
2015-02-20 21:17 - 2013-11-11 03:08 - 00148314 _____ () C:\Windows\system32\perfc007.dat
2015-02-20 21:17 - 2009-07-14 06:13 - 01614852 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-19 15:51 - 2013-05-16 14:01 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000Core.job
2015-02-15 22:08 - 2013-06-04 17:50 - 00000000 ____D () C:\Users\User\AppData\Roaming\.minecraft
2015-02-15 21:39 - 2015-02-07 23:46 - 00000000 ____D () C:\Program Files (x86)\Minecraft

==================== Files in the root of some directories =======

2014-08-24 17:41 - 2014-08-24 17:41 - 0000039 _____ () C:\Users\User\AppData\Roaming\TheHunterSettings_steam_live.cfg
2015-02-08 00:03 - 2015-02-08 00:03 - 0035328 ___SH () C:\Users\User\AppData\Roaming\Thumbs.db
2013-08-03 13:41 - 2015-03-14 00:41 - 0000094 _____ () C:\Users\User\AppData\Roaming\WB.CFG
2013-06-15 10:48 - 2014-01-31 10:41 - 0000005 _____ () C:\Users\User\AppData\Roaming\WBPU-TTL.DAT

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\DealPlyUpdateVer.exe
C:\Users\User\AppData\Local\Temp\Quarantine.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll
C:\Users\User\AppData\Local\Temp\uninst1.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-10 14:28

==================== End Of Log ============================

--- --- ---

--- --- ---

Die Addition :

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by User at 2015-03-14 02:51:48
Running from C:\Users\User\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
Black & White® 2 (HKLM-x32\...\{D9E52CD1-9DF1-4A8A-9BDC-1E5E53982F2B}) (Version: 1.00.0000 - Lionhead Studios)
Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32\...\Steam App 10190) (Version:  - Infinity Ward)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version:  - Infinity Ward - Sledgehammer Games)
Call of Duty: Modern Warfare 3 (HKLM-x32\...\Steam App 42680) (Version:  - Infinity Ward)
CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.0.3717 - CDBurnerXP)
Company of Heroes 2 – OPEN BETA (HKLM-x32\...\Steam App 231430) (Version:  - )
Cube World version 0.0.1 (HKLM-x32\...\{D692A0E0-1BBB-4E9C-826E-4254EE330830}_is1) (Version: 0.0.1 - Picroma)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
DirectVobSub 2.40.4209 (HKLM-x32\...\vsfilter_is1) (Version: 2.40.4209 - MPC-HC Team)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.8 - DivX, LLC)
Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology) Hidden
ffdshow v1.1.4399 [2012-03-22] (HKLM-x32\...\ffdshow_is1) (Version: 1.1.4399.0 - )
FUSSBALL MANAGER 13 (HKLM-x32\...\{80AF0300-866F-400F-A350-D53E3C3E34E0}) (Version: 1.0.4.0 - Electronic Arts)
Google Chrome (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Java 7 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217021FF}) (Version: 7.0.210 - Oracle)
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version:  - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
ManiaPlanet (HKLM-x32\...\ManiaPlanet_is1) (Version:  - Nadeo)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\{0E3DAF3D-FF69-345A-A99E-1FED304CA083}) (Version:  - )
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.6109.5003 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
ON_OFF Charge B12.0308.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
OpenSource Flash Video Splitter 1.0.0.5 (HKLM-x32\...\OpenSource Flash Video Splitter) (Version: 1.0.0.5 - )
Opera 12.15 (HKLM-x32\...\Opera 12.15.1748) (Version: 12.15.1748 - Opera Software ASA)
Opera Stable 28.0.1750.40 (HKLM-x32\...\Opera 28.0.1750.40) (Version: 28.0.1750.40 - Opera Software ASA)
Origin (HKLM-x32\...\Origin) (Version: 9.3.1.4482 - Electronic Arts, Inc.)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6650 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.2 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.2.103 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2531.0 - Hi-Rez Studios)
Spotify (HKU\S-1-5-21-131629521-1761861761-2204564278-1000\...\Spotify) (Version: 1.0.1.1060.gc75ebdfd - Spotify AB)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
War Thunder Launcher 1.0.1.269 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version:  - 2013 Gaijin Entertainment Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-131629521-1761861761-2204564278-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-131629521-1761861761-2204564278-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)

==================== Restore Points  =========================

13-03-2015 19:19:34 Windows Update
14-03-2015 01:52:46 Revo Uninstaller's restore point - Codec Pack Packages
14-03-2015 01:55:30 Revo Uninstaller's restore point - Codec Pack Packages
14-03-2015 01:58:08 Revo Uninstaller's restore point - DealPly
14-03-2015 01:59:22 Revo Uninstaller's restore point - DP1815
14-03-2015 02:01:54 Revo Uninstaller's restore point - Lollipop
14-03-2015 02:03:50 Revo Uninstaller's restore point - Mobogenie
14-03-2015 02:05:34 Revo Uninstaller's restore point - OffersWizard Network System Driver
14-03-2015 02:07:11 Revo Uninstaller's restore point - Registry Dr
14-03-2015 02:09:08 Revo Uninstaller's restore point - Re-markit
14-03-2015 02:10:19 Revo Uninstaller's restore point - Savings Wizard
14-03-2015 02:12:04 Revo Uninstaller's restore point - Software Version Updater
14-03-2015 02:13:09 Revo Uninstaller's restore point - ValueApps
14-03-2015 02:14:04 Revo Uninstaller's restore point - Update for Codec Pack
14-03-2015 02:15:59 Revo Uninstaller's restore point - Haali Media Splitter

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-03-14 02:11 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0EFCB515-CA2B-44BC-AB8A-D7911745CB13} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {15BE5816-10FB-4727-AC75-459F1FD32AEF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000Core => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-16] (Google Inc.)
Task: {26BFB48D-2A3D-4C25-A992-5582D13E8588} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)
Task: {7EC6EDCB-D6AE-4120-9667-7D56D28D3276} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {A7BCD601-5912-467B-BBF4-ED83D9E42DA1} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000UA => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-16] (Google Inc.)
Task: {AB1C4A9D-6B83-49D7-AC87-553576381515} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTION
Task: {AC7E4E08-B6A2-49E0-84AC-FCDF8689BE1D} - System32\Tasks\Opera scheduled Autoupdate 1418848675 => C:\Program Files (x86)\Opera\launcher.exe [2015-03-05] (Opera Software)
Task: {C9788B77-4B0F-45AC-9A8F-B9927434755B} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION
Task: {D5FA2FD1-31A7-498D-973E-21BE2E705207} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-07] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000Core.job => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-131629521-1761861761-2204564278-1000UA.job => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2013-03-28 21:31 - 2013-03-28 21:31 - 00210944 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2012-09-23 12:53 - 2012-09-23 12:53 - 00748544 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2012-09-23 12:53 - 2012-09-23 12:53 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2013-02-13 03:37 - 2013-02-13 03:37 - 01263952 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2013-12-13 23:13 - 2013-12-13 23:13 - 00250880 _____ () C:\Users\User\AppData\Roaming\Opvau\qeelg.exe
2013-03-28 21:30 - 2013-03-28 21:30 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 01007104 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00024576 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00216576 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00261120 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00019456 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00337408 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2014-01-29 11:33 - 2015-02-28 18:37 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2013-04-23 17:30 - 2014-11-11 19:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-20 20:39 - 2014-12-02 01:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-20 20:39 - 2014-12-02 01:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-20 20:39 - 2014-12-02 01:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-05-23 11:38 - 2015-02-19 00:51 - 02360000 _____ () C:\Program Files (x86)\Steam\video.dll
2014-08-29 14:11 - 2014-12-01 22:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-08-29 14:11 - 2014-12-01 22:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-08-29 14:11 - 2014-12-01 22:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-08-29 14:11 - 2014-12-01 22:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-08-29 14:11 - 2014-12-01 22:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2013-05-03 14:35 - 2015-02-19 00:51 - 00702656 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2015-03-12 10:55 - 2015-03-12 10:55 - 40506936 _____ () C:\Users\User\AppData\Roaming\Spotify\libcef.dll
2013-02-13 03:38 - 2013-02-13 03:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2015-03-12 10:55 - 2015-03-12 10:55 - 01365560 _____ () C:\Users\User\AppData\Roaming\Spotify\libglesv2.dll
2015-03-12 10:55 - 2015-03-12 10:55 - 00219192 _____ () C:\Users\User\AppData\Roaming\Spotify\libegl.dll
2013-03-26 15:16 - 2015-01-28 02:30 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2015-03-12 10:55 - 2015-03-12 10:55 - 09305656 _____ () C:\Users\User\AppData\Roaming\Spotify\pdf.dll
2015-03-12 10:55 - 2015-03-12 10:55 - 00990776 _____ () C:\Users\User\AppData\Roaming\Spotify\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-131629521-1761861761-2204564278-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-131629521-1761861761-2204564278-500 - Administrator - Disabled)
Gast (S-1-5-21-131629521-1761861761-2204564278-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-131629521-1761861761-2204564278-1005 - Limited - Enabled)
User (S-1-5-21-131629521-1761861761-2204564278-1000 - Administrator - Enabled) => C:\Users\User

==================== Faulty Device Manager Devices =============

Name: USB camera
Description: USB camera
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2015-02-13 19:16:49.446
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-13 19:16:49.430
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:15:57.403
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:15:57.348
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:09:39.288
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:09:39.257
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:08:38.210
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-12 16:08:38.179
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 18:44:56.179
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-11 18:44:56.120
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\nethfdrv.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: AMD FX(tm)-6200 Six-Core Processor 
Percentage of memory in use: 28%
Total physical RAM: 8162.55 MB
Available physical RAM: 5824.25 MB
Total Pagefile: 16323.29 MB
Available Pagefile: 13708.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:774.89 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 58382C81)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Dankeee

cosinus · 14.03.2015, 03:05

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: DP1815 -> {11111111-1111-1111-1111-110411721120} -> C:\Program Files (x86)\DP1815\DP1815-bho64.dll No File
Task: {AB1C4A9D-6B83-49D7-AC87-553576381515} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTION
Task: {C9788B77-4B0F-45AC-9A8F-B9927434755B} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION
C:\Program Files (x86)\DP1815
C:\awh5225.tmp
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

NeedHelpX27 · 14.03.2015, 03:15

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by User at 2015-03-14 03:08:29 Run:1
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: DP1815 -> {11111111-1111-1111-1111-110411721120} -> C:\Program Files (x86)\DP1815\DP1815-bho64.dll No File
Task: {AB1C4A9D-6B83-49D7-AC87-553576381515} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTION
Task: {C9788B77-4B0F-45AC-9A8F-B9927434755B} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION
C:\Program Files (x86)\DP1815
C:\awh5225.tmp
EmptyTemp:
Hosts:
*****************

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}" => Key deleted successfully.
HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found. 
"HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}" => Key deleted successfully.
HKCR\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => Key not found. 
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411721120}" => Key deleted successfully.
"HKCR\CLSID\{11111111-1111-1111-1111-110411721120}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{AB1C4A9D-6B83-49D7-AC87-553576381515}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB1C4A9D-6B83-49D7-AC87-553576381515}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate 2" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C9788B77-4B0F-45AC-9A8F-B9927434755B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C9788B77-4B0F-45AC-9A8F-B9927434755B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate" => Key deleted successfully.
"C:\Program Files (x86)\DP1815" => File/Directory not found.
C:\awh5225.tmp => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 128.5 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 03:09:02 ====

Dankee

cosinus · 14.03.2015, 12:30

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

NeedHelpX27 · 15.03.2015, 14:41

MBAM log:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 14.03.2015
Suchlauf-Zeit: 14:58:13
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.14.02
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: User

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 333884
Verstrichene Zeit: 7 Min, 23 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 1
Trojan.Agent.GT, C:\Users\User\AppData\Roaming\Opvau\qeelg.exe, 4028, Löschen bei Neustart, [65051332e6a41b1bffe88dfe8f72fc04]

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 13
PUP.Optional.SavingsWizard.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{39B931CF-F1E2-4D04-8129-9EE8159A91C5}, In Quarantäne, [1852b1948cfe37ff59a7071edc27eb15], 
PUP.Optional.SavingsWizard.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{39B931CF-F1E2-4D04-8129-9EE8159A91C5}, In Quarantäne, [1852b1948cfe37ff59a7071edc27eb15], 
PUP.Optional.MediaBuzz.A, HKLM\SOFTWARE\WOW6432NODE\MediaBuzzV1mode5614, In Quarantäne, [1f4bf3521971ce688d77a146d231966a], 
PUP.Optional.MediaPlayerAlpha.A, HKLM\SOFTWARE\WOW6432NODE\MediaPlayerV1alpha5513, In Quarantäne, [0a6076cf8bff45f1bd21a35437ccfc04], 
PUP.Optional.MediaViewer.A, HKLM\SOFTWARE\WOW6432NODE\MediaViewerV1alpha148, In Quarantäne, [5911a1a496f44de974f5d61d5ca7b050], 
PUP.Optional.MediaView.A, HKLM\SOFTWARE\WOW6432NODE\MediaViewV1alpha1748, In Quarantäne, [db8f25206c1e1125655dde144eb558a8], 
PUP.Optional.MediaView.A, HKLM\SOFTWARE\WOW6432NODE\MediaViewV1alpha203, In Quarantäne, [d199b78e404a6fc7dbe7846eee15f907], 
PUP.Optional.MediaWatch.A, HKLM\SOFTWARE\WOW6432NODE\MediaWatchV1home45, In Quarantäne, [f575370e7a10d26493ae66c4877e54ac], 
PUP.Optional.RichMediaView.A, HKLM\SOFTWARE\WOW6432NODE\RichMediaViewV1release483, In Quarantäne, [97d349fc4b3f65d1043bda07be45f10f], 
PUP.Optional.RichMediaView.A, HKLM\SOFTWARE\WOW6432NODE\RichMediaViewV1release5902, In Quarantäne, [70fa53f217730036241b8160c83b43bd], 
PUP.Optional.DPMM.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\DP1815, In Quarantäne, [89e13a0b8dfde5513de8aa483dc6c63a], 
PUP.Optional.ReMarkit.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, In Quarantäne, [006afb4ac0cafe382eb130954fb4fb05], 
PUP.Optional.DPMM.A, HKU\S-1-5-21-131629521-1761861761-2204564278-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\DP1815, In Quarantäne, [cb9f85c01c6e61d5ed38975bdf24a65a], 

Registrierungswerte: 9
Trojan.Agent.GT, HKU\S-1-5-21-131629521-1761861761-2204564278-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Syvoqomaek, C:\Users\User\AppData\Roaming\Opvau\qeelg.exe, In Quarantäne, [65051332e6a41b1bffe88dfe8f72fc04]
PUP.Optional.MediaPlayerAlpha.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@MediaPlayerV1alpha5513.net, C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha5513\ff, In Quarantäne, [2248ef56acde1d19c718ee098380639d]
PUP.Optional.MediaViewer.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@MediaViewerV1alpha148.net, C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha148\ff, In Quarantäne, [94d6212418722d09a5c51cd7758e9070]
PUP.Optional.MediaView.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@MediaViewV1alpha1748.net, C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1748\ff, In Quarantäne, [5a1049fc078379bdf3d0658db1526b95]
PUP.Optional.MediaView.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@MediaViewV1alpha203.net, C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha203\ff, In Quarantäne, [7befee57dcae57df7053b141b053c040]
PUP.Optional.MediaWatch.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@MediaWatchV1home45.net, C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home45\ff, In Quarantäne, [74f6a79ebdcd4aec8eb4eb3fcb3a3ac6]
PUP.Optional.MediaBuzz.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@MediaBuzzV1mode5614.net, C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode5614\ff, In Quarantäne, [80ea42037d0d06300104f2f511f22ed2]
PUP.Optional.RichMediaView.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@RichMediaViewV1release483.net, C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release483\ff, In Quarantäne, [81e986bf1773e353f14d5d84f1123ec2]
PUP.Optional.RichMediaView.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|ext@RichMediaViewV1release5902.net, C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release5902\ff, In Quarantäne, [58127acb6d1d3cfa6cd239a8e41fca36]

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 15
PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config, In Quarantäne, [8fdb46ffd1b9dc5a071ea82ca75cdd23], 
PUP.Optional.DPMM.A, C:\Users\User\AppData\LocalLow\DP1815, In Quarantäne, [462459ec2f5b41f563b4acc6a16205fb], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\defaults, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\defaults\preferences, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\userCode, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\locale, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\locale\en-US, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 

Dateien: 156
Trojan.Agent.GT, C:\Users\User\AppData\Roaming\Opvau\qeelg.exe, Löschen bei Neustart, [65051332e6a41b1bffe88dfe8f72fc04], 
Riskware.Injector.DC, C:\Users\User\Downloads\Call od Duty Modern Warfare 3 Multiplayer Aimbot.rar, In Quarantäne, [76f4430298f2ec4a0457fd06e41e9b65], 
PUP.Optional.Freemium.A, C:\Users\User\Downloads\CR_Downloader_fuer_pokemon-white.exe, In Quarantäne, [7af0b98c098180b6ad8892c039c84cb4], 
PUP.Optional.Amonetize.A, C:\Users\User\Downloads\Naruto Shippuden 172 KUC NG H264 .mp4__3515_i103609716_il4890992.exe, In Quarantäne, [fa7098ad3357f046e7e95af79071817f], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (1).exe, In Quarantäne, [4723ea5b6f1b63d3727afba5d32e7987], 
PUP.Optional.Outbrowse, C:\Users\User\Downloads\setup (10).exe, In Quarantäne, [b6b41233c1c9a096fb042e7b34cdef11], 
PUP.Optional.Downloader, C:\Users\User\Downloads\Setup (11).exe, In Quarantäne, [eb7ff0557d0d2d09a853298c3acb748c], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup (13).exe, In Quarantäne, [d892b095d8b2d462152a1245c53b8878], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup (14).exe, In Quarantäne, [8bdfaa9b62281e18174961faf907d52b], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup (15).exe, In Quarantäne, [4c1edf66e0aa56e0e5405606f40c9868], 
PUP.Optional.InstallMonetizer, C:\Users\User\Downloads\FlashPlayersetup__3873_i265940406_il3.exe, In Quarantäne, [1753351012789e981525f95bcd346d93], 
PUP.Optional.InstallMonetizer, C:\Users\User\Downloads\FlashPlayersetup__3873_i265944682_il3.exe, In Quarantäne, [83e714313b4f082e102a0252689940c0], 
PUP.Optional.InstallMonetizer, C:\Users\User\Downloads\FlashPlayersetup__3873_i287501701_il22.exe, In Quarantäne, [f476f253deacf83ec17932220af7f010], 
PUP.Optional.InstallMonetizer, C:\Users\User\Downloads\FlashPlayersetup__3873_i287531605_il22.exe, In Quarantäne, [e4861530f397231384b63420da27768a], 
PUP.Optional.InstallMonetizer, C:\Users\User\Downloads\FlashPlayersetup__3873_i287569863_il22.exe, In Quarantäne, [9cce31147e0cc76f003a2d278d74f50b], 
PUP.Optional.InstallMonetizer, C:\Users\User\Downloads\FlashPlayersetup__3873_i287570136_il22.exe, In Quarantäne, [de8c7cc94c3e7abcdd5d8ec6ba47936d], 
PUP.Optional.InstallMonetizer, C:\Users\User\Downloads\FlashPlayersetup__3873_i297871061_il155.exe, In Quarantäne, [92d8db6af09a1e1859e1e0748180cb35], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (2).exe, In Quarantäne, [76f43f062268290da04c4d53000157a9], 
PUP.Optional.InstallMonetizer, C:\Users\User\Downloads\FlashPlayersetup__3873_i297914981_il155.exe, In Quarantäne, [c4a64ef7f39749ed3a00d282b44d7a86], 
PUP.Optional.Bandoo, C:\Users\User\Downloads\iLividSetup-r563-n-bc.exe, In Quarantäne, [ec7ec87d4743999dc25dc76e4eb3946c], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (3).exe, In Quarantäne, [61090540890139fd68849d03847dfb05], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (4).exe, In Quarantäne, [8ae0d86dafdb2a0c7577217fc23f7b85], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (5).exe, In Quarantäne, [ec7e7cc9206aac8abebf2f773ac7738d], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (6).exe, In Quarantäne, [fb6f85c05931b77f4d30149217ead22e], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (7).exe, In Quarantäne, [c6a46bda890141f58eef4264e71abc44], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (8).exe, In Quarantäne, [7befc87d9cee1d1945389016a65bc937], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup (9).exe, In Quarantäne, [ee7c1b2a98f22214c5b87531778a946c], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1 (1).exe, In Quarantäne, [91d9bd8887031b1bb2bfb7a115ebb24e], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1 (2).exe, In Quarantäne, [e387e4610882f343b2b7a8b2a25e4bb5], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1 (3).exe, In Quarantäne, [c0aa2c19bad0a096470016483ac6c43c], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1 (4).exe, In Quarantäne, [e189d372cbbf9f9778cfe777d927946c], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1 (5).exe, In Quarantäne, [dd8de164a6e4b08693f80eef2cd5f20e], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1 (6).exe, In Quarantäne, [1a5086bfd5b5a294a9e2d8252bd6b14f], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1 (7).exe, In Quarantäne, [1e4c71d47d0d9a9c4a417588b74afa06], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1 (8).exe, In Quarantäne, [d09a182db8d2ef472a61b54810f106fa], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Setup v2 1.exe, In Quarantäne, [0a608bbaaae088ae06610354ea16d030], 
PUP.Optional.OutBrowse, C:\Users\User\Downloads\setup.exe, In Quarantäne, [9bcfac99fb8f65d105204efc5ca9f40c], 
PUP.Optional.BundleInstaller.A, C:\Users\User\Downloads\Player Setup (1).exe, In Quarantäne, [83e779cc6129be78696f6f015ea34eb2], 
PUP.Optional.DomaIQ, C:\Users\User\Downloads\Player Setup (2).exe, In Quarantäne, [98d25de8f892c472effe8328b34e2cd4], 
PUP.Optional.MultiPlug, C:\Users\User\Downloads\Player Setup (3).exe, In Quarantäne, [85e5ce77840675c1113dd30b5aa748b8], 
PUP.Optional.BundleInstaller.A, C:\Users\User\Downloads\Player Setup.exe, In Quarantäne, [313948fd1f6b7eb832a64d2318e99f61], 
PUP.Optional.OptimumInstaller.A, C:\Users\User\Downloads\Player-Chrome (1).exe, In Quarantäne, [dd8ddd68f496bd7953a65e1aef1254ac], 
PUP.Optional.OptimumInstaller.A, C:\Users\User\Downloads\Player-Chrome (2).exe, In Quarantäne, [15551f26d3b7003623d68eeaae530ef2], 
PUP.Optional.OptimumInstaller.A, C:\Users\User\Downloads\Player-Chrome.exe, In Quarantäne, [3a3075d03456f0465c9dc5b34ab7f30d], 
PUP.Optional.BundleInstaller.A, C:\Users\User\Downloads\Player_Setup.exe, In Quarantäne, [b8b252f38cfe4beb8e354b27c041a15f], 
PUP.Optional.InstallBrain, C:\Users\User\Downloads\VideoPerformerSetup.exe, In Quarantäne, [6bff1b2ae5a58da949fb3203738df50b], 
PUP.Optional.Amonetize.A, C:\Users\User\AppData\Local\23568\a9319.exe, In Quarantäne, [a3c73f061c6ef44216557cdb53ad17e9], 
PUP.Optional.WidgetContext.A, C:\Users\User\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi, In Quarantäne, [bfab291cd3b7ee48c7f63a7bf40fad53], 
PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config\ver.xml, In Quarantäne, [8fdb46ffd1b9dc5a071ea82ca75cdd23], 
PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe, In Quarantäne, [8fdb46ffd1b9dc5a071ea82ca75cdd23], 
PUP.Optional.DPMM.A, C:\Users\User\AppData\LocalLow\DP1815\DTFProxyToServerSect_bCrossriderApp0047220_p4748.dat, In Quarantäne, [462459ec2f5b41f563b4acc6a16205fb], 
PUP.Optional.DPMM.A, C:\Users\User\AppData\LocalLow\DP1815\DTFProxyToServerSect_bCrossriderApp0047220_p7844.dat, In Quarantäne, [462459ec2f5b41f563b4acc6a16205fb], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome.manifest, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\install.rdf, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\0eb2c09cfab7484ad8958d3f69f0a9b3.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\55e398718a6d40da99ec5b8f6c5f9a59.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\a14b589a8577c50a47dba5bc0a3579f2.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\background.html, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\browser.xul, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\ccc9cfeb749c1b25b1bf39867bdd7c40.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\dialog.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\fcb08181ef6c350b1ed9908bef3f4114.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\ff5c835064357fbb4f60fe9c6083888c.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\ffCoreFilesIndex.txt, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\options.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\options.xul, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\search_dialog.xul, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\8e9956735b9d0228ec4bcd7b51709b9e.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\0d8461de791dba4fc276c65ff23e7598.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\115d4a19f88c5b157369dd45df3b1dc0.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\2a044b4794dc0795c934f06248e98a8e.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\36f0ad63edf1fee04289df33b7c9ad13.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\5d121094d898b4f558ba3bf18c7df523.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\632571aba8daeec33f0015d77ef0bc01.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\68c20f89e419dcf392d59287b6b13b85.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\6c91562a23eefe8572c0e779d775c5bd.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\9ded66430ba0e418be8be8bae40ded5d.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\a1dc04b8e9ca4663fe421627bffae8b5.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\a1f2f9f6e39921e25e6270dc79943b1a.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\b70af0c242080aec031be0c125b361a7.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\c8d9849cc93a0d77a06e4b22d80c3f7c.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\d0a8cfe1f49e928f32938bad1d7d5220.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\api\f482f97bfa92d721a7c28538f990d2fc.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\71912a7d8fe03f888f389066786f0941.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\0d72a7bc5c51fae42f9071a9fe840cc8.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\17033d4df2e0eb373a44828dfc897abd.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\18e63b0fb95469750a9b0d65105bba2b.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\234d5d0fb2ebadcff429c5ab449520e6.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\35b777dd58d5d955feb631396a126339.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\622ced2739fd1a7bef2e7bb6023264c2.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\64901a0e285e57b6fc8f1c2af4416af8.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\67f322d0e1db95fc59d6458c0fd5bfb8.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\6a21caae0591e6079d9e7d9203b518f7.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\6b2b6a99a060d53eff42af141084c20e.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\6edf8971c62127c16789e82eb9176733.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\6f79bfbe77c64ae8a644f03028619c6f.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\70211c1797cd4ae70f83c8b0bc2aa292.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\7db4878123f4d234781e7c51d54da18d.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\85ffa628455dfb141965a88c71988442.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\a44b7165e597db31699790cd8497dd48.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\a5261fa79d3e147491824b84e748e6d9.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\b36942a1e4b7f97447f9149018e1a2ac.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\dbbe1a2d29c0fd2c2753213994ad7e6c.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\chrome\content\core\installer.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\defaults\preferences\prefs.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\manifest.xml, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins.json, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\1.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\102.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\104.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\13.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\14.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\16.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\17.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\177.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\180.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\182.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\183.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\184.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\192.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\193.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\207.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\21.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\22.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\223.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\246.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\253.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\28.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\345.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\354.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\385.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\4.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\47.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\64.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\72.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\78.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\91.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\93.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\plugins\98.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\userCode\background.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\extensionData\userCode\extension.js, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\locale\en-US\translations.dtd, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\button1.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\button2.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\button3.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\button4.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\button5.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\crossrider_statusbar.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\icon128.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\icon16.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\icon24.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\icon48.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\panelarrow-up.png, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\popup.html, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\skin.css, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 
PUP.Optional.CrossRider.A, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\extensions\858a779a-4bec-47f4-ac06-ed86e2daad75@d82626c3-adcb-475b-b77d-9a1e67c4fd2a.com\skin\update.css, In Quarantäne, [beac77ce7713dd59703412600ff458a8], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Eset log:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ccb4fccee4a74e478581d3b163782397
# engine=22908
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-15 02:13:50
# local_time=2015-03-15 03:13:50 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 88293 178015480 0 0
# scanned=187175
# found=31
# cleaned=31
# scan_time=40530
sh=0FADB783C6C38284E5819BCADED2A1C50503F7AF ft=1 fh=fcdd72b19b62f8d2 vn="Win32/AdWare.SmartApps.E Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Bench\BService\1.1\bhelper.dll.vir"
sh=0144DAD6530EDBF83280FF7B7ACE933567C6AF13 ft=1 fh=1852f3471a1c93e3 vn="Win32/AdWare.Yontoo.F Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe.vir"
sh=36AE28E4CC008845E5E58CBC87F3360B489A87C0 ft=1 fh=8aa3e172f5a6ee64 vn="Win64/bProtector.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\loader.dll.vir"
sh=A3DC686988E80D53E58907B579B91D3A9856D053 ft=1 fh=62638af7c7a12355 vn="Win32/bProtector.J evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe.vir"
sh=410B32FD3FE4642644AD91AC60C69B86EC2762DD ft=1 fh=0e378a435beab91a vn="Variante von Win32/Adware.Yontoo.B Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir"
sh=2BAE487AA8A12C5C56FBE0AC14724F82418CE6BD ft=1 fh=499676f60d03baf0 vn="Variante von Win32/Adware.Yontoo.B Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir"
sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Local\genienext\nengine.dll.vir"
sh=683E5F77670D41279B3BD6D33ACF44A82CDFD6E3 ft=1 fh=52e4bdf54b18a591 vn="Variante von Win32/Amonetize.AC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Local\SwvUpdater\Updater.exe.vir"
sh=143416AAC4F6000C3A3235EB4EC955B4D0B6955E ft=1 fh=b68409d87b15670c vn="Win32/DealPly.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe.vir"
sh=FD0663F63F87B7B5B310EC6CE26E72AF58243084 ft=1 fh=f52ffd4db74c8f0b vn="Variante von Win32/DealPly.S evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe.vir"
sh=36405A410CCA340CC748E0796B0ADD0AD6B32625 ft=1 fh=c71c0011ea47c4d7 vn="Win32/FileScout.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\file scout\filescout.exe.vir"
sh=DAE5F5AEAF33F7EC2B14C0963F3064C206E17874 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\invalidprefs.js.vir"
sh=C5DB8386C3A901DD6D4FB8B66685B889FA1099F9 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\user.js.vir"
sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\newnext.me\nengine.dll.vir"
sh=C307169B03CEC17E4D612431FEC97D8966F4C636 ft=1 fh=a38c5df5482fc9b8 vn="Variante von Win32/Toolbar.Conduit.AM evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\ValueApps\CH\TBVerifier.dll.vir"
sh=ACF9E9D055517B6571FB5EF39869632F5C85A2D5 ft=1 fh=c3303b6c2148f14d vn="Variante von MSIL/WebCake.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\Yontoo\YontooDesktop.exe.vir"
sh=7D9EE93F5231AD75CFF7A87EAB92EBB694BBD2DB ft=1 fh=720e32b2a68f033d vn="Variante von Win32/BrowseFox.W evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\Yontoo\dat\bsvc.dll.vir"
sh=4EFFA2BF56C16695B8DDC6B11E0C0478AE1867B6 ft=1 fh=77a4d79c01d9c271 vn="MSIL/BrowseFox.J evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\Yontoo\dat\cst.exe.vir"
sh=7B439FB6CD9AE4A46F402F0A44DB0B22F3479CE6 ft=1 fh=739fca2ab5e7f1a8 vn="Variante von Win32/BrowseFox.W evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\Yontoo\dat\DIBS.dat.vir"
sh=693B5CA371E5C789ABEA7240DCC56FB9AB21FAA6 ft=1 fh=36979a1a6595bee8 vn="Variante von Win32/Amonetize.DY evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\installd.exe.vir"
sh=69881715B4E0378DF66688836637CDCDA2281FF6 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjllbogbaogimpilgdginhalhhbmhiob\1.26.70_0\extensionData\plugins\91.js"
sh=3F2FE652892316F12A1289091DA8917880AB56B0 ft=1 fh=de4faabbe8db6790 vn="Variante von Win32/InstallCore.SO evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\AppData\Local\Opera\CPROGR~1\cache\g_006C\opr00NCF.tmp"
sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\AppData\Roaming\Codec Pack Packages\uninstaller.exe"
sh=E4400A4AB10B97DFA765C4699B5DCB1E68C9F7F6 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\prefs.js"
sh=A3E46DCE769F46048671AC99C553728F6BFFF971 ft=1 fh=c71c00110f023ec6 vn="Variante von Win32/InstallCore.BY evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\Desktop\Pokemon ROM\League of Legends\CR_Downloader_fuer_pokemon-white.exe"
sh=4301CE41A717A01DDEFE771EA8DAB9B0515D6B80 ft=1 fh=8e0bb4cbdf39662d vn="Win32/OutBrowse.V evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\Downloads\Player.exe"
sh=DA6D7D4FD86E0CD4B0512A0BDD684A781144F7A7 ft=1 fh=4c9484167e90a9f5 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\Downloads\PowerPoint Viewer - CHIP-Installer (1).exe"
sh=B66516D29AE1651625A79370F0A296642843F972 ft=1 fh=df6e9bb1a0da80cf vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\Downloads\PowerPoint Viewer - CHIP-Installer.exe"
sh=C49AC73A9960B103F1E3F2229777EEF0BDC856D7 ft=1 fh=eccda623d7f86f4e vn="Variante von Win32/SoftPulse.J evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\Downloads\Setup (12).exe"
sh=4597A412A993571ECB88D43CD91FC922634D13BF ft=1 fh=eeb6c5a42e1278a0 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer (1).exe"
sh=6F5CA1608DF78C9372E79477093B5A406203D9FB ft=1 fh=aa614fc06dada211 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer.exe"

cosinus · 15.03.2015, 17:10

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjllbogbaogimpilgdginhalhhbmhiob
C:\Users\User\AppData\Local\Opera\CPROGR~1\cache
C:\Users\User\AppData\Roaming\Codec Pack Packages
C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\prefs.js
C:\Users\User\Desktop\Pokemon ROM\League of Legends\CR_Downloader_fuer_pokemon-white.exe
C:\Users\User\Downloads\Player.exe
C:\Users\User\Downloads\PowerPoint Viewer - CHIP-Installer (1).exe
C:\Users\User\Downloads\PowerPoint Viewer - CHIP-Installer.exe
C:\Users\User\Downloads\Setup
C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer (1).exe
C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer.exe
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

NeedHelpX27 · 15.03.2015, 18:56

Fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by User at 2015-03-15 18:06:35 Run:2
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available profiles: User)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjllbogbaogimpilgdginhalhhbmhiob
C:\Users\User\AppData\Local\Opera\CPROGR~1\cache
C:\Users\User\AppData\Roaming\Codec Pack Packages
C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\prefs.js
C:\Users\User\Desktop\Pokemon ROM\League of Legends\CR_Downloader_fuer_pokemon-white.exe
C:\Users\User\Downloads\Player.exe
C:\Users\User\Downloads\PowerPoint Viewer - CHIP-Installer (1).exe
C:\Users\User\Downloads\PowerPoint Viewer - CHIP-Installer.exe
C:\Users\User\Downloads\Setup
C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer (1).exe
C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer.exe
EmptyTemp:
Hosts:
*****************

C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjllbogbaogimpilgdginhalhhbmhiob => Moved successfully.
C:\Users\User\AppData\Local\Opera\CPROGR~1\cache => Moved successfully.
C:\Users\User\AppData\Roaming\Codec Pack Packages => Moved successfully.
"C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\cwmpb8fd.default\prefs.js" => File/Directory not found.
"C:\Users\User\Desktop\Pokemon ROM\League of Legends\CR_Downloader_fuer_pokemon-white.exe" => File/Directory not found.
"C:\Users\User\Downloads\Player.exe" => File/Directory not found.
"C:\Users\User\Downloads\PowerPoint Viewer - CHIP-Installer (1).exe" => File/Directory not found.
"C:\Users\User\Downloads\PowerPoint Viewer - CHIP-Installer.exe" => File/Directory not found.
"C:\Users\User\Downloads\Setup" => File/Directory not found.
"C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer (1).exe" => File/Directory not found.
"C:\Users\User\Downloads\VLC media player 32 Bit - CHIP-Installer.exe" => File/Directory not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 74.5 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 18:07:06 ====

cosinus · 15.03.2015, 18:56

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

NeedHelpX27 · 15.03.2015, 18:59

Großes Dankeschön!

Habe sonst keine Probleme am Pc alles bestens.

Anfänger sucht Hilfe bei Virenproblem

Alles rund um Windows: Anfänger sucht Hilfe bei Virenproblem

Problem: Anfänger sucht Hilfe bei Virenproblem