Trojaner-Board - Schadsoftware?

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Schadsoftware? (https://www.trojaner-board.de/159609-schadsoftware.html)

Guten Tag,ich habe seit geraumer Zeit ein Problem das ich mir selbst zuzuschreiben habe,ich habe mir einen Crack gedownloadet...,diesen hab ich sofort wieder runtergehauen,später ist mir dann aufgefallen dass ESET sicht nichtmehr starten . Als Fehlermeldung steht dort dann:
Dieses Programm wurde durch eine Gruppenrichtlinie blockiert.
Könnte es sein dass ich mir durch den Crack Schadsoftware geholt habe, wie einen Virus oder Malware?
Vornerein schonmal Danke für die Antwort

Mfg deluxius

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-10-2014 01

Ran by david (administrator) on DAVID-PC on 10-10-2014 20:56:12

Running from C:\Users\david\Desktop

Loaded Profile: david (Available profiles: david & VERSUCH)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Akamai Technologies, Inc.) C:\Users\david\AppData\Local\Akamai\netsession_win.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Akamai Technologies, Inc.) C:\Users\david\AppData\Local\Akamai\netsession_win.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe

() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe

(Electronic Arts) C:\Program Files (x86)\Origin\OriginClientService.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(PC-Doctor, Inc.) C:\Program Files\My Dell\imstrayicon.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.224\deploy\LoLLauncher.exe

() C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\LoLPatcher.exe

() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\LolClient.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2461504 2014-09-17] (NVIDIA Corporation)

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)

HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)

HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)

HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()

HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Facebook Update] => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Akamai NetSession Interface] => C:\Users\david\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-09-16] (Electronic Arts)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [hh] => C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe [134656 2012-01-27] ()

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [852808 2014-09-23] (Google Inc.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\RunOnce: [hh] => C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe [134656 2012-01-27] ()

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [HideSCAHealth] 1

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\MountPoints2: {1b512607-389d-11e2-b1b2-d4bed9b97b5e} - G:\pushinst.exe

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Command Processor: "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe" <===== ATTENTION!

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\n. ATTENTION! ====> ZeroAccess/Alureon?

HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

AppInit_DLLs: c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll => c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll File Not Found

AppInit_DLLs-x32: c:\progra~3\bitguard\271832~1.68\{c16c1~1\bitguard.dll => "c:\progra~3\bitguard\271832~1.68\{c16c1~1\bitguard.dll" File Not Found

Startup: C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hh.lnk

ShortcutTarget: hh.lnk -> C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe ()

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:"C:\Program Files\AVAST Software\Avast"
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: No Name -> {1FB251BE-1A9B-16AD-99F8-A54DD1FBA160} ->  No File

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: No Name -> {1FB251BE-1A9B-16AD-99F8-A54DD1FBA160} ->  No File

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: No Name -> {a235e1e3-6296-4710-af39-104a7faa6c7c} ->  No File

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

BHO-x32: No Name -> {f236ca79-3123-4afb-9f74-e98117ad5625} ->  No File

Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File

Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default

FF NewTab: user_pref("browser.newtab.url", "");

FF DefaultSearchEngine: Google

FF SearchEngineOrder.1: Google

FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");

FF Homepage: user_pref("browser.startup.homepage", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)

FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF user.js: detected! => C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\user.js

FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]

FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]

FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]

FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]

FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]

FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]

FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]

FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]
 

Chrome: 

=======

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]

CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]

CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]

CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]

CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]

CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]

CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]

CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]

CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]

CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-04-22]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\david\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2013-04-30]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()

S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S4 aswSP; No ImagePath

S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)

R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)

R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)

R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)

R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-10 20:56 - 2014-10-10 20:58 - 00029239 _____ () C:\Users\david\Desktop\FRST.txt

2014-10-10 20:56 - 2014-10-10 20:56 - 00000000 ____D () C:\FRST

2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe

2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe

2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers

2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe

2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive

2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb

2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA

2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll

2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll

2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe

2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe

2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt

2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk

2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames

2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-09-15 17:16 - 2014-09-15 17:16 - 00000000 ____D () C:\Users\david\AppData\Local\Skyrim

2014-09-15 14:02 - 2014-09-15 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-09-13 17:01 - 2014-09-13 17:01 - 00002994 _____ () C:\Windows\System32\Tasks\{27D2EB2D-97B3-45D7-92BF-F3A828E00E69}

2014-09-13 17:01 - 2014-09-13 17:01 - 00002994 _____ () C:\Windows\System32\Tasks\{0DD3DE14-B902-4045-B1FF-C97573D1D309}

2014-09-13 16:48 - 2014-09-13 16:49 - 01595776 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer_.exe

2014-09-13 15:58 - 2014-09-13 15:58 - 00000000 ____D () C:\blabliblu

2014-09-13 15:42 - 2014-09-13 15:42 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images

2014-09-13 15:01 - 2014-09-13 15:01 - 00386680 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys

2014-09-13 00:47 - 2014-09-13 00:47 - 13429504 _____ (Disc Soft Ltd) C:\Users\david\Downloads\DTLite4491-0356.exe

2014-09-11 06:39 - 2014-09-11 06:41 - 00001629 _____ () C:\Users\VERSUCH\Desktop\Sir.lnk

2014-09-11 06:39 - 2014-09-11 06:39 - 00000000 ____D () C:\Games

2014-09-11 00:10 - 2014-09-11 00:10 - 00000000 ____D () C:\ProgramData\Astroburn Lite

2014-09-10 23:40 - 2014-09-10 23:40 - 00000000 ____D () C:\ProgramData\UlhuGisc

2014-09-10 21:14 - 2014-09-11 00:01 - 00000000 ____D () C:\Users\david\AppData\Roaming\DAEMON Tools Lite

2014-09-10 21:12 - 2014-09-11 00:10 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-10 20:58 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps

2014-10-10 20:54 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype

2014-10-10 20:33 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-10-10 20:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-10 20:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-10 20:10 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client

2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks

2014-10-10 18:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job

2014-10-10 18:19 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-10 14:01 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask

2014-10-10 13:16 - 2014-01-02 12:25 - 01295903 _____ () C:\Windows\WindowsUpdate.log

2014-10-10 04:04 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}

2014-10-10 02:00 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe

2014-10-10 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job

2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin

2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-10-09 13:22 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-09 13:22 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-09 13:10 - 2014-01-01 20:14 - 00032179 _____ () C:\Windows\setupact.log

2014-10-09 13:10 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-10-09 13:10 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands

2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log

2014-10-04 15:44 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify

2014-10-03 23:03 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify

2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk

2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation

2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic

2014-09-29 13:11 - 2014-01-07 16:07 - 00950000 _____ () C:\Windows\PFRO.log

2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer

2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg

2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr

2014-09-15 17:14 - 2012-06-29 13:21 - 00000000 ____D () C:\Users\david\Documents\My Games

2014-09-15 17:13 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-09-15 14:02 - 2014-08-26 05:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-09-15 14:02 - 2012-06-23 16:19 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-09-15 14:02 - 2012-01-27 11:00 - 00000000 ____D () C:\ProgramData\Skype

2014-09-14 01:48 - 2013-03-17 21:13 - 20589536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-09-14 01:48 - 2012-06-23 20:58 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 16875856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 03223120 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-09-13 23:53 - 2011-02-17 12:10 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2014-09-13 23:53 - 2011-02-17 11:10 - 02557640 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2014-09-13 23:53 - 2011-02-17 11:10 - 00934216 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2014-09-13 23:53 - 2011-02-17 11:10 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2014-09-13 23:53 - 2011-02-17 11:09 - 06890696 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2014-09-13 23:53 - 2011-02-17 11:09 - 03529872 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2014-09-13 17:53 - 2013-12-29 22:58 - 00001104 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk

2014-09-13 17:05 - 2014-05-28 23:04 - 00000000 ____D () C:\Program Files (x86)\osu!

2014-09-13 01:00 - 2010-11-21 08:50 - 00699416 _____ () C:\Windows\system32\perfh007.dat

2014-09-13 01:00 - 2010-11-21 08:50 - 00149556 _____ () C:\Windows\system32\perfc007.dat

2014-09-13 01:00 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-09-11 17:37 - 2012-06-23 20:59 - 03961833 _____ () C:\Windows\system32\nvcoproc.bin
 

ZeroAccess:

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
 

ZeroAccess:

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
 

Files to move or delete:

====================

C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-09-19 05:45
 

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-10-2014 01

Ran by david at 2014-10-10 20:59:18

Running from C:\Users\david\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )

Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.0.2.189 - Adobe Systems Incorporated)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.5.146 - Adobe Systems, Inc.)

Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)

Any Video Converter 5.5.2 (HKLM-x32\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)

Apple Application Support (HKLM-x32\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)

Arma 2 (HKLM-x32\...\Steam App 33900) (Version:  - Bohemia Interactive)

ARMA 2 Army of The Czech Republic - Data cache removal (HKLM-x32\...\A2ACR Data cache removal) (Version:  - )

ARMA 2: British Armed Forces - Data cache removal (HKLM-x32\...\A2BAF Data cache removal) (Version:  - )

Arma 2: British Armed Forces (HKLM-x32\...\Steam App 65700) (Version:  - Bohemia Interactive)

Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)

ARMA 2: Private Military Company - Data cache removal (HKLM-x32\...\A2PMC Data cache removal) (Version:  - )

Arma 2: Private Military Company (HKLM-x32\...\Steam App 65720) (Version:  - Bohemia Interactive)

Awesomium Redistributable (HKLM-x32\...\{5BCB064B-9F65-4E15-BAFB-669E72E54FD9}) (Version: 1.7.4.2 - SIX Networks GmbH)

AwesomiumSetup (HKLM-x32\...\{19EF99D1-7EE6-4B5E-ABEE-0B3825F703B0}) (Version: 1.00.0000 - SIX Networks GmbH)

Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.4.0 - EA Digital Illusions CE AB)

BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )

BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.9.4 - BitRaider, LLC)

CCG Launcher version 0.6 (HKLM-x32\...\{28362054-F79B-4697-A246-3ECF730E7E9D}_is1) (Version: 0.6 - Custom Combat Gaming)

CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)

Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.50.4.0 - Conexant)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)

DayZ Commander (HKLM-x32\...\{790412BB-B6CE-459B-9E17-7DA7C20FC98C}) (Version: 0.9.124 - Dotjosh Studios)

Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.61 - Dell Inc.)

Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.61 - Dell Inc.)

Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)

Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)

Dell MusicStage (HKLM-x32\...\{3255BC3F-32BA-41ED-93A0-B9AEB6CDD9E6}) (Version: 1.5.201.0 - Fingertapps)

Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)

Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.1.3 - Dell Inc.)

Dell Stage (HKLM-x32\...\{E2F57269-065E-4B19-8CDA-AB6C401FAF1A}) (Version: 1.7.209.0 - Fingertapps)

Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)

Dell VideoStage  (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden

diclovit's mod pack 1.10.6 (HKLM-x32\...\{28B1238E-1C18-4637-A2B7-95315E94EB29}_is1) (Version: 1.10.6 - diclovit)

DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden

eBay (HKLM-x32\...\{A8B88634-7F90-402F-B66A-86429755F6A5}) (Version: 1.4.0 - eBay Inc.)

Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)

Fantasy Voice Pack (HKLM-x32\...\{5F4C3E1F-87FC-41BD-B219-E4156BBD8AE5}) (Version: 1.3.2 - Screaming Bee)

File Association Helper (HKLM\...\{C168639F-5810-4EC8-B1E8-0251AA8A771C}) (Version: 1.2.225.65451 - WinZip Computing International, LLC)

FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version:  - Image-Line)

Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )

Free YouTube to MP3 Converter version 3.12.32.327 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.32.327 - DVDVideoSoft Ltd.)

Furry Voices for Second Life (HKLM-x32\...\{2032DA39-C844-43AE-B638-6A4F7496686E}) (Version: 1.3.1 - Screaming Bee)

Glyph (HKLM-x32\...\Glyph) (Version:  - Trion Worlds, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )

HexChat (x64) (HKLM\...\HexChat (x64)_is1) (Version: 2.9.5 - HexChat)

IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version:  - Image-Line)

Java 7 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417025FF}) (Version: 7.0.250 - Oracle)

Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 RC (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50861 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 RC (Version: 4.5.50861 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.30730.0 - Microsoft Corporation)

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)

Modern War Sounds (HKLM-x32\...\{A514E94F-C436-44C3-A1E9-1F58CD352669}) (Version: 1.0.1 - Screaming Bee)

Mozilla Firefox 22.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 22.0 (x86 en-US)) (Version: 22.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 22.0 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)

My Game Long Name (HKLM\...\UDK-c4ea7acb-501f-4c29-b8c6-daf02f547053) (Version:  - Epic Games, Inc.)

NVIDIA 3D Vision Controller-Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)

NVIDIA 3D Vision Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation)

NVIDIA GeForce Experience Service (Version: 16.13.42 - NVIDIA Corporation) Hidden

NVIDIA Grafiktreiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.162.1274 - NVIDIA Corporation) Hidden

NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Network Service (Version: 2.0 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.14.0702 - NVIDIA Corporation) Hidden

NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)

NVIDIA ShadowPlay 16.13.42 (Version: 16.13.42 - NVIDIA Corporation) Hidden

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 344.11 (Version: 344.11 - NVIDIA Corporation) Hidden

NVIDIA Update 16.13.42 (Version: 16.13.42 - NVIDIA Corporation) Hidden

NVIDIA Update Core (Version: 16.13.42 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.25 (Version: 1.2.25 - NVIDIA Corporation) Hidden

Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )

OpenAL (HKLM-x32\...\OpenAL) (Version:  - )

OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)

Origin (HKLM-x32\...\Origin) (Version: 9.4.21.2812 - Electronic Arts, Inc.)

osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)

Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)

PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden

PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.994 - Even Balance, Inc.)

RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden

Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden

Roxio BackOnTrack (x32 Version: 1.3.3 - Roxio) Hidden

Roxio Burn (x32 Version: 1.8 - Roxio) Hidden

Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)

Roxio Creator Starter (x32 Version: 1.0.439 - Roxio) Hidden

Roxio Creator Starter (x32 Version: 5.0.0 - Roxio) Hidden

Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden

Roxio File Backup (Version: 1.3.2 - Roxio) Hidden

S.T.A.L.K.E.R.: Call of Pripyat (HKLM-x32\...\Steam App 41700) (Version:  - GSC Game World)

SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)

Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)

SlimDX Redistributable (March 2009) (HKLM-x32\...\{D5395E5F-4D45-4665-8F00-234FA33678AF}) (Version: 2.0.7.41 - SlimDX Group)

Snap.Do (HKLM-x32\...\{C0AF06AE-DA2A-4299-AD1A-F40C5C81E409}) (Version: 1.75.1.11559 - ReSoft Ltd.) <==== ATTENTION

Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden

Speccy (HKLM\...\Speccy) (Version: 1.21 - Piriform)

Special Effects Voices (HKLM-x32\...\{913C4C4F-9E3E-41A6-A614-1BDC1352A225}) (Version: 1.0.2 - Screaming Bee)

Spotify (HKCU\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.31064 - TeamViewer)

The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)

Translator Fun Voice Pack (HKLM-x32\...\{C39768C1-82E7-4466-8526-2D8AC44B768F}) (Version: 1.5.1 - Screaming Bee)

Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden

Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)

Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden

Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

WinRAR 4.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-243866017-1107141967-568923311-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\david\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File

CustomCLSID: HKU\S-1-5-21-243866017-1107141967-568923311-1001_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32 -> C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\n. No File
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {025FD671-2EEF-4565-B85B-E99DC670A632} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {050228F8-66AC-4C76-AE27-948A505E8A6E} - \DealPlyUpdate No Task File <==== ATTENTION

Task: {05B71C85-ADE4-49E6-85E4-2280A5CC3E95} - \DealPly No Task File <==== ATTENTION

Task: {11DB9A4D-AC00-48FD-8C89-CFBD238600BA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)

Task: {14FEE834-0A77-4666-83CD-4195AE98AFDC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-03] (Google Inc.)

Task: {180A7227-01BD-4F76-9E90-97066F8DD6D3} - \Desk 365 RunAsStdUser No Task File <==== ATTENTION

Task: {1F1BFE31-0A2E-45FF-A3DB-1E314EF1C341} - System32\Tasks\{103811C6-98C5-4593-9878-D64DB8906036} => C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe

Task: {25769AE3-0013-466B-AB46-C56E34A8C940} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)

Task: {272AB684-61F9-4369-BB25-3E2D14AB93B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-03] (Google Inc.)

Task: {30633D0D-CC3E-4F8A-A0B2-A8576EC69707} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-04] (Adobe Systems Incorporated)

Task: {3CE2026C-48FF-4E0E-8E87-B2BEC94D3FEB} - System32\Tasks\{3EC173E2-65C5-4F3D-9C44-AB294852860F} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603

Task: {43341FCC-7348-47D8-9F41-D6AFD222A976} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.0.26\SymErr.exe

Task: {4B85320F-65AB-4D6C-A326-B54A538E5EC3} - System32\Tasks\{27D2EB2D-97B3-45D7-92BF-F3A828E00E69} => C:\Users\david\Downloads\eset_smart_security_live_installer_.exe [2014-09-13] (ESET)

Task: {58D53B25-FB58-42AF-98A3-C15AAC1B20A3} - System32\Tasks\AdobeAAMUpdater-1.0-david-PC-VERSUCH => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-03] (Adobe Systems Incorporated)

Task: {5D612964-9217-449E-AD2E-30A7757D1F4B} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)

Task: {5EF56591-5D0A-42FE-8F5E-9E1E731F76C0} - System32\Tasks\{2AD196DC-2CAE-4FE8-A293-8C6E15211CB4} => C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe

Task: {615B1915-B622-4F2B-9A47-11815D450255} - \BitGuard No Task File <==== ATTENTION

Task: {712997D8-946B-482C-A0F1-57196C6E778A} - \Software Updater Ui No Task File <==== ATTENTION

Task: {78AFC96B-A918-470F-AEBD-5BA3AA39BB95} - \Software Updater No Task File <==== ATTENTION

Task: {7EA82062-ADEC-4EC2-88F3-1ABEA711A556} - System32\Tasks\{0DD3DE14-B902-4045-B1FF-C97573D1D309} => C:\Users\david\Downloads\eset_smart_security_live_installer_.exe [2014-09-13] (ESET)

Task: {91AD3C1E-5149-4913-B10D-3598A637B7B9} - System32\Tasks\{539A872B-467E-4F11-BD91-CF1F57AD6849} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603

Task: {9ACFE22B-2C00-4316-91D2-B56A0439C887} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.0.26\SymErr.exe

Task: {A5342BC7-3B22-4987-AE79-BB41A042C0C1} - System32\Tasks\{617B6C21-B7A2-4967-ABF9-F012709DC422} => C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe

Task: {A8AC4178-E484-456F-AD29-3D0422444818} - System32\Tasks\AdobeAAMUpdater-1.0-david-PC-david => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-03] (Adobe Systems Incorporated)

Task: {B97EA42A-952F-46F6-931A-02CCD8E49590} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)

Task: {C0F4AE49-3168-4039-BED3-3BA7A681DF03} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe

Task: {C26F7851-C717-4F61-A13B-C3F0EAA24439} - System32\Tasks\{A84A8AB2-258F-4DE7-A802-D08915F5B339} => C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe

Task: {CA9A241F-8AC4-42DC-8428-EBF57E6ACA1B} - System32\Tasks\{FB8A7D5F-7399-47EA-90B6-7AC5055BA85B} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603

Task: {CE0B7FD3-9340-44F2-8ED2-3E00339CF47A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job => C:\Users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-06-23 20:59 - 2014-09-13 23:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2012-06-23 19:03 - 2014-06-21 18:55 - 00076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2012-02-01 12:50 - 2012-02-01 12:50 - 00968048 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

2013-06-20 00:45 - 2013-06-20 00:45 - 04519280 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

2013-04-20 11:25 - 2013-03-01 14:13 - 01300816 _____ () C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

2014-09-03 18:40 - 2014-10-09 22:14 - 02448376 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.224\deploy\LoLLauncher.exe

2014-10-09 22:14 - 2014-10-09 22:14 - 04143096 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\LoLPatcher.exe

2013-07-10 13:41 - 2013-07-10 13:41 - 00074752 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\LolClient.exe

2012-01-27 18:27 - 2012-01-27 18:27 - 00134656 __RSH () C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe

2013-06-20 00:45 - 2013-06-20 00:45 - 03317616 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll

2012-02-01 12:44 - 2012-02-01 12:44 - 08151040 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll

2012-02-01 12:44 - 2012-02-01 12:44 - 02278400 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll

2013-07-12 14:37 - 2013-07-12 14:37 - 32726528 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\libcef.dll

2013-03-13 13:42 - 2013-06-05 14:21 - 00071560 _____ () C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\zlib1.dll

2013-06-20 00:45 - 2013-06-20 00:45 - 00381808 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CCInvokeAAM.dll

2013-07-12 14:37 - 2013-07-12 14:37 - 00736256 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\libglesv2.dll

2013-07-12 14:37 - 2013-07-12 14:37 - 00130048 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\libegl.dll

2014-08-27 23:19 - 2014-09-16 13:12 - 00962560 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll

2014-08-27 23:19 - 2014-09-16 13:12 - 00024064 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll

2014-08-27 23:19 - 2014-09-16 13:12 - 00025088 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll

2014-08-27 23:19 - 2014-09-16 13:12 - 00217088 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll

2014-08-27 23:19 - 2014-09-16 13:12 - 00261632 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll

2014-08-27 23:19 - 2014-09-16 13:12 - 00019968 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll

2014-08-27 23:19 - 2014-09-16 13:12 - 00302592 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll

2014-08-27 23:19 - 2014-09-16 13:12 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll

2014-09-25 01:21 - 2014-09-23 06:06 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\libglesv2.dll

2014-09-25 01:21 - 2014-09-23 06:06 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\libegl.dll

2014-09-25 01:21 - 2014-09-23 06:07 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\pdf.dll

2014-09-25 01:21 - 2014-09-23 06:07 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll

2014-09-25 01:21 - 2014-09-23 06:06 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ffmpegsumo.dll

2014-08-29 03:58 - 2014-08-21 20:15 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll

2014-08-29 03:58 - 2014-08-21 20:15 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll

2014-08-29 03:58 - 2014-08-21 20:15 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll

2013-05-06 17:05 - 2014-09-03 21:28 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll

2014-05-21 23:19 - 2014-09-23 06:32 - 02226880 _____ () C:\Program Files (x86)\Steam\video.dll

2014-08-29 03:58 - 2014-08-21 20:15 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll

2014-08-29 03:58 - 2014-08-21 20:15 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll

2013-06-06 14:06 - 2014-09-23 06:32 - 00679616 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL

2013-03-26 16:16 - 2014-09-05 01:29 - 34589376 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

2014-08-14 22:58 - 2014-09-05 01:29 - 00837824 _____ () C:\Program Files (x86)\Steam\bin\ffmpegsumo.dll

2014-10-09 22:14 - 2014-10-09 22:14 - 01629176 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\RiotLauncher.dll

2014-09-10 15:15 - 2014-09-10 15:15 - 42975744 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\libcef.dll

2014-09-10 15:15 - 2014-09-10 15:15 - 01559552 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\icui18n.dll

2014-09-10 15:15 - 2014-09-10 15:15 - 01241088 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\icuuc.dll

2014-09-10 15:15 - 2014-09-10 15:15 - 04945408 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\v8.dll

2014-10-09 22:14 - 2014-10-09 22:14 - 01708032 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\RiotRadsIO.dll

2013-07-10 13:41 - 2013-07-10 13:41 - 04774248 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\Adobe AIR\Versions\1.0\Resources\WebKit.dll

2013-07-10 13:41 - 2013-07-10 13:41 - 16032616 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll

2014-09-25 01:21 - 2014-09-23 06:07 - 14891848 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Temp:373E1720
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-243866017-1107141967-568923311-500 - Administrator - Disabled)

david (S-1-5-21-243866017-1107141967-568923311-1001 - Administrator - Enabled) => C:\Users\david

Gast (S-1-5-21-243866017-1107141967-568923311-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-243866017-1107141967-568923311-1002 - Limited - Enabled)

VERSUCH (S-1-5-21-243866017-1107141967-568923311-1004 - Administrator - Enabled) => C:\Users\VERSUCH
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/10/2014 08:59:48 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000009593523

ID des fehlerhaften Prozesses: 0x2278

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:58:35 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00000000075d3523

ID des fehlerhaften Prozesses: 0x1470

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:57:22 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000005473523

ID des fehlerhaften Prozesses: 0x2c28

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:55:33 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00000000079c3523

ID des fehlerhaften Prozesses: 0x1d54

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:54:13 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000007893523

ID des fehlerhaften Prozesses: 0x1580

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:53:01 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00000000071a3523

ID des fehlerhaften Prozesses: 0xdfc

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:51:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000007123523

ID des fehlerhaften Prozesses: 0x1534

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:50:43 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc000041d

Fehleroffset: 0x00000000088d3523

ID des fehlerhaften Prozesses: 0x17c8

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:50:38 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00000000088d3523

ID des fehlerhaften Prozesses: 0x17c8

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (10/10/2014 08:49:15 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000008e93523

ID des fehlerhaften Prozesses: 0x1a40

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 
 

System errors:

=============

Error: (10/10/2014 08:58:49 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%-2147024891
 

Error: (10/10/2014 08:58:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147024891
 

Error: (10/10/2014 08:57:36 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%-2147024891
 

Error: (10/10/2014 08:57:36 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147024891
 

Error: (10/10/2014 08:55:48 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%-2147024891
 

Error: (10/10/2014 08:55:48 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147024891
 

Error: (10/10/2014 08:54:26 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%-2147024891
 

Error: (10/10/2014 08:54:26 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147024891
 

Error: (10/10/2014 08:53:14 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%-2147024891
 

Error: (10/10/2014 08:53:14 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147024891
 
 

Microsoft Office Sessions:

=========================

Error: (10/10/2014 08:59:48 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c00000050000000009593523227801cfe4bc3592e969C:\Windows\explorer.exeunknown9af46f19-50af-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:58:35 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000075d3523147001cfe4bc0a2b6fb6C:\Windows\explorer.exeunknown6f909ef4-50af-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:57:22 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000054735232c2801cfe4bbc9784b50C:\Windows\explorer.exeunknown43c49598-50af-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:55:33 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000079c35231d5401cfe4bb98e9ed1eC:\Windows\explorer.exeunknown02ff487e-50af-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:54:13 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c00000050000000007893523158001cfe4bb6e681bd8C:\Windows\explorer.exeunknownd2ea13b2-50ae-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:53:01 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000071a3523dfc01cfe4bb443be5e3C:\Windows\explorer.exeunknowna8664694-50ae-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:51:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c00000050000000007123523153401cfe4bb1a1d92d2C:\Windows\explorer.exeunknown7e3a37b0-50ae-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:50:43 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000041d00000000088d352317c801cfe4baee60089cC:\Windows\explorer.exeunknown5643aeb3-50ae-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:50:38 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c000000500000000088d352317c801cfe4baee60089cC:\Windows\explorer.exeunknown52e29cb9-50ae-11e4-9f78-d4bed9b97b5e
 

Error: (10/10/2014 08:49:15 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d672ee4unknown0.0.0.000000000c00000050000000008e935231a4001cfe4babd70762eC:\Windows\explorer.exeunknown216b88ce-50ae-11e4-9f78-d4bed9b97b5e
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-08-14 11:44:57.261

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 11:44:57.256

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 11:44:57.254

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 11:44:57.197

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 11:44:57.161

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-14 11:44:57.142

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-12 14:05:02.217

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-12 14:05:02.197

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-12 14:05:02.195

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-12 14:05:02.127

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz

Percentage of memory in use: 74%

Total physical RAM: 6126.64 MB

Available physical RAM: 1581.65 MB

Total Pagefile: 12251.48 MB

Available Pagefile: 5989.55 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:450.91 GB) (Free:49.96 GB) NTFS

Drive d: (DATAPART1) (Fixed) (Total:465.75 GB) (Free:372.23 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: F8FE908A)

Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)

Partition 2: (Active) - (Size=14.8 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450.9 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F8FE909D)

Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Snap.Do
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-10-2014 01
Ran by david at 2014-10-11 19:06:41 Run:1
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
*****************

HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.

==== End of Fixlog ====

Combofix Logfile:

Code:

ComboFix 14-10-04.01 - david 11.10.2014  21:25:28.2.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6127.976 [GMT 2:00]

ausgeführt von:: c:\users\david\Desktop\ComboFix.exe

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\CFLog

c:\programdata\31260090b29de69f

c:\programdata\31260090b29de69f\{4820778D-AB0D-6D18-C316-52A6A0E1D507}

c:\programdata\31260090b29de69f\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}

c:\programdata\31260090b29de69f\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}.old

c:\programdata\31260090b29de69f\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}

c:\programdata\PCDr\6426\AddOnDownloaded\12856377-13ca-4a23-b36d-60217190121a.dll

c:\programdata\PCDr\6426\AddOnDownloaded\c234a47d-843f-4a61-889b-e1538e961da5.dll

c:\users\david\AppData\Local\Adobe\gccheck.exe

c:\users\david\AppData\Local\Adobe\gtbcheck.exe

c:\users\david\AppData\Roaming\appdata

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014081920140820\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082020140821\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082120140822\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082220140823\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082320140824\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082420140825\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082520140826\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082620140827\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014082720140828\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014083020140831\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014090420140905\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014090520140906\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014090820140909\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014090920140910\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091020140911\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091220140913\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091320140914\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091520140916\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091620140917\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091720140918\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014091820140919\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092020140921\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092220140923\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092320140924\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092420140925\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092520140926\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092620140927\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092820140929\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014092920140930\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014093020141001\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100120141002\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100220141003\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100320141004\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100620141007\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100820141009\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014100920141010\index.dat

c:\users\david\AppData\Roaming\appdata\Local\Microsoft\Windows\History\History.IE5\MSHist012014101120141012\index.dat

c:\users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe

c:\windows\SysWow64\SET71A0.tmp

c:\windows\SysWow64\SET951B.tmp

D:\install.exe

.

-- Vorheriger Suchlauf --

.

Infizierte Kopie von c:\windows\SysWow64\ntdll.dll wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\wow64_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7601.17725_none_c147c22d473527e8\ntdll.dll wurde wiederhergestellt 

.

--------

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-09-11 bis 2014-10-11  ))))))))))))))))))))))))))))))

.

.

2014-10-11 20:49 . 2014-10-11 20:49        --------        d-sh--w-        c:\users\david\AppData\Roaming\AppData

2014-10-11 20:44 . 2014-10-11 20:44        --------        d-----w-        c:\users\hedev\AppData\Local\temp

2014-10-11 20:44 . 2014-10-11 20:44        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-10-11 20:30 . 2014-10-11 20:30        --------        d-----w-        c:\users\VERSUCH\AppData\Local\temp

2014-10-10 18:56 . 2014-10-11 17:06        --------        d-----w-        C:\FRST

2014-10-10 17:12 . 2014-10-10 17:13        --------        d-----w-        c:\users\david\AppData\Roaming\SpaceEngineers

2014-09-29 18:45 . 2014-09-29 18:45        --------        d-----w-        c:\program files (x86)\AGEIA Technologies

2014-09-29 18:43 . 2014-09-13 20:13        613696        ----a-w-        c:\windows\SysWow64\nvStreaming.exe

2014-09-29 16:41 . 2014-09-29 16:41        --------        d-----w-        C:\NVIDIA

2014-09-29 16:34 . 2014-09-17 02:10        1715224        ----a-w-        c:\windows\system32\nvspbridge64.dll

2014-09-29 16:34 . 2014-09-17 02:10        1291280        ----a-w-        c:\windows\SysWow64\nvspbridge.dll

2014-09-29 16:32 . 2014-09-04 19:14        38048        ----a-w-        c:\windows\system32\drivers\nvvad64v.sys

2014-09-29 16:32 . 2014-09-04 19:14        32416        ----a-w-        c:\windows\SysWow64\nvaudcap32v.dll

2014-09-26 16:07 . 2014-09-26 16:07        --------        d-----w-        c:\users\david\AppData\Roaming\The Creative Assembly

2014-09-20 17:55 . 2014-09-20 17:55        --------        d-----w-        c:\program files (x86)\Common Files\InstallShield

2014-09-16 18:14 . 2014-05-14 16:23        44512        ----a-w-        c:\windows\system32\wups2.dll

2014-09-16 18:14 . 2014-05-14 16:23        58336        ----a-w-        c:\windows\system32\wuauclt.exe

2014-09-16 18:14 . 2014-05-14 16:23        2477536        ----a-w-        c:\windows\system32\wuaueng.dll

2014-09-16 18:14 . 2014-05-14 16:21        2620928        ----a-w-        c:\windows\system32\wucltux.dll

2014-09-16 18:13 . 2014-05-14 16:23        38880        ----a-w-        c:\windows\system32\wups.dll

2014-09-16 18:13 . 2014-05-14 16:23        36320        ----a-w-        c:\windows\SysWow64\wups.dll

2014-09-16 18:13 . 2014-05-14 16:23        700384        ----a-w-        c:\windows\system32\wuapi.dll

2014-09-16 18:13 . 2014-05-14 16:23        581600        ----a-w-        c:\windows\SysWow64\wuapi.dll

2014-09-16 18:13 . 2014-05-14 16:20        97792        ----a-w-        c:\windows\system32\wudriver.dll

2014-09-16 18:13 . 2014-05-14 16:17        92672        ----a-w-        c:\windows\SysWow64\wudriver.dll

2014-09-16 18:13 . 2014-05-14 07:23        198600        ----a-w-        c:\windows\system32\wuwebv.dll

2014-09-16 18:13 . 2014-05-14 07:23        179656        ----a-w-        c:\windows\SysWow64\wuwebv.dll

2014-09-16 18:13 . 2014-05-14 07:20        36864        ----a-w-        c:\windows\system32\wuapp.exe

2014-09-16 18:13 . 2014-05-14 07:17        33792        ----a-w-        c:\windows\SysWow64\wuapp.exe

2014-09-15 15:16 . 2014-09-15 15:16        --------        d-----w-        c:\users\david\AppData\Local\Skyrim

2014-09-15 12:02 . 2014-09-15 12:02        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2014-09-13 13:58 . 2014-09-13 13:58        --------        d-----w-        C:\blabliblu

2014-09-13 13:01 . 2014-09-13 13:01        386680        ----a-w-        c:\windows\system32\drivers\sptd.sys

2014-09-12 09:43 . 2014-09-12 09:43        227728        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-10-04 20:03 . 2012-06-23 14:32        701104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-10-04 20:03 . 2012-01-27 08:40        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-09-17 02:10 . 2013-12-21 16:53        2193560        ----a-w-        c:\windows\SysWow64\nvspcap.dll

2014-09-17 02:10 . 2013-12-21 16:53        2799784        ----a-w-        c:\windows\system32\nvspcap64.dll

2014-09-13 23:48 . 2013-03-17 19:13        20589536        ----a-w-        c:\windows\system32\nvwgf2umx.dll

2014-09-13 23:48 . 2012-06-23 18:58        984424        ----a-w-        c:\windows\system32\nvumdshimx.dll

2014-09-13 23:48 . 2012-01-27 16:13        16875856        ----a-w-        c:\windows\SysWow64\nvd3dum.dll

2014-09-13 23:48 . 2012-01-27 16:13        3223120        ----a-w-        c:\windows\system32\nvapi64.dll

2014-09-13 23:48 . 2012-01-27 16:13        2838424        ----a-w-        c:\windows\SysWow64\nvapi.dll

2014-09-13 21:53 . 2011-02-17 09:09        6890696        ----a-w-        c:\windows\system32\nvcpl.dll

2014-09-13 21:53 . 2011-02-17 09:09        3529872        ----a-w-        c:\windows\system32\nvsvc64.dll

2014-09-13 21:53 . 2011-02-17 10:10        62608        ----a-w-        c:\windows\system32\nvshext.dll

2014-09-13 21:53 . 2011-02-17 09:10        385168        ----a-w-        c:\windows\system32\nvmctray.dll

2014-09-13 21:53 . 2011-02-17 09:10        934216        ----a-w-        c:\windows\system32\nvvsvc.exe

2014-09-13 21:53 . 2011-02-17 09:10        2557640        ----a-w-        c:\windows\system32\nvsvcr.dll

2014-09-11 15:37 . 2012-06-23 18:59        3961833        ----a-w-        c:\windows\system32\nvcoproc.bin

2014-09-04 19:14 . 2013-09-17 17:48        34976        ----a-w-        c:\windows\system32\nvaudcap64v.dll

2014-09-04 11:11 . 2010-06-24 11:33        23256        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2014-03-27 18:29        297128        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Spotify Web Helper"="c:\users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-10-03 1514040]

"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-09-23 1938112]

"AgolBemet"="c:\programdata\AgolBemet\AgolBemet.dat" [2014-08-14 269208]

"AdneWbiql"="c:\programdata\AdneWbiql\AdneWbiql.dat" [2014-08-15 269208]

"IqikWuge"="c:\programdata\IqikWuge\IqikWuge.dat" [2014-08-16 269208]

"OfuxDurov"="c:\programdata\OfuxDurov\OfuxDurov.dat" [2014-08-16 269208]

"EbanOcaha"="c:\programdata\EbanOcaha\EbanOcaha.dat" [2014-08-16 269208]

"OpohEluda"="c:\programdata\OpohEluda\OpohEluda.dat" [2014-08-16 269208]

"OxereNazic"="c:\programdata\OxereNazic\OxereNazic.dat" [2014-08-16 269208]

"OlafcEhitu"="c:\programdata\OlafcEhitu\OlafcEhitu.dat" [2014-08-17 269208]

"EdvapYexhu"="c:\programdata\EdvapYexhu\EdvapYexhu.dat" [2014-08-17 269208]

"UkjaFtoq"="c:\programdata\UkjaFtoq\UkjaFtoq.dat" [2014-08-17 269208]

"UkvoJojow"="c:\programdata\UkvoJojow\UkvoJojow.dat" [2014-08-18 269208]

"ApmeJxel"="c:\programdata\ApmeJxel\ApmeJxel.dat" [2014-08-20 303104]

"OfqiTaxo"="c:\programdata\OfqiTaxo\OfqiTaxo.dat" [2014-08-24 339968]

"AkoyaVgogi"="c:\programdata\AkoyaVgogi\AkoyaVgogi.dat" [2014-08-26 339968]

"AkmupUguge"="c:\programdata\AkmupUguge\AkmupUguge.dat" [2014-08-28 282624]

"AmqiqPizet"="c:\programdata\AmqiqPizet\AmqiqPizet.dat" [2014-09-03 266240]

"OcniNtih"="c:\programdata\OcniNtih\OcniNtih.dat" [2014-09-05 278528]

"OnibErof"="c:\programdata\OnibErof\OnibErof.dat" [2014-09-05 274432]

"UzeneKjojf"="c:\programdata\UzeneKjojf\UzeneKjojf.dat" [2014-09-05 243712]

"IdobvItazx"="c:\programdata\IdobvItazx\IdobvItazx.dat" [2014-09-09 258048]

"UlhuGisc"="c:\programdata\UlhuGisc\UlhuGisc.dat" [2014-09-10 258048]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-08-27 22041192]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2011-08-04 4165440]

"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]

"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]

"Adobe Creative Cloud"="c:\program files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2013-07-12 2236816]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-08-27 22041192]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"Run"= "c:\users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

.

R2 AviraUpgradeService;Avira Upgrade Service;c:\windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe;c:\windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]

R3 BRDriver64;BRDriver64;c:\programdata\BitRaider\BRDriver64.sys;c:\programdata\BitRaider\BRDriver64.sys [x]

R3 BRSptSvc;BitRaider Mini-Support Service;c:\programdata\BitRaider\BRSptSvc.exe;c:\programdata\BitRaider\BRSptSvc.exe [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]

R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]

R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [x]

R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]

R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]

R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]

R4 aswSP;aswSP; [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]

S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]

S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]

S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]

S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]

S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]

S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]

S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]

S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]

S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-09-24 23:20        1096520        ----a-w-        c:\program files (x86)\Google\Chrome\Application\37.0.2062.124\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-10-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 20:03]

.

2014-10-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job

- c:\users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-24 23:20]

.

2014-10-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job

- c:\users\david\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-24 23:20]

.

2014-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-03 13:26]

.

2014-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-03 13:26]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2014-03-20 16:08        357432        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]

@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"

[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]

2013-06-19 22:45        3317616        ----a-w-        c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]

@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"

[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]

2013-06-19 22:45        3317616        ----a-w-        c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]

@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"

[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]

2013-06-19 22:45        3317616        ----a-w-        c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-06-03 472984]

"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2014-02-24 5581888]

"FAHConsole"="c:\program files\File Association Helper\FAHConsole.exe" [2014-01-28 729272]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/

mDefault_Page_URL = hxxp://www.google.com

mStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>

uSearchAssistant = hxxp://www.google.com

IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\

FF - prefs.js: browser.search.selectedEngine - 

FF - prefs.js: browser.startup.homepage - 

FF - prefs.js: keyword.enabled - false

FF - user.js: extensions.mysearchdial.hmpg - false

FF - user.js: extensions.mysearchdial.hmpgUrl - hxxp://start.mysearchdial.com/?f=1&a=dvd_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0DyE0B0E0Dzy0BzyyB0ByD0EtD0F0CtBtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StB0B0A0EtA0E0C0CtGtC0AyDzytGyEyDtD0DtGzy0F0ByBtGyBtCtBzztByDzytCyDtAyBzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0Bzy0ByDtCyDtDtGtB0DtDyDtG0D0CtCyCtGzz0EyC0AtGtC0EzztAyC0CyEyB0FyDyEtA2Q&cr=1320803099&ir=

FF - user.js: extensions.mysearchdial.dfltSrch - false

FF - user.js: extensions.mysearchdial.srchPrvdr - Mysearchdial

FF - user.js: extensions.mysearchdial.dnsErr - true

FF - user.js: extensions.mysearchdial_i.newTab - false

FF - user.js: extensions.mysearchdial.newTabUrl - hxxp://start.mysearchdial.com/?f=2&a=dvd_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0DyE0B0E0Dzy0BzyyB0ByD0EtD0F0CtBtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StB0B0A0EtA0E0C0CtGtC0AyDzytGyEyDtD0DtGzy0F0ByBtGyBtCtBzztByDzytCyDtAyBzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0Bzy0ByDtCyDtDtGtB0DtDyDtG0D0CtCyCtGzz0EyC0AtGtC0EzztAyC0CyEyB0FyDyEtA2Q&cr=1320803099&ir=

FF - user.js: extensions.mysearchdial.tlbrSrchUrl - hxxp://start.mysearchdial.com/?f=3&a=dvd_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0DyE0B0E0Dzy0BzyyB0ByD0EtD0F0CtBtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StB0B0A0EtA0E0C0CtGtC0AyDzytGyEyDtD0DtGzy0F0ByBtGyBtCtBzztByDzytCyDtAyBzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0Bzy0ByDtCyDtDtGtB0DtDyDtG0D0CtCyCtGzz0EyC0AtGtC0EzztAyC0CyEyB0FyDyEtA2Q&cr=1320803099&ir=&q=

FF - user.js: extensions.mysearchdial.id - D4BED9B97B5E0FC2

FF - user.js: extensions.mysearchdial.instlDay - 16182

FF - user.js: extensions.mysearchdial.vrsn - 1.8.29.0

FF - user.js: extensions.mysearchdial.vrsni - 1.8.29.0

FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.29.017:33:8

FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial

FF - user.js: extensions.mysearchdial.prdct - mysearchdial

FF - user.js: extensions.mysearchdial.aflt - dvd_14_17_ch

FF - user.js: extensions.mysearchdial_i.smplGrp - none

FF - user.js: extensions.mysearchdial.tlbrId - base

FF - user.js: extensions.mysearchdial.instlRef - 140305_b

FF - user.js: extensions.mysearchdial.dfltLng - 

FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}

FF - user.js: extensions.mysearchdial.excTlbr - false

FF - user.js: extensions.mysearchdial.cr - 1320803099

FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1Qzu0DyE0B0E0Dzy0BzyyB0ByD0EtD0F0CtBtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StB0B0A0EtA0E0C0CtGtC0AyDzytGyEyDtD0DtGzy0F0ByBtGyBtCtBzztByDzytCyDtAyBzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0Bzy0ByDtCyDtDtGtB0DtDyDtG0D0CtCyCtGzz0EyC0AtGtC0EzztAyC0CyEyB0FyDyEtA2Q

FF - user.js: extensions.mysearchdial.AL - 2

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

BHO-{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160} - (no file)

BHO-{a235e1e3-6296-4710-af39-104a7faa6c7c} - (no file)

BHO-{f236ca79-3123-4afb-9f74-e98117ad5625} - (no file)

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

Toolbar-!{5018CFD2-804D-4C99-9F81-25EAEA2769DE} - (no file)

c:\users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hh.lnk - c:\users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe

BHO-{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160} - (no file)

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)

HKLM-Run-Nvtmru - c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe

AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe

AddRemove-PunkBusterSvc - c:\program files (x86)\Origin Games\BFH Beta\pbsvc.exe

AddRemove-{28B1238E-1C18-4637-A2B7-95315E94EB29}_is1 - c:\games\World_of_Tanks\unins001.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va008]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]

@Denied: (A 2) (Everyone)

@="IFlashBroker6"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.15"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]

@Denied: (A 2) (Everyone)

@="IFlashBroker6"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\windows\SysWOW64\PnkBstrA.exe

c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

c:\program files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe

c:\program files (x86)\Steam\bin\steamwebhelper.exe

c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

c:\program files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

c:\program files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-10-11  22:54:26 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-10-11 20:54

.

Vor Suchlauf: 35 Verzeichnis(se), 65.429.893.120 Bytes frei

Nach Suchlauf: 38 Verzeichnis(se), 65.570.463.744 Bytes frei

.

- - End Of File - - 92079EB355DE2B74682F3514837A3C86

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Suchlauf Datum: 12.10.2014
Suchlauf-Zeit: 15:40:49
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.10.11.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: david

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 293140
Verstrichene Zeit: 10 Min, 4 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 12
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\esrv.mysearchdialESrvc.1, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\esrv.mysearchdialESrvc, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\esrv.mysearchdialESrvc, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\esrv.mysearchdialESrvc.1, In Quarantäne, [88c1f00f14661026c14e89ebd72b9d63],
PUP.Optional.DealPly.A, HKU\S-1-5-21-243866017-1107141967-568923311-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{4B6ACEA2-308A-4876-AD36-57CEC5B4FCC7}, In Quarantäne, [c485a15e99e1d16545013c0429d99967],
PUP.Optional.DealPly.A, HKU\S-1-5-21-243866017-1107141967-568923311-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{4B6ACEA2-308A-4876-AD36-57CEC5B4FCC7}, In Quarantäne, [c485a15e99e1d16545013c0429d99967],
PUP.Optional.PCSpeedUp.A, HKLM\SOFTWARE\SPEEDCHECKER LIMITED\PC Speed Up, In Quarantäne, [99b00cf3f08a6bcb92aaa709877cdc24],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-243866017-1107141967-568923311-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [4cfdfb04532738fea0d84d47fe046d93],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-243866017-1107141967-568923311-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [ea5f32cd7bff76c06569fbafd62d7090],

Registrierungswerte: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-243866017-1107141967-568923311-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, zr2X2X1G1S1F2V1S2Q0V, In Quarantäne, [ea5f32cd7bff76c06569fbafd62d7090]

Registrierungsdaten: 2
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[5aef48b7b5c5a6909ba8a7882ada748c]
PUM.Disabled.SecurityCenter, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER|UpdatesDisableNotify, 1, Gut: (0), Schlecht: (1),Ersetzt,[8cbd0df2e496033345bef03a44c01ee2]

Ordner: 2
PUP.Optional.OpenCandy, C:\Users\david\AppData\Roaming\OpenCandy, In Quarantäne, [50f93bc43e3c3501d5b643434eb445bb],
PUP.Optional.OpenCandy, C:\Users\david\AppData\Roaming\OpenCandy\5A60C4946D3F459D8ABD3CDD76C780A5, In Quarantäne, [50f93bc43e3c3501d5b643434eb445bb],

Dateien: 2
PUP.Optional.OpenCandy, C:\Users\david\Downloads\DTLite4491-0356.exe, In Quarantäne, [fd4c59a63446a195955166eb1aea38c8],
PUP.Optional.OpenCandy, C:\Users\david\AppData\Roaming\OpenCandy\5A60C4946D3F459D8ABD3CDD76C780A5\Trial-14.0.1000.89_de-DE_1004732_DE-1.exe, In Quarantäne, [50f93bc43e3c3501d5b643434eb445bb],

Physische Sektoren: 0
(No malicious items detected)

(end)

AdwCleaner Logfile:

Code:

# AdwCleaner v3.311 - Bericht erstellt am 12/10/2014 um 16:03:22

# Aktualisiert 30/09/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : david - DAVID-PC

# Gestartet von : C:\Users\david\Downloads\AdwCleaner_3.311.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Program Files (x86)\vGrabber-software

Ordner Gelöscht : C:\Users\david\AppData\LocalLow\DataMngr

Ordner Gelöscht : C:\Users\david\AppData\LocalLow\Mysearchdial

Ordner Gelöscht : C:\Users\david\Documents\Optimizer Pro

Ordner Gelöscht : C:\Users\VERSUCH\AppData\Roaming\Mozilla\Firefox\Profiles\j2om1l2w.default\Extensions\staged\ffxtlbr@mysearchdial.com

Ordner Gelöscht : C:\Users\VERSUCH\AppData\Local\Google\Chrome\User Data\Default\Extensions\anapakpgfbcahenpocgaidhcoladocle

Ordner Gelöscht : C:\Users\VERSUCH\AppData\Local\Google\Chrome\User Data\Default\Extensions\canmieadikjafpekoppfdcohgnkgihpa

Datei Gelöscht : C:\END

Datei Gelöscht : C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\user.js

Datei Gelöscht : C:\Users\VERSUCH\AppData\Roaming\Mozilla\Firefox\Profiles\j2om1l2w.default\user.js
 

***** [ Tasks ] *****
 

Task Gelöscht : BitGuard

Task Gelöscht : Dealply

Task Gelöscht : DealPlyUpdate

Task Gelöscht : Desk 365 RunAsStdUser

Task Gelöscht : Software Updater Ui

Task Gelöscht : Software Updater
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MYSEAR~1_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MYSEAR~1_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MySearchDial_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MySearchDial_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\webcakeupdater

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_s-w-a-t-4_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_s-w-a-t-4_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{065C1A21-97F8-45FB-A9F0-861B60FACEC8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3204358F-5904-46A6-841F-D6B5BE3EF4E3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3AE67737-0E3E-44AA-AA5E-46A68BF017FF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3EE5B726-044A-48D2-AA7B-049BD9A0F62A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60FBBE03-57FF-49D8-B38E-053D3F489825}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6A5182F1-C0B8-42B8-96CC-7F329CD46913}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6C153418-8E4D-4FAF-AF27-5201E38463A7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A26A2F05-AC4D-4A1E-9531-9125F7309B78}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5D6240-7DF0-435D-9B9B-F8586A99DE86}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F343045E-E20A-46E1-82D8-9962C43EFC9E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FBB360DC-CB6C-4D6A-808A-2C773151BFFF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFD7DDAC-EC28-42A5-8D39-917B9078604B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A235E1E3-6296-4710-AF39-104A7FAA6C7C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F236CA79-3123-4AFB-9F74-E98117AD5625}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{49606DC7-976D-4030-A74E-9FB5C842FA68}

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\RegisteredApplicationsEx

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Schlüssel Gelöscht : HKLM\SOFTWARE\mysearchdial

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Speedchecker Limited

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF
 

***** [ Browser ] *****
 

-\\ Internet Explorer v9.0.8112.16447
 
 

-\\ Mozilla Firefox v22.0 (en-US)
 

[ Datei : C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\prefs.js ]
 
 

[ Datei : C:\Users\VERSUCH\AppData\Roaming\Mozilla\Firefox\Profiles\j2om1l2w.default\prefs.js ]
 
 

-\\ Google Chrome v37.0.2062.124
 

[ Datei : C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

[ Datei : C:\Users\VERSUCH\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht [Extension] : dhdepfaagokllfmhfbcfmocaeigmoebo

Gelöscht [Extension] : fbmimoidopbghbcmdmpkjaffffmcbmbg

Gelöscht [Extension] : hphibigbodkkohoglgfkddblldpfohjl

Gelöscht [Extension] : kdcnnmifdmlmjffdgeieikcokcogpbej

Gelöscht [Extension] : kincjchfokkeneeofpeefomkikfkiedl

Gelöscht [Extension] : kkkeikdkpjenmoiicggnnodbkebafgpc

Gelöscht [Extension] : mkcedibhemacmilmkpndpkoidlnmgngg

Gelöscht [Extension] : pgmfkblbflahhponhjmkcnpjinenhlnc

Gelöscht [Extension] : anapakpgfbcahenpocgaidhcoladocle

Gelöscht [Extension] : canmieadikjafpekoppfdcohgnkgihpa
 

*************************
 

AdwCleaner[R0].txt - [59055 octets] - [23/11/2013 13:09:43]

AdwCleaner[R1].txt - [5396 octets] - [09/12/2013 18:40:43]

AdwCleaner[R2].txt - [11021 octets] - [12/10/2014 16:02:22]

AdwCleaner[S0].txt - [54852 octets] - [23/11/2013 13:11:23]

AdwCleaner[S1].txt - [5318 octets] - [09/12/2013 18:41:36]

AdwCleaner[S2].txt - [10669 octets] - [12/10/2014 16:03:22]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [10730 octets] ##########

--- --- ---

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.2 (10.09.2014:1)
OS: Windows 7 Home Premium x64
Ran by david on 12.10.2014 at 16:08:45,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_02042013_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_02042013_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_02042013_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_02042013_RASMANCS
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{1FB251BE-1A9B-16AD-99F8-A54DD1FBA160}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\david\appdata\local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [Folder] C:\Users\david\AppData\Roaming\mozilla\firefox\profiles\2mmwkhvz.default\extensions\staged
Emptied folder: C:\Users\david\AppData\Roaming\mozilla\firefox\profiles\2mmwkhvz.default\minidumps [187 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.10.2014 at 16:12:54,33
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014

Ran by david (administrator) on DAVID-PC on 12-10-2014 16:13:44

Running from C:\Users\david\Desktop

Loaded Profile: david (Available profiles: david & VERSUCH)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)

HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)

HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)

HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)

HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"

HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default

FF NewTab: user_pref("browser.newtab.url", "");

FF DefaultSearchEngine: Google

FF SearchEngineOrder.1: Google

FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");

FF Homepage: user_pref("browser.startup.homepage", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)

FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]

FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]

FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]

FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]

FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]

FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]

FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]

FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]
 

Chrome: 

=======

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]

CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]

CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]

CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]

CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]

CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]

CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]

CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]

CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()

S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S4 aswSP; No ImagePath

S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)

R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)

R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)

R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)

R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

S3 PCDSRVC{D3412D80-CF3B4A27-06020200}_0; \??\c:\program files\my dell\pcdsrvc_x64.pkms [X]

S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-12 16:13 - 2014-10-12 16:13 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion

2014-10-12 16:12 - 2014-10-12 16:12 - 00002316 _____ () C:\Users\david\Desktop\JRT.txt

2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe

2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Desktop\JRT.exe

2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT

2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe

2014-10-12 15:59 - 2014-10-12 15:59 - 00004314 _____ () C:\Users\david\Desktop\mbam.txt

2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys

2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe

2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe

2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}

2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe

2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt

2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox

2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe

2014-10-11 19:10 - 2014-10-11 19:10 - 00000740 _____ () C:\Users\david\Desktop\Revo Uninstaller.lnk

2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe

2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss

2014-10-10 20:59 - 2014-10-10 21:00 - 00047985 _____ () C:\Users\david\Desktop\Addition.txt

2014-10-10 20:56 - 2014-10-12 16:13 - 00011595 _____ () C:\Users\david\Desktop\FRST.txt

2014-10-10 20:56 - 2014-10-12 16:13 - 00000000 ____D () C:\FRST

2014-10-10 20:55 - 2014-10-12 16:13 - 02110464 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe

2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe

2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers

2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe

2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive

2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb

2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA

2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll

2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll

2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe

2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe

2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt

2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk

2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames

2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-09-15 17:16 - 2014-09-15 17:16 - 00000000 ____D () C:\Users\david\AppData\Local\Skyrim

2014-09-15 14:02 - 2014-09-15 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-09-13 17:01 - 2014-09-13 17:01 - 00002994 _____ () C:\Windows\System32\Tasks\{27D2EB2D-97B3-45D7-92BF-F3A828E00E69}

2014-09-13 17:01 - 2014-09-13 17:01 - 00002994 _____ () C:\Windows\System32\Tasks\{0DD3DE14-B902-4045-B1FF-C97573D1D309}

2014-09-13 16:48 - 2014-09-13 16:49 - 01595776 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer_.exe

2014-09-13 15:58 - 2014-09-13 15:58 - 00000000 ____D () C:\blabliblu

2014-09-13 15:42 - 2014-09-13 15:42 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images

2014-09-13 15:01 - 2014-09-13 15:01 - 00386680 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-12 16:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-12 16:12 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-12 16:12 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-12 16:08 - 2014-01-02 12:25 - 01381899 _____ () C:\Windows\WindowsUpdate.log

2014-10-12 16:06 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe

2014-10-12 16:06 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype

2014-10-12 16:05 - 2014-01-01 20:14 - 00032851 _____ () C:\Windows\setupact.log

2014-10-12 16:05 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-12 16:05 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-10-12 16:05 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-10-12 16:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-12 16:04 - 2014-01-07 16:07 - 00953452 _____ () C:\Windows\PFRO.log

2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner

2014-10-12 15:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job

2014-10-12 15:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-12 14:51 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client

2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0

2014-10-12 12:44 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask

2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner

2014-10-12 05:47 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}

2014-10-12 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job

2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default

2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps

2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks

2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin

2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands

2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log

2014-10-04 15:44 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify

2014-10-03 23:03 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify

2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk

2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation

2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic

2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer

2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg

2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr

2014-09-15 17:14 - 2012-06-29 13:21 - 00000000 ____D () C:\Users\david\Documents\My Games

2014-09-15 17:13 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-09-15 14:02 - 2014-08-26 05:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-09-15 14:02 - 2012-06-23 16:19 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-09-15 14:02 - 2012-01-27 11:00 - 00000000 ____D () C:\ProgramData\Skype

2014-09-14 01:48 - 2013-03-17 21:13 - 20589536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-09-14 01:48 - 2012-06-23 20:58 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 16875856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 03223120 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-09-13 23:53 - 2011-02-17 12:10 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2014-09-13 23:53 - 2011-02-17 11:10 - 02557640 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2014-09-13 23:53 - 2011-02-17 11:10 - 00934216 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2014-09-13 23:53 - 2011-02-17 11:10 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2014-09-13 23:53 - 2011-02-17 11:09 - 06890696 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2014-09-13 23:53 - 2011-02-17 11:09 - 03529872 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2014-09-13 17:53 - 2013-12-29 22:58 - 00001104 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk

2014-09-13 17:05 - 2014-05-28 23:04 - 00000000 ____D () C:\Program Files (x86)\osu!

2014-09-13 01:00 - 2010-11-21 08:50 - 00699416 _____ () C:\Windows\system32\perfh007.dat

2014-09-13 01:00 - 2010-11-21 08:50 - 00149556 _____ () C:\Windows\system32\perfc007.dat

2014-09-13 01:00 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
 

ZeroAccess:

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
 

ZeroAccess:

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
 

Some content of TEMP:

====================

C:\Users\david\AppData\Local\Temp\InstHelper.exe

C:\Users\david\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-09-19 05:45
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Außerdem lässt sich ESET wieder nicht öffnen wegen Gruppenrichtlinien(?!?!?!?)

So,jetzt hab ich das mit der Fixlist.txt wiederholt und es ist wieder ok

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=aef44c87e8bee247909276d9062540b9
# engine=20571
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-13 03:58:46
# local_time=2014-10-13 05:58:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 16003 164845776 0 0
# compatibility_mode_1='ESET Smart Security 7.0'
# compatibility_mode=8221 16777213 100 100 5171763 33795668 0 0
# scanned=306593
# found=105
# cleaned=0
# scan_time=6634
# nod_component=V3 Build:0x30000000
sh=D6E3758123FA1C4B9945BBF3359584ABA79C90F3 ft=1 fh=1253b0cb81c9b1bd vn="Win32/DealPly.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdate.exe.vir"
sh=143416AAC4F6000C3A3235EB4EC955B4D0B6955E ft=1 fh=b68409d87b15670c vn="Win32/DealPly.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdateVer.exe.vir"
sh=99DF98DFEF4B483889FA88162D20EE46340A5DBE ft=1 fh=e6e2c196b2ffcb6f vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65auxstb.dll.vir"
sh=56CF4F2AC44C6ADD5CDCD419BA4B99D22DC7A0E3 ft=1 fh=46ed14ba69906e9f vn="Win32/Toolbar.MyWebSearch.X evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65barsvc.exe.vir"
sh=0FF3588ECB69D2B18C6FAEC012672CA2F60314F6 ft=1 fh=731190b7425307d6 vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65bprtct.dll.vir"
sh=12FF3195BDACA5482034AAC3C3E132D5ADA421A9 ft=1 fh=982f80d197512813 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65brstub.dll.vir"
sh=0C88EFCFA1C77D597111125A6C031CEB47B18BA7 ft=1 fh=b856def4c7346ea3 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65dlghk.dll.vir"
sh=8090E240F528004402B29C11E5072BED79D95384 ft=1 fh=73e118282d8d3c4a vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65dyn.dll.vir"
sh=2CA2EA6CF1AD1FE87C25D4AB6B1C7729E48C6390 ft=1 fh=a34a8b9082c46c86 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65feedmg.dll.vir"
sh=9788294F2B8AB28DBAE4C73BB61A6B1200BDD89D ft=1 fh=af8ed8fd644fe8ac vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65highin.exe.vir"
sh=9D54BAF23397E5F1444BC6471052AD234B76FBD3 ft=1 fh=2ab58862c927227b vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65hkstub.dll.vir"
sh=978867B422339E68971E56C49C66F14F2ACD745D ft=1 fh=dd289cd2c7a55037 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65httpct.dll.vir"
sh=DC971C75FFCE77CC952FB6660A2603E09D62D4D9 ft=1 fh=ac2f97e786bfc982 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65idle.dll.vir"
sh=AFCAAC5845D81A407C63733E4A7D007167F96BE8 ft=1 fh=02b0c8de8c8e9f1e vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65impipe.exe.vir"
sh=556C4FCA5D890F17B7B5040A601B42452A205E29 ft=1 fh=0f2a31b21601aeb5 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65medint.exe.vir"
sh=3EB4A6A25199E6339EC04F36189C71738DE63CE7 ft=1 fh=eafb3b5bfaf84345 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65mlbtn.dll.vir"
sh=DFD07B722E317D1CDDAAB7D5B31BFAB57CC5E739 ft=1 fh=507b4871517a4ad4 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65msg.dll.vir"
sh=77C8DC985373B1E5D9035ECB3A831C7DD1ABFD55 ft=1 fh=e1f880731de07609 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65radio.dll.vir"
sh=C5F26031D5E0C487BFF0D60AA44603135BF60395 ft=1 fh=a846ae5344ec78c3 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65regfft.dll.vir"
sh=A2F202F68FEF2A31E9FE3AE124A46B908349778C ft=1 fh=bf17c6b7704b10fd vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65reghk.dll.vir"
sh=65D604A070334183E5034CDEEC5838E46D705794 ft=1 fh=3d9a604351eb1640 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65regiet.dll.vir"
sh=72E48F7F37E208A52AD975EAECAB29FC50223C27 ft=1 fh=958a563919bf5cc2 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65script.dll.vir"
sh=496310EE0816B49176E03226DB102FAE9AA452B4 ft=1 fh=ceffc168909c0690 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65sknlcr.dll.vir"
sh=F5946D49A70A64072739370E7BAD592FE4799EA1 ft=1 fh=5bc3efb780caf8fa vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65skplay.exe.vir"
sh=8ACE75F6C2417666AD9D60837B72D78B394C3944 ft=1 fh=ae6d89138faf571c vn="Win32/Toolbar.MyWebSearch.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65SrchMn.exe.vir"
sh=110033F4A78DCA521E8BA73F75747E4E3B6AE545 ft=1 fh=21686246ae128bdd vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65uabtn.dll.vir"
sh=630D5FC9ACC4932C87263895F554F8C3CB6D4B4A ft=1 fh=b81ce565a99a556c vn="Win64/Toolbar.MyWebSearch.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe.vir"
sh=374E378A91209732B48C8416D1E9805E98FDCFA9 ft=1 fh=6da58ad1308c1c96 vn="Win64/Toolbar.MyWebSearch.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegratorStub64.dll.vir"
sh=3D7CD376DFDB97512A376E85FBB7F04344C051B6 ft=1 fh=e0ed2601e18686d8 vn="Win64/Toolbar.MyWebSearch.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\Hpg64.dll.vir"
sh=6FD2998EC2109C6D2AB8816D908D712A3D380FA2 ft=1 fh=709275a08cc237b9 vn="Win32/Toolbar.MyWebSearch.T evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\NP65Stub.dll.vir"
sh=B8944722E8D577E67925DD4A72D1D8E44C3BC6CA ft=1 fh=6f8a20cf4b11d7b0 vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\FromDocToPDF_65\bar\1.bin\T8EXTPEX.DLL.vir"
sh=76039D5A64EF897B1AA388EED70452774019DB59 ft=1 fh=890f56b03e669e11 vn="Win32/Somoto.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\FilesFrog Update Checker\update_checker.exe.vir"
sh=BDF49E9DB1E7F1DF379077EE4D651A841F88EE43 ft=1 fh=b964e189b9898c4e vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=48C826EF00938F035C91C9F6B3E167CB21D96633 ft=1 fh=59fac0a23423ab50 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_16.dll.vi r"
sh=45F4ABE93E1FB333545719948B418FB1207A5085 ft=1 fh=3a58b09db4698b9d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_17.dll.vi r"
sh=FED76CBD8D5660DEC60B3F16547372DEE7F87FA6 ft=1 fh=9705b06916654cd4 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_18.dll.vi r"
sh=C8F23EFE19C6A36D8921AE5C96F95808EBEFBE05 ft=1 fh=8064b8d931435e04 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_19.dll.vi r"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_20.dll.vi r"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_21.dll.vi r"
sh=1549CF4F9282F1B42A58B5E050E12EF0AD669798 ft=1 fh=ffe6693d8bc7d6c5 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\BabSolution\Shared\BabMaint.exe.vir"
sh=143416AAC4F6000C3A3235EB4EC955B4D0B6955E ft=1 fh=b68409d87b15670c vn="Win32/DealPly.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\DealPly\UpdateProc\UpdateTask.exe.vir"
sh=48C826EF00938F035C91C9F6B3E167CB21D96633 ft=1 fh=59fac0a23423ab50 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_16.dll.vir"
sh=45F4ABE93E1FB333545719948B418FB1207A5085 ft=1 fh=3a58b09db4698b9d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_17.dll.vir"
sh=FED76CBD8D5660DEC60B3F16547372DEE7F87FA6 ft=1 fh=9705b06916654cd4 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_18.dll.vir"
sh=C8F23EFE19C6A36D8921AE5C96F95808EBEFBE05 ft=1 fh=8064b8d931435e04 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_19.dll.vir"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_20.dll.vir"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{2894a412-e091-6466-9ab8-ea76561654ca}\components\SmartbarFireFoxRemotePlugin_21.dll.vir"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_361\uninstall.exe"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_442\uninstall.exe"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_455\uninstall.exe"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_518\uninstall.exe"
sh=D9A47983E4D8E67F12BC190A8BE3B659411D123A ft=1 fh=63c40146d214be9b vn="Win32/InstallBrain evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Uninstall Information\ib_uninst_519\uninstall.exe"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\AbewgOcluk\AbewgOcluk.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\AdneWbiql\AdneWbiql.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\AgolBemet\AgolBemet.dat"
sh=231FDBB0835B7165187DCD020E30DA6DCBAAC40F ft=1 fh=a1cb973671c52be2 vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\ProgramData\AkmupUguge\AkmupUguge.dat"
sh=0B471E11AECB3E8BC7BEEBB7D3712B3EA28D6DF6 ft=1 fh=34bf2e27b2f00fa4 vn="Win32/PSW.Papras.CP Trojaner" ac=I fn="C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
sh=D34239554573F008EE1B9A4C9C0A4E14A5FCFFF3 ft=1 fh=3da748770c2769f4 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
sh=B597999D94CF8489899AB37080277B0B4D4BBF3E ft=1 fh=b0d762835dd86ebf vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\ProgramData\ApmeJxel\ApmeJxel.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\EbanOcaha\EbanOcaha.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\EzekoTahit\EzekoTahit.dat"
sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\InstallMate\{D1E9524F-6F96-4A26-A8CD-27B40A0A70B9}\Custom.dll"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\IqikWuge\IqikWuge.dat"
sh=C82DE4B723515AFE0E8B4EFD33882BE50633C5ED ft=1 fh=4798528b570f1298 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\ProgramData\OcniNtih\OcniNtih.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OdwewEzuce\OdwewEzuce.dat"
sh=0B471E11AECB3E8BC7BEEBB7D3712B3EA28D6DF6 ft=1 fh=34bf2e27b2f00fa4 vn="Win32/PSW.Papras.CP Trojaner" ac=I fn="C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OfuxDurov\OfuxDurov.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
sh=9A4E26F49E2BBC55ACAF4E8A4FBE96A2D8AE6162 ft=1 fh=ddfa1c972cc4cd39 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\ProgramData\OnibErof\OnibErof.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OpohEluda\OpohEluda.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\OxereNazic\OxereNazic.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\UgeceNezxo\UgeceNezxo.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\UkvoJojow\UkvoJojow.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\ProgramData\UxzoqYoxuz\UxzoqYoxuz.dat"
sh=15BA7A48CE702BB40B26C14FE7BD1644B65D8C1F ft=1 fh=7ea0f02e160fa23a vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\AbewgOcluk\AbewgOcluk.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\AdneWbiql\AdneWbiql.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\AgolBemet\AgolBemet.dat"
sh=231FDBB0835B7165187DCD020E30DA6DCBAAC40F ft=1 fh=a1cb973671c52be2 vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\Users\All Users\AkmupUguge\AkmupUguge.dat"
sh=0B471E11AECB3E8BC7BEEBB7D3712B3EA28D6DF6 ft=1 fh=34bf2e27b2f00fa4 vn="Win32/PSW.Papras.CP Trojaner" ac=I fn="C:\Users\All Users\AkoyaVgogi\AkoyaVgogi.dat"
sh=D34239554573F008EE1B9A4C9C0A4E14A5FCFFF3 ft=1 fh=3da748770c2769f4 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\Users\All Users\AmqiqPizet\AmqiqPizet.dat"
sh=B597999D94CF8489899AB37080277B0B4D4BBF3E ft=1 fh=b0d762835dd86ebf vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\Users\All Users\ApmeJxel\ApmeJxel.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\EbanOcaha\EbanOcaha.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\EdvapYexhu\EdvapYexhu.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\EzekoTahit\EzekoTahit.dat"
sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{D1E9524F-6F96-4A26-A8CD-27B40A0A70B9}\Custom.dll"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\IqikWuge\IqikWuge.dat"
sh=C82DE4B723515AFE0E8B4EFD33882BE50633C5ED ft=1 fh=4798528b570f1298 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\Users\All Users\OcniNtih\OcniNtih.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OdwewEzuce\OdwewEzuce.dat"
sh=0B471E11AECB3E8BC7BEEBB7D3712B3EA28D6DF6 ft=1 fh=34bf2e27b2f00fa4 vn="Win32/PSW.Papras.CP Trojaner" ac=I fn="C:\Users\All Users\OfqiTaxo\OfqiTaxo.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OfuxDurov\OfuxDurov.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OlafcEhitu\OlafcEhitu.dat"
sh=9A4E26F49E2BBC55ACAF4E8A4FBE96A2D8AE6162 ft=1 fh=ddfa1c972cc4cd39 vn="Win32/PSW.Papras.DR Trojaner" ac=I fn="C:\Users\All Users\OnibErof\OnibErof.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OpohEluda\OpohEluda.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\OxereNazic\OxereNazic.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\UgeceNezxo\UgeceNezxo.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\UkjaFtoq\UkjaFtoq.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\UkvoJojow\UkvoJojow.dat"
sh=4EE209ABEE9D3DC3127F1796A73503F4ACAC954A ft=1 fh=df7e0c350b53f941 vn="Win32/PSW.Papras.CX Trojaner" ac=I fn="C:\Users\All Users\UxzoqYoxuz\UxzoqYoxuz.dat"
sh=15BA7A48CE702BB40B26C14FE7BD1644B65D8C1F ft=1 fh=7ea0f02e160fa23a vn="Win32/PSW.Papras.DJ Trojaner" ac=I fn="C:\Users\All Users\UzeneKjojf\UzeneKjojf.dat"
sh=39A46FEA3BDD809C2AC0FA05915422FD7C8A6C9E ft=1 fh=7ffefd4dcecdb4d1 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\david\Desktop\Dubstep\flstudio_11.1.exe"
sh=9A3475327FC02A2434383C1FF3B41C90FA27E2FE ft=1 fh=53854597d8020bfc vn="Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\david\Local Settings\Application Data\Bundled software uninstaller\biclient.exe"
sh=7D46D39AEE256EED7AB0AA6EF0E9A422831C01DC ft=1 fh=5623ddb773ac081b vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\VERSUCH\Downloads\FreeYouTubeToMP3Converter5628.exe"

Results of screen317's Security Check version 0.99.87
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
ESET Smart Security 7.0
Antivirus out of date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 25
Java version out of Date!
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Mozilla Firefox 22.0 Firefox out of Date!
Google Chrome 37.0.2062.120
Google Chrome 37.0.2062.124
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
windows defender MpCmdRun.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

frisches FRST log fehlt.

ups mein fehler
FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014

Ran by david (administrator) on DAVID-PC on 14-10-2014 16:23:37

Running from C:\Users\david\Desktop

Loaded Profile: david (Available profiles: david & VERSUCH)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe

(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(PC-Doctor, Inc.) C:\Program Files\My Dell\imstrayicon.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)

HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)

HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)

HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"

HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default

FF NewTab: user_pref("browser.newtab.url", "");

FF DefaultSearchEngine: Google

FF SearchEngineOrder.1: Google

FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");

FF Homepage: user_pref("browser.startup.homepage", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)

FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]

FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]

FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]

FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]

FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]

FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]

FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]

FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]
 

Chrome: 

=======

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]

CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]

CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]

CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]

CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]

CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]

CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]

CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]

CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()

S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S4 aswSP; No ImagePath

S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)

R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)

R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)

R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)

R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-14 16:24 - 2014-10-14 16:24 - 00000000 ____D () C:\Users\david\Desktop\Neuer Ordner

2014-10-13 18:56 - 2014-10-13 18:56 - 00705224 _____ (ESET) C:\Windows\eins2666.dll

2014-10-13 18:51 - 2014-10-13 18:52 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer (1).exe

2014-10-13 18:40 - 2014-10-13 18:40 - 00001034 _____ () C:\Users\david\Desktop\checkup.txt

2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Downloads\SecurityCheck.exe

2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Desktop\SecurityCheck.exe

2014-10-13 16:03 - 2014-10-13 16:03 - 02347384 _____ (ESET) C:\Users\david\Downloads\esetsmartinstaller_deu.exe

2014-10-13 13:28 - 2014-10-13 13:28 - 00001106 _____ () C:\Users\david\Desktop\dings.txt

2014-10-13 13:27 - 2014-10-13 13:27 - 00001106 _____ () C:\Users\david\Desktop\die sachen für die fixlist.txt

2014-10-12 16:13 - 2014-10-12 16:13 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion

2014-10-12 16:12 - 2014-10-12 16:12 - 00002316 _____ () C:\Users\david\Desktop\JRT.txt

2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe

2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Desktop\JRT.exe

2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT

2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe

2014-10-12 15:59 - 2014-10-12 15:59 - 00004314 _____ () C:\Users\david\Desktop\mbam.txt

2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys

2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe

2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe

2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}

2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe

2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt

2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox

2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe

2014-10-11 19:10 - 2014-10-11 19:10 - 00000740 _____ () C:\Users\david\Desktop\Revo Uninstaller.lnk

2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe

2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss

2014-10-10 20:59 - 2014-10-10 21:00 - 00047985 _____ () C:\Users\david\Desktop\Addition.txt

2014-10-10 20:56 - 2014-10-14 16:23 - 00020861 _____ () C:\Users\david\Desktop\FRST.txt

2014-10-10 20:56 - 2014-10-14 16:23 - 00000000 ____D () C:\FRST

2014-10-10 20:55 - 2014-10-12 16:13 - 02110464 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe

2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe

2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers

2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe

2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive

2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb

2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA

2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll

2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll

2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe

2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe

2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt

2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk

2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames

2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-09-15 17:16 - 2014-09-15 17:16 - 00000000 ____D () C:\Users\david\AppData\Local\Skyrim

2014-09-15 14:02 - 2014-09-15 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-14 16:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-14 16:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-14 16:09 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype

2014-10-14 15:57 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-10-14 15:48 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask

2014-10-14 15:38 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}

2014-10-14 15:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job

2014-10-14 15:16 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-14 15:16 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-14 15:14 - 2014-01-02 12:25 - 01505120 _____ () C:\Windows\WindowsUpdate.log

2014-10-14 15:12 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe

2014-10-14 15:08 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-14 15:07 - 2014-01-01 20:14 - 00033243 _____ () C:\Windows\setupact.log

2014-10-14 15:06 - 2014-01-07 16:07 - 00954286 _____ () C:\Windows\PFRO.log

2014-10-14 15:06 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-10-14 15:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-14 05:45 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify

2014-10-14 01:33 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client

2014-10-14 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job

2014-10-13 21:01 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify

2014-10-12 16:28 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner

2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0

2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner

2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default

2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps

2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks

2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin

2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands

2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log

2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk

2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation

2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic

2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer

2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg

2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr

2014-09-15 17:14 - 2012-06-29 13:21 - 00000000 ____D () C:\Users\david\Documents\My Games

2014-09-15 14:02 - 2014-08-26 05:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-09-15 14:02 - 2012-06-23 16:19 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-09-15 14:02 - 2012-01-27 11:00 - 00000000 ____D () C:\ProgramData\Skype

2014-09-14 01:48 - 2013-03-17 21:13 - 20589536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-09-14 01:48 - 2012-06-23 20:58 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 16875856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 03223120 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
 

ZeroAccess:

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
 

ZeroAccess:

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
 

Some content of TEMP:

====================

C:\Users\david\AppData\Local\Temp\InstHelper.exe

C:\Users\david\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-09-19 05:45
 

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014

Ran by david (administrator) on DAVID-PC on 14-10-2014 16:23:37

Running from C:\Users\david\Desktop

Loaded Profile: david (Available profiles: david & VERSUCH)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe

(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(PC-Doctor, Inc.) C:\Program Files\My Dell\imstrayicon.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)

HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)

HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)

HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"

HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default

FF NewTab: user_pref("browser.newtab.url", "");

FF DefaultSearchEngine: Google

FF SearchEngineOrder.1: Google

FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");

FF Homepage: user_pref("browser.startup.homepage", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)

FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]

FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]

FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]

FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]

FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]

FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]

FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]

FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]
 

Chrome: 

=======

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]

CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]

CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]

CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]

CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]

CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]

CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]

CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]

CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()

S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S4 aswSP; No ImagePath

S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)

R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)

R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)

R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)

R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-14 16:24 - 2014-10-14 16:24 - 00000000 ____D () C:\Users\david\Desktop\Neuer Ordner

2014-10-13 18:56 - 2014-10-13 18:56 - 00705224 _____ (ESET) C:\Windows\eins2666.dll

2014-10-13 18:51 - 2014-10-13 18:52 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer (1).exe

2014-10-13 18:40 - 2014-10-13 18:40 - 00001034 _____ () C:\Users\david\Desktop\checkup.txt

2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Downloads\SecurityCheck.exe

2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Desktop\SecurityCheck.exe

2014-10-13 16:03 - 2014-10-13 16:03 - 02347384 _____ (ESET) C:\Users\david\Downloads\esetsmartinstaller_deu.exe

2014-10-13 13:28 - 2014-10-13 13:28 - 00001106 _____ () C:\Users\david\Desktop\dings.txt

2014-10-13 13:27 - 2014-10-13 13:27 - 00001106 _____ () C:\Users\david\Desktop\die sachen für die fixlist.txt

2014-10-12 16:13 - 2014-10-12 16:13 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion

2014-10-12 16:12 - 2014-10-12 16:12 - 00002316 _____ () C:\Users\david\Desktop\JRT.txt

2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe

2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Desktop\JRT.exe

2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT

2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe

2014-10-12 15:59 - 2014-10-12 15:59 - 00004314 _____ () C:\Users\david\Desktop\mbam.txt

2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys

2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe

2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe

2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}

2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe

2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt

2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox

2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe

2014-10-11 19:10 - 2014-10-11 19:10 - 00000740 _____ () C:\Users\david\Desktop\Revo Uninstaller.lnk

2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe

2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss

2014-10-10 20:59 - 2014-10-10 21:00 - 00047985 _____ () C:\Users\david\Desktop\Addition.txt

2014-10-10 20:56 - 2014-10-14 16:23 - 00020861 _____ () C:\Users\david\Desktop\FRST.txt

2014-10-10 20:56 - 2014-10-14 16:23 - 00000000 ____D () C:\FRST

2014-10-10 20:55 - 2014-10-12 16:13 - 02110464 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe

2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe

2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers

2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe

2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive

2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb

2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA

2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll

2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll

2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe

2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe

2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt

2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk

2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames

2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-09-15 17:16 - 2014-09-15 17:16 - 00000000 ____D () C:\Users\david\AppData\Local\Skyrim

2014-09-15 14:02 - 2014-09-15 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-14 16:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-14 16:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-14 16:09 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype

2014-10-14 15:57 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-10-14 15:48 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask

2014-10-14 15:38 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}

2014-10-14 15:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job

2014-10-14 15:16 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-14 15:16 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-14 15:14 - 2014-01-02 12:25 - 01505120 _____ () C:\Windows\WindowsUpdate.log

2014-10-14 15:12 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe

2014-10-14 15:08 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-14 15:07 - 2014-01-01 20:14 - 00033243 _____ () C:\Windows\setupact.log

2014-10-14 15:06 - 2014-01-07 16:07 - 00954286 _____ () C:\Windows\PFRO.log

2014-10-14 15:06 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-10-14 15:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-14 05:45 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify

2014-10-14 01:33 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client

2014-10-14 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job

2014-10-13 21:01 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify

2014-10-12 16:28 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner

2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0

2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner

2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default

2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps

2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks

2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin

2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands

2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log

2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk

2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation

2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic

2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer

2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg

2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr

2014-09-15 17:14 - 2012-06-29 13:21 - 00000000 ____D () C:\Users\david\Documents\My Games

2014-09-15 14:02 - 2014-08-26 05:17 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-09-15 14:02 - 2012-06-23 16:19 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-09-15 14:02 - 2012-01-27 11:00 - 00000000 ____D () C:\ProgramData\Skype

2014-09-14 01:48 - 2013-03-17 21:13 - 20589536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-09-14 01:48 - 2012-06-23 20:58 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 16875856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 03223120 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-09-14 01:48 - 2012-01-27 18:13 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
 

ZeroAccess:

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
 

ZeroAccess:

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
 

Some content of TEMP:

====================

C:\Users\david\AppData\Local\Temp\InstHelper.exe

C:\Users\david\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-09-19 05:45
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Java und Firefox updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Program Files (x86)\Uninstall Information

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"

BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}

C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@

C:\ProgramData\AbewgOcluk

C:\ProgramData\AdneWbiql

C:\ProgramData\AgolBemet

C:\ProgramData\AkmupUguge

C:\ProgramData\AkoyaVgogi

C:\ProgramData\AmqiqPizet

C:\ProgramData\ApmeJxel

C:\ProgramData\EbanOcaha

C:\ProgramData\EdvapYexhu

C:\ProgramData\EzekoTahit

C:\ProgramData\InstallMate

C:\ProgramData\IqikWuge

C:\ProgramData\OcniNtih

C:\ProgramData\OdwewEzuce

C:\ProgramData\OfqiTaxo

C:\ProgramData\OfuxDurov

C:\ProgramData\OlafcEhitu

C:\ProgramData\OnibErof

C:\ProgramData\OpohEluda

C:\ProgramData\OxereNazic

C:\ProgramData\UgeceNezxo

C:\ProgramData\UkjaFtoq

C:\ProgramData\UkvoJojow

C:\ProgramData\UxzoqYoxuz

C:\ProgramData\UzeneKjojf

Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Alle Passwörter und Zugänge ändern. Frisches FRST log bitte.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-10-2014 02
Ran by david at 2014-10-16 01:09:09 Run:5
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Program Files (x86)\Uninstall Information
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AgolBemet] => regsvr32.exe "C:\ProgramData\AgolBemet\AgolBemet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AdneWbiql] => regsvr32.exe "C:\ProgramData\AdneWbiql\AdneWbiql.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IqikWuge] => regsvr32.exe "C:\ProgramData\IqikWuge\IqikWuge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfuxDurov] => regsvr32.exe "C:\ProgramData\OfuxDurov\OfuxDurov.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EbanOcaha] => regsvr32.exe "C:\ProgramData\EbanOcaha\EbanOcaha.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OxereNazic] => regsvr32.exe "C:\ProgramData\OxereNazic\OxereNazic.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OlafcEhitu] => regsvr32.exe "C:\ProgramData\OlafcEhitu\OlafcEhitu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [EdvapYexhu] => regsvr32.exe "C:\ProgramData\EdvapYexhu\EdvapYexhu.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkjaFtoq] => regsvr32.exe "C:\ProgramData\UkjaFtoq\UkjaFtoq.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UkvoJojow] => regsvr32.exe "C:\ProgramData\UkvoJojow\UkvoJojow.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [ApmeJxel] => regsvr32.exe "C:\ProgramData\ApmeJxel\ApmeJxel.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OfqiTaxo] => regsvr32.exe "C:\ProgramData\OfqiTaxo\OfqiTaxo.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkoyaVgogi] => regsvr32.exe "C:\ProgramData\AkoyaVgogi\AkoyaVgogi.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AkmupUguge] => regsvr32.exe "C:\ProgramData\AkmupUguge\AkmupUguge.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [AmqiqPizet] => regsvr32.exe "C:\ProgramData\AmqiqPizet\AmqiqPizet.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OcniNtih] => regsvr32.exe "C:\ProgramData\OcniNtih\OcniNtih.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OnibErof] => regsvr32.exe "C:\ProgramData\OnibErof\OnibErof.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UzeneKjojf] => regsvr32.exe "C:\ProgramData\UzeneKjojf\UzeneKjojf.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [IdobvItazx] => regsvr32.exe "C:\ProgramData\IdobvItazx\IdobvItazx.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [UlhuGisc] => regsvr32.exe "C:\ProgramData\UlhuGisc\UlhuGisc.dat"
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Policies\Explorer: [Run] "C:\Users\david\AppData\Roaming\Microsoft\Windows\IEUpdate\hh.exe"
BootExecute: autocheck autochk * aswBoot.exe /M:c2da9b9a2a /wow /dir:C:\Program
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@
C:\ProgramData\AbewgOcluk
C:\ProgramData\AdneWbiql
C:\ProgramData\AgolBemet
C:\ProgramData\AkmupUguge
C:\ProgramData\AkoyaVgogi
C:\ProgramData\AmqiqPizet
C:\ProgramData\ApmeJxel
C:\ProgramData\EbanOcaha
C:\ProgramData\EdvapYexhu
C:\ProgramData\EzekoTahit
C:\ProgramData\InstallMate
C:\ProgramData\IqikWuge
C:\ProgramData\OcniNtih
C:\ProgramData\OdwewEzuce
C:\ProgramData\OfqiTaxo
C:\ProgramData\OfuxDurov
C:\ProgramData\OlafcEhitu
C:\ProgramData\OnibErof
C:\ProgramData\OpohEluda
C:\ProgramData\OxereNazic
C:\ProgramData\UgeceNezxo
C:\ProgramData\UkjaFtoq
C:\ProgramData\UkvoJojow
C:\ProgramData\UxzoqYoxuz
C:\ProgramData\UzeneKjojf
Emptytemp:
*****************

C:\Program Files (x86)\Uninstall Information => Moved successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AgolBemet => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AdneWbiql => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\IqikWuge => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OfuxDurov => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\EbanOcaha => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OpohEluda => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OxereNazic => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OlafcEhitu => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\EdvapYexhu => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UkjaFtoq => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UkvoJojow => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ApmeJxel => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OfqiTaxo => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AkoyaVgogi => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AkmupUguge => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AmqiqPizet => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OcniNtih => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OnibErof => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UzeneKjojf => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\IdobvItazx => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\UlhuGisc => value deleted successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\Run => value deleted successfully.
HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully.
esgiguard => Service deleted successfully.
X6va008 => Service deleted successfully.
X6va011 => Service deleted successfully.
xhunter1 => Service deleted successfully.
C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d} => Moved successfully.
"C:\Windows\Installer\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@" => File/Directory not found.
C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d} => Moved successfully.
"C:\Users\david\AppData\Local\{1547a4df-a060-bca0-5da2-aff15ee51e9d}\@" => File/Directory not found.
C:\ProgramData\AbewgOcluk => Moved successfully.
C:\ProgramData\AdneWbiql => Moved successfully.
C:\ProgramData\AgolBemet => Moved successfully.
C:\ProgramData\AkmupUguge => Moved successfully.
C:\ProgramData\AkoyaVgogi => Moved successfully.
C:\ProgramData\AmqiqPizet => Moved successfully.
C:\ProgramData\ApmeJxel => Moved successfully.
C:\ProgramData\EbanOcaha => Moved successfully.
C:\ProgramData\EdvapYexhu => Moved successfully.
C:\ProgramData\EzekoTahit => Moved successfully.
C:\ProgramData\InstallMate => Moved successfully.
C:\ProgramData\IqikWuge => Moved successfully.
C:\ProgramData\OcniNtih => Moved successfully.
C:\ProgramData\OdwewEzuce => Moved successfully.
C:\ProgramData\OfqiTaxo => Moved successfully.
C:\ProgramData\OfuxDurov => Moved successfully.
C:\ProgramData\OlafcEhitu => Moved successfully.
C:\ProgramData\OnibErof => Moved successfully.
C:\ProgramData\OpohEluda => Moved successfully.
C:\ProgramData\OxereNazic => Moved successfully.
C:\ProgramData\UgeceNezxo => Moved successfully.
C:\ProgramData\UkjaFtoq => Moved successfully.
C:\ProgramData\UkvoJojow => Moved successfully.
C:\ProgramData\UxzoqYoxuz => Moved successfully.
C:\ProgramData\UzeneKjojf => Moved successfully.
EmptyTemp: => Removed 618.8 MB temporary data.

The system needed a reboot.

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-10-2014 02

Ran by david (administrator) on DAVID-PC on 16-10-2014 18:47:25

Running from C:\Users\david\Desktop

Loaded Profile: david (Available profiles: david & VERSUCH)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe

(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe

() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.224\deploy\LoLLauncher.exe

() C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\LoLPatcher.exe

() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\LolClient.exe

(PC-Doctor, Inc.) C:\Program Files\My Dell\imstrayicon.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)

HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)

HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)

HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"

HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default

FF NewTab: user_pref("browser.newtab.url", "");

FF DefaultSearchEngine: Google

FF SearchEngineOrder.1: Google

FF SelectedSearchEngineuser_pref("browser.search.selectedEngine", "");: user_pref("browser.search.selectedEngine", "");

FF Homepage: user_pref("browser.startup.homepage", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)

FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]

FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]

FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]

FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]

FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]

FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]

FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]

FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]
 

Chrome: 

=======

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]

CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]

CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]

CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]

CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]

CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]

CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]

CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]

CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()

S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S4 aswSP; No ImagePath

S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)

R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)

R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)

R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)

R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-16 18:47 - 2014-10-16 18:47 - 00022759 _____ () C:\Users\david\Desktop\FRST.txt

2014-10-16 01:09 - 2014-10-16 01:09 - 00000000 ____D () C:\ProgramData\OpohEluda

2014-10-14 16:24 - 2014-10-16 01:08 - 00000000 ____D () C:\Users\david\Desktop\TrojanerBoard

2014-10-13 18:51 - 2014-10-13 18:52 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer (1).exe

2014-10-13 18:40 - 2014-10-13 18:40 - 00001034 _____ () C:\Users\david\Desktop\checkup.txt

2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Downloads\SecurityCheck.exe

2014-10-13 16:03 - 2014-10-13 16:03 - 02347384 _____ (ESET) C:\Users\david\Downloads\esetsmartinstaller_deu.exe

2014-10-12 16:13 - 2014-10-16 01:09 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion

2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe

2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT

2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe

2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys

2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe

2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe

2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}

2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe

2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt

2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox

2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe

2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe

2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss

2014-10-10 20:56 - 2014-10-16 18:47 - 00000000 ____D () C:\FRST

2014-10-10 20:55 - 2014-10-16 01:09 - 02111488 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe

2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe

2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers

2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe

2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive

2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb

2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA

2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll

2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll

2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe

2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe

2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt

2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk

2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames

2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-09-16 20:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-09-16 20:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-09-16 20:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-09-16 20:13 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-09-16 20:13 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-09-16 20:13 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-09-16 20:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-09-16 20:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-16 18:45 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-10-16 18:43 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype

2014-10-16 18:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job

2014-10-16 18:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-16 18:19 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-16 18:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-16 16:22 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask

2014-10-16 13:20 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-16 13:20 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-16 13:15 - 2014-01-02 12:25 - 01633945 _____ () C:\Windows\WindowsUpdate.log

2014-10-16 13:13 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe

2014-10-16 13:12 - 2014-01-01 20:14 - 00033747 _____ () C:\Windows\setupact.log

2014-10-16 13:12 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-10-16 13:12 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-16 01:13 - 2014-01-07 16:07 - 01374658 _____ () C:\Windows\PFRO.log

2014-10-16 01:11 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify

2014-10-16 01:09 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client

2014-10-16 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job

2014-10-15 17:52 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}

2014-10-13 21:01 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify

2014-10-12 16:28 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner

2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0

2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner

2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default

2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps

2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks

2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin

2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands

2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log

2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk

2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation

2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic

2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer

2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg

2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-09-16 20:19 - 2012-06-24 09:00 - 00000000 ____D () C:\ProgramData\PCDr
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-09-19 05:45
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"

C:\ProgramData\OpohEluda

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Nochmal ein frisches FRST log bitte.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-10-2014
Ran by david at 2014-10-17 13:14:33 Run:6
Running from C:\Users\david\Desktop
Loaded Profile: david (Available profiles: david & VERSUCH)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\ESET <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [OpohEluda] => regsvr32.exe "C:\ProgramData\OpohEluda\OpohEluda.dat"
C:\ProgramData\OpohEluda
*****************

HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKU\S-1-5-21-243866017-1107141967-568923311-1001\Software\Microsoft\Windows\CurrentVersion\Run\\OpohEluda => value deleted successfully.
C:\ProgramData\OpohEluda => Moved successfully.

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-10-2014

Ran by david (administrator) on DAVID-PC on 17-10-2014 13:15:06

Running from C:\Users\david\Desktop

Loaded Profile: david (Available profiles: david & VERSUCH)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 9

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe

(Spotify Ltd) C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe

() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2195824 2012-02-01] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)

HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)

HKLM-x32\...\Run: [Dell Registration] => C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)

HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [968048 2012-02-01] ()

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2236816 2013-07-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Spotify Web Helper] => C:\Users\david\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-03] (Spotify Ltd)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938112 2014-09-23] (Valve Corporation)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

HKU\S-1-5-21-243866017-1107141967-568923311-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_v_1_1_0_x64.dll ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM-x32 - No Name - !{1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File

Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default

FF NewTab: user_pref("browser.newtab.url", "");

FF DefaultSearchEngine: Google

FF SearchEngineOrder.1: Google

FF SelectedSearchEngineuser_pref("browser.search.selectedEngine", "");: user_pref("browser.search.selectedEngine", "");

FF Homepage: user_pref("browser.startup.homepage", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)

FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File

FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\david\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\david\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Extension: Amazon-Icon - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\amazon-icon@giga.de [2014-04-16]

FF Extension: Stylish - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2012-10-08]

FF Extension: NoScript - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-10-07]

FF Extension: Adblock Plus - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-08]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-14]

FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-22]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldheroespatcher@ea.com [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\battlefieldplay4free@ea.com [Not Found]

FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]

FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi [Not Found]

FF Extension: No Name - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin [Not Found]

FF Extension: No Name - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\2mmwkhvz.default\extensions\{2894a412-e091-6466-9ab8-ea76561654ca} [Not Found]
 

Chrome: 

=======

CHR HomePage: Default -> chrome://newtab

CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-20]

CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-20]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]

CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-20]

CHR Extension: (Google-Suche) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-20]

CHR Extension: (Stylish) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-07-03]

CHR Extension: (AdBlock) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-03]

CHR Extension: (Skype Click to Call) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-20]

CHR Extension: (Google Wallet) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Battlefield Play4Free) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2014-04-06]

CHR Extension: (Google Mail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-20]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-08-04] ()

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-11] (BitRaider, LLC)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-17] (NVIDIA Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3191392 2014-05-15] (INCA Internet Co., Ltd.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-17] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-17] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-21] ()

S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_53f13fa6\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_53f13fa6\setup.exe" /NOTEMPCLEANUP /CLEANUPSRCFILES"
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S4 aswSP; No ImagePath

S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-08] (BitRaider)

R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)

R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)

R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)

R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-17] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-09-13] (Duplex Secure Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-16 18:48 - 2014-10-16 18:48 - 00043177 _____ () C:\Users\david\Desktop\Addition.txt

2014-10-16 18:47 - 2014-10-17 13:15 - 00009201 _____ () C:\Users\david\Desktop\FRST.txt

2014-10-14 16:24 - 2014-10-16 01:08 - 00000000 ____D () C:\Users\david\Desktop\TrojanerBoard

2014-10-13 18:51 - 2014-10-13 18:52 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer (1).exe

2014-10-13 18:40 - 2014-10-13 18:40 - 00001034 _____ () C:\Users\david\Desktop\checkup.txt

2014-10-13 18:17 - 2014-10-13 18:17 - 00854417 _____ () C:\Users\david\Downloads\SecurityCheck.exe

2014-10-13 16:03 - 2014-10-13 16:03 - 02347384 _____ (ESET) C:\Users\david\Downloads\esetsmartinstaller_deu.exe

2014-10-12 16:13 - 2014-10-17 13:14 - 00000000 ____D () C:\Users\david\Desktop\FRST-OlderVersion

2014-10-12 16:08 - 2014-10-12 16:08 - 01705755 _____ (Thisisu) C:\Users\david\Downloads\JRT.exe

2014-10-12 16:08 - 2014-10-12 16:08 - 00000000 ____D () C:\Windows\ERUNT

2014-10-12 16:03 - 2014-10-12 16:03 - 00000000 _____ () C:\Users\david\Downloads\C6E7.tmp

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311.exe

2014-10-12 16:01 - 2014-10-12 16:01 - 01375089 _____ () C:\Users\david\Downloads\AdwCleaner_3.311 (1).exe

2014-10-12 15:56 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys

2014-10-12 15:40 - 2014-10-12 15:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-12 15:40 - 2014-10-12 15:40 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-12 15:40 - 2014-10-12 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-12 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-12 15:40 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-12 15:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-12 15:39 - 2014-10-12 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\david\Downloads\mbam-setup-2.0.2.1012.exe

2014-10-12 12:20 - 2014-10-12 12:21 - 04965896 _____ (Piriform Ltd) C:\Users\david\Downloads\ccsetup418.exe

2014-10-12 12:19 - 2014-10-12 12:19 - 00003206 _____ () C:\Windows\System32\Tasks\{536105BA-DC87-4426-BF21-07E3D6160448}

2014-10-11 23:01 - 2014-10-11 23:01 - 01660616 _____ (ESET) C:\Users\david\Downloads\eset_smart_security_live_installer.exe

2014-10-11 22:54 - 2014-10-11 22:54 - 00033935 _____ () C:\ComboFix.txt

2014-10-11 20:04 - 2014-10-11 22:54 - 00000000 ____D () C:\Qoobox

2014-10-11 20:04 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-10-11 20:04 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-10-11 20:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-10-11 20:04 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-10-11 20:01 - 2014-10-11 22:53 - 00000000 ____D () C:\Windows\erdnt

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Downloads\ComboFix.exe

2014-10-11 20:00 - 2014-10-11 20:00 - 05582481 ____R (Swearware) C:\Users\david\Desktop\ComboFix.exe

2014-10-11 19:09 - 2014-10-11 19:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\david\Downloads\revosetup95.exe

2014-10-10 21:18 - 2014-10-10 21:18 - 00000000 ____D () C:\Windows\pss

2014-10-10 20:56 - 2014-10-17 13:15 - 00000000 ____D () C:\FRST

2014-10-10 20:55 - 2014-10-17 13:14 - 02112000 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe

2014-10-10 20:55 - 2014-10-10 20:55 - 02109952 _____ (Farbar) C:\Users\david\Downloads\FRST64.exe

2014-10-10 19:12 - 2014-10-10 19:13 - 00000000 ____D () C:\Users\david\AppData\Roaming\SpaceEngineers

2014-10-06 21:21 - 2014-10-06 22:00 - 764194469 _____ ( ) C:\Users\david\Downloads\Call_of_Pripyat_Complete_v1.0.2_Setup.exe

2014-10-03 10:50 - 2014-10-03 10:50 - 00000000 ____D () C:\Users\david\Documents\Paradox Interactive

2014-09-29 20:45 - 2014-09-29 20:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-09-29 20:43 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-09-29 20:33 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-09-29 20:33 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-09-29 20:33 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 18106152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-09-29 20:33 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-09-29 20:33 - 2014-09-14 01:48 - 00026956 _____ () C:\Windows\system32\nvinfo.pb

2014-09-29 18:41 - 2014-09-29 18:41 - 00000000 ____D () C:\NVIDIA

2014-09-29 18:34 - 2014-09-17 04:10 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll

2014-09-29 18:34 - 2014-09-17 04:10 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll

2014-09-29 18:32 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-09-29 18:32 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-09-29 18:29 - 2014-09-29 18:32 - 319671744 _____ (NVIDIA Corporation) C:\Users\david\Downloads\344.11-desktop-win8-win7-winvista-64bit-international-whql.exe

2014-09-29 01:11 - 2014-09-29 01:11 - 06626832 _____ (TeamViewer GmbH) C:\Users\david\Downloads\TeamViewer_Setup_de.exe

2014-09-25 01:04 - 2014-09-25 01:04 - 00342430 _____ () C:\Users\david\Downloads\lolhentai-1.6.3.sdt

2014-09-20 19:59 - 2014-09-20 19:59 - 00002466 _____ () C:\Users\VERSUCH\Desktop\SWAT 4 Single Player Demo.lnk

2014-09-20 19:59 - 2014-09-20 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUGames

2014-09-20 19:51 - 2014-09-20 19:51 - 00367432 _____ () C:\Users\david\Downloads\SoftonicDownloader_for_s-w-a-t-4.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-17 13:14 - 2012-06-23 16:32 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-17 13:11 - 2014-01-02 12:25 - 01692820 _____ () C:\Windows\WindowsUpdate.log

2014-10-17 13:10 - 2012-06-30 11:37 - 00000000 ____D () C:\Users\david\AppData\Local\Adobe

2014-10-17 13:10 - 2012-06-23 16:19 - 00000000 ____D () C:\Users\david\AppData\Roaming\Skype

2014-10-17 13:08 - 2014-01-01 20:14 - 00033915 _____ () C:\Windows\setupact.log

2014-10-17 13:08 - 2013-07-03 15:26 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-17 13:08 - 2013-07-01 13:47 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-10-17 13:08 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-10-17 13:08 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-17 07:06 - 2013-06-02 22:16 - 00000000 ____D () C:\Users\david\AppData\Roaming\Spotify

2014-10-17 07:06 - 2012-06-23 16:41 - 00000000 ____D () C:\Users\david\AppData\Roaming\TS3Client

2014-10-17 06:25 - 2012-06-24 18:15 - 00001138 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001UA.job

2014-10-17 06:19 - 2013-07-03 15:26 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-17 00:25 - 2012-06-24 18:15 - 00001116 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243866017-1107141967-568923311-1001Core.job

2014-10-16 19:20 - 2012-11-01 17:03 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{963751FF-E6A0-461A-9D15-630985D8D304}

2014-10-16 16:22 - 2013-05-21 18:36 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask

2014-10-16 13:20 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-16 13:20 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-16 01:13 - 2014-01-07 16:07 - 01374658 _____ () C:\Windows\PFRO.log

2014-10-13 21:01 - 2013-06-24 22:20 - 00000000 ____D () C:\Users\david\AppData\Local\Spotify

2014-10-12 16:28 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-10-12 16:03 - 2013-11-23 13:09 - 00000000 ____D () C:\AdwCleaner

2014-10-12 12:48 - 2012-09-09 17:58 - 00000000 ____D () C:\Users\david\AppData\Local\Apps\2.0

2014-10-12 12:24 - 2012-06-27 19:00 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-10-12 12:24 - 2012-06-27 19:00 - 00000000 ____D () C:\Program Files\CCleaner

2014-10-11 22:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Users\Default

2014-10-11 22:48 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-10-10 21:20 - 2013-03-23 18:55 - 00000000 ____D () C:\Users\david\AppData\Local\CrashDumps

2014-10-10 19:55 - 2014-09-08 20:25 - 00000000 ____D () C:\Users\david\Desktop\Cracks

2014-10-09 21:07 - 2012-06-23 16:25 - 00000000 ____D () C:\ProgramData\Origin

2014-10-09 21:06 - 2014-08-27 23:16 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-10-05 13:11 - 2014-08-11 02:34 - 00000000 ____D () C:\Users\david\Documents\BattleIslands

2014-10-04 22:03 - 2012-06-23 16:32 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-10-04 22:03 - 2012-06-23 16:32 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-10-04 22:03 - 2012-01-27 10:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-10-04 15:49 - 2014-01-06 03:51 - 00661582 _____ () C:\Windows\DirectX.log

2014-09-29 20:49 - 2013-09-17 19:46 - 00001349 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk

2014-09-29 20:45 - 2012-06-23 20:58 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-09-29 20:44 - 2013-09-17 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-09-29 20:38 - 2012-01-27 09:33 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-09-29 18:38 - 2013-12-21 19:21 - 00000000 ____D () C:\Users\david\AppData\Local\NVIDIA Corporation

2014-09-29 18:34 - 2012-01-27 09:33 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-09-29 13:14 - 2012-01-27 11:20 - 00000000 ____D () C:\ProgramData\Sonic

2014-09-29 01:12 - 2012-07-18 17:29 - 00000000 ____D () C:\Users\david\AppData\Roaming\TeamViewer

2014-09-28 20:48 - 2012-10-03 16:54 - 00007599 _____ () C:\Users\david\AppData\Local\Resmon.ResmonCfg

2014-09-20 20:23 - 2012-01-27 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-09-19 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-09-18 15:15 - 2013-03-02 00:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-09-17 04:10 - 2013-12-21 18:53 - 02799784 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-09-17 04:10 - 2013-12-21 18:53 - 02193560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-17 04:28
 

==================== End Of Log ============================

--- --- ---

--- --- ---