ComboFix hat festgestellt das folgende Real-Time-Scanner aktiv sind:
antispyware: Spybot - Search and Destroy
den habe ich aber ausgemacht davor und es stand auch keine Prozess mehr im Task Manager. Das erste ist der ComboFix Log die anderen 2 sind die FRST Logs.
Als ich den Computer gestartet hab kamen wieder die Virus Meldungen vom ersten Post. Code:
ComboFix 15-01-08.01 - Julian 16/01/2015 17:03:16.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.12269.9758 [GMT 1:00]
ausgeführt von:: c:\users\Julian\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\RadioRage_4j
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jauxstb64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbar.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbarsvc.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbrmon64.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbrstub64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdatact.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdlghk64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jfeedmg.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhighin.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhkstub.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhtmlmu.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhttpct.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jidle.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jmedint.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jmlbtn.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jPlugin.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jradio.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jregfft.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jreghk.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jscript.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jskin.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jskplay.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jSrchMn.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jsrchmr.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jtpinst.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\APPINTEGRATOR.EXE
c:\program files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\APPINTEGRATORSTUB.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\AppIntegratorStub64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\ASSISTMONITOR.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\ASSISTMONITOR64.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE
c:\program files (x86)\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\CONFIG.XML
c:\program files (x86)\RadioRage_4j\bar\1.bin\BOOTSTRAP.JS
c:\program files (x86)\RadioRage_4j\bar\1.bin\CHROME.MANIFEST
c:\program files (x86)\RadioRage_4j\bar\1.bin\chrome\4jffxtbr.jar
c:\program files (x86)\RadioRage_4j\bar\1.bin\CREXT.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\CrExtP4j.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\DPNMNGR.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\EXEMANAGER.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\FF-NativeMessagingDispatcher.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\Hpg64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\INSTALL.RDF
c:\program files (x86)\RadioRage_4j\bar\1.bin\installKeys.js
c:\program files (x86)\RadioRage_4j\bar\1.bin\LOGO.BMP
c:\program files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EPMSUP.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EXTEX.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EXTPEX.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8HTML.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8RES.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8TICKER.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\TPIMANAGERCONSOLE.EXE
c:\program files (x86)\RadioRage_4j\bar\1.bin\UNIFIEDLOGGING.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\VERIFY.DLL
c:\users\Julian\4.0
c:\users\Julian\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\IsUn0407.exe
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-12-16 bis 2015-01-16 ))))))))))))))))))))))))))))))
.
.
2015-01-16 16:10 . 2015-01-16 16:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-01-16 13:06 . 2015-01-16 13:09 -------- d-----w- C:\FRST
2015-01-15 22:31 . 2015-01-15 23:07 -------- d-----w- c:\users\Julian\AppData\Roaming\.minecraft
2015-01-15 22:22 . 2015-01-15 22:30 -------- d-----w- c:\program files (x86)\Minecraft
2015-01-12 12:47 . 2015-01-12 12:47 -------- d-----w- c:\users\Julian\AppData\Local\calibre-cache
2015-01-12 12:46 . 2015-01-12 12:48 -------- d-----w- c:\users\Julian\AppData\Roaming\calibre
2015-01-12 12:46 . 2015-01-12 12:46 -------- d-----w- c:\program files (x86)\Calibre2
2015-01-12 12:01 . 2014-12-13 00:47 620176 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2015-01-12 11:54 . 2014-11-22 10:46 38032 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2015-01-12 11:54 . 2014-11-22 10:46 32400 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2015-01-12 11:49 . 2015-01-12 11:49 942808 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2015-01-12 11:49 . 2015-01-12 11:49 73800 ----a-w- c:\windows\system32\RtNicProp64.dll
2015-01-12 11:47 . 2015-01-12 11:47 450048 ----a-w- c:\windows\system32\drivers\RTL8187B.sys
2015-01-12 11:39 . 2015-01-12 11:39 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-01-12 10:44 . 2015-01-12 10:44 11944 ----a-w- c:\windows\system32\drivers\amdide64.sys
2015-01-12 10:36 . 2015-01-12 10:36 65408 ----a-w- c:\windows\system32\drivers\EtronHub3.sys
2015-01-12 10:29 . 2015-01-12 10:29 -------- d-----w- c:\programdata\ProductData
2015-01-12 10:29 . 2015-01-12 10:29 -------- d-----w- c:\programdata\IObit
2015-01-12 10:29 . 2015-01-12 10:29 26528 ----a-w- c:\windows\SysWow64\drivers\HWiNFO64A.SYS
2015-01-12 10:29 . 2015-01-12 10:29 -------- d-----w- c:\users\Julian\AppData\Roaming\IObit
2015-01-12 10:29 . 2015-01-12 10:29 -------- d-----w- c:\program files (x86)\IObit
2015-01-08 16:51 . 2015-01-16 15:56 -------- d-----w- c:\users\Julian\AppData\Roaming\Compatibility Verifier
2015-01-06 15:12 . 2015-01-06 15:12 -------- d-----w- c:\users\Julian\.tfo4
2015-01-06 15:10 . 2015-01-06 15:10 -------- d-----w- c:\windows\Sun
2015-01-04 18:48 . 2015-01-04 18:48 -------- d-----w- c:\users\Julian\AppData\Roaming\java
2015-01-02 21:09 . 2014-05-17 02:35 44744 ----a-w- c:\windows\system32\drivers\hssdrv6.sys
2015-01-02 21:09 . 2015-01-02 21:09 -------- d-----w- c:\programdata\Hotspot Shield
2015-01-02 21:09 . 2015-01-02 21:09 -------- d-----w- c:\program files (x86)\Hotspot Shield
2015-01-02 21:08 . 2015-01-02 21:08 -------- d-----w- c:\users\Julian\AppData\Roaming\Hotspot Shield
2015-01-02 20:58 . 2015-01-02 20:58 1647396 ----a-w- c:\windows\SysWow64\PerfStringBackup.TMP
2015-01-02 20:57 . 2015-01-02 20:57 -------- d-----w- c:\windows\Migration
2014-12-30 19:24 . 2014-12-30 19:24 -------- d-----w- c:\users\Julian\AppData\Local\Risen
2014-12-30 19:18 . 2014-12-30 19:18 -------- d-----w- c:\program files (x86)\Deep Silver
2014-12-27 12:18 . 2014-12-27 12:16 270408 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-12-27 12:16 . 2014-12-27 12:16 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-16 11:56 . 2014-06-19 21:21 1647396 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2015-01-12 11:49 . 2014-05-10 09:31 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2015-01-12 11:38 . 2014-10-19 11:25 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-01-12 11:21 . 2014-07-30 10:24 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-12 11:21 . 2014-07-30 10:24 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-12 10:36 . 2013-07-07 16:28 94208 ----a-w- c:\windows\system32\drivers\EtronXHCI.sys
2014-12-13 10:08 . 2014-07-31 21:12 16040184 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2014-12-13 10:08 . 2013-07-07 15:55 3293136 ----a-w- c:\windows\system32\nvapi64.dll
2014-12-13 10:08 . 2013-07-07 15:55 18594432 ----a-w- c:\windows\system32\nvwgf2umx.dll
2014-12-13 10:08 . 2013-07-07 15:55 14128496 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2014-12-13 08:03 . 2013-07-07 15:55 6859408 ----a-w- c:\windows\system32\nvcpl.dll
2014-12-13 08:03 . 2013-07-07 15:55 3513488 ----a-w- c:\windows\system32\nvsvc64.dll
2014-12-13 08:03 . 2013-07-07 15:55 935240 ----a-w- c:\windows\system32\nvvsvc.exe
2014-12-13 08:03 . 2013-07-07 15:55 62608 ----a-w- c:\windows\system32\nvshext.dll
2014-12-13 08:03 . 2013-07-07 15:55 386368 ----a-w- c:\windows\system32\nvmctray.dll
2014-12-13 08:03 . 2013-07-07 15:55 2558608 ----a-w- c:\windows\system32\nvsvcr.dll
2014-12-13 00:12 . 2014-06-03 13:13 1291464 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2014-12-13 00:12 . 2013-11-12 23:18 2210040 ----a-w- c:\windows\SysWow64\nvspcap.dll
2014-12-13 00:12 . 2014-06-03 13:13 1715224 ----a-w- c:\windows\system32\nvspbridge64.dll
2014-12-13 00:12 . 2013-11-12 23:18 2824504 ----a-w- c:\windows\system32\nvspcap64.dll
2014-12-12 23:11 . 2013-07-07 15:55 4151176 ----a-w- c:\windows\system32\nvcoproc.bin
2014-11-22 10:46 . 2013-07-30 17:52 35472 ----a-w- c:\windows\system32\nvaudcap64v.dll
2014-11-13 00:20 . 2014-11-24 23:03 1876296 ----a-w- c:\windows\system32\nvdispco6434475.dll
2014-11-13 00:20 . 2014-11-24 23:03 1540424 ----a-w- c:\windows\system32\nvdispgenco6434475.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-04-08 12:22 1728216 ---ha-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-04-08 12:22 1728216 ---ha-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-04-08 12:22 1728216 ---ha-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spybot-S&D Cleaning"="c:\program files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" [2014-06-24 4566952]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-11-18 1940160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-02-15 767200]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-12-16 702768]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2014-06-24 4101576]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-10-15 157480]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-11-20 126200]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-10-07 507776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 RadioRage_4jService;RadioRageService;c:\progra~2\RADIOR~1\bar\1.bin\4jbarsvc.exe;c:\progra~2\RADIOR~1\bar\1.bin\4jbarsvc.exe [x]
R3 cpuz136;cpuz136;c:\program files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys;c:\program files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys;c:\windows\etdrv.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys;c:\windows\GVTDrv64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys;c:\windows\SYSNATIVE\DRIVERS\HtcVComV64.sys [x]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys;c:\windows\SYSNATIVE\DRIVERS\SWDUMon.sys [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S0 amdide64;amdide64;c:\windows\system32\DRIVERS\amdide64.sys;c:\windows\SYSNATIVE\DRIVERS\amdide64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys;c:\windows\SYSNATIVE\DRIVERS\hssdrv6.sys [x]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS [x]
S1 netfilter64;netfilter64;c:\windows\system32\drivers\netfilter64.sys;c:\windows\SYSNATIVE\drivers\netfilter64.sys [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AODDriver4.3;AODDriver4.3;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe [x]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S2 rqpbhevlkc64;rqpbhevlkc64;c:\program files\004\rqpbhevlkc64.exe run options=01100010040000000000000000000000 sourceguid=A6ADCE5D-859A-4E7E-B0B2-D07F8AB9237E;c:\program files\004\rqpbhevlkc64.exe run options=01100010040000000000000000000000 sourceguid=A6ADCE5D-859A-4E7E-B0B2-D07F8AB9237E [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 SplashtopRemoteService;Splashtop® Remote Service;c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe;c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 Verifies and fixes application compatibility issues;Compatibility Verify;c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe;c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys;c:\windows\SYSNATIVE\DRIVERS\MijXfilt.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8187B.sys [x]
S3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-04-08 12:18 2333400 ---ha-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-04-08 12:18 2333400 ---ha-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-04-08 12:18 2333400 ---ha-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-12-13 2824504]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-12-13 2531472]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Search_URL = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = about:blank
uInternet Settings,ProxyServer = http=127.0.0.1:8555;https=127.0.0.1:8555
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;10.*;192.168.*;127.0.0.1:895;127.0.0.1:896;<local>
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -
TCP: DhcpNameServer = 192.168.178.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
FF - ProfilePath - c:\users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\uf1ropz9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=512435&p=
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{c817d3d8-b9da-521d-971d-2c0a747ea697} - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
AddRemove-Gothic-Patch 1.07c - c:\windows\IsUn0407.exe
AddRemove-{B1AC4B05-9618-6F44-17B6-636B5C59955F} - c:\progra~3\INSTAL~1\{52957~1\Setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
c:\program files (x86)\Steam\bin\steamwebhelper.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
c:\users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-01-16 17:19:39 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-01-16 16:19
.
Vor Suchlauf: 6 Verzeichnis(se), 355.991.535.616 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 355.812.896.768 Bytes frei
.
- - End Of File - - 666200898C88C75F000F5DEEDA6F793D
A36C5E4F47E84449FF07ED3517B43A31
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01
Ran by Julian (administrator) on JULIAN-PC on 16-01-2015 17:23:07
Running from C:\Users\Julian\Downloads
Loaded Profiles: Julian (Available profiles: Julian)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Program Files\004\rqpbhevlkc64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-02-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1255664577-1147447546-4291453216-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-1255664577-1147447546-4291453216-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1940160 2014-11-18] (Valve Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1255664577-1147447546-4291453216-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-1255664577-1147447546-4291453216-1000] => http=127.0.0.1:8555;https=127.0.0.1:8555
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1255664577-1147447546-4291453216-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1255664577-1147447546-4291453216-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1255664577-1147447546-4291453216-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd72&cd=2XzuyEtN2Y1L1QzuzztDtC0FtDtByCyEtCyC0EtB0D0FzyzytN0D0Tzu0SyDyByEtN1L2XzutBtFtBtFyEtFzzyDyDtN1L1Czu1L1C1H1B1QyBtB&cr=1898365615&ir=
SearchScopes: HKU\S-1-5-21-1255664577-1147447546-4291453216-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd72&cd=2XzuyEtN2Y1L1QzuzztDtC0FtDtByCyEtCyC0EtB0D0FzyzytN0D0Tzu0SyDyByEtN1L2XzutBtFtBtFyEtFzzyDyDtN1L1Czu1L1C1H1B1QyBtB&cr=1898365615&ir=
SearchScopes: HKU\S-1-5-21-1255664577-1147447546-4291453216-1000 -> {F2E6120A-FDF6-43E3-953A-4335D182249A} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=512435&p={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name -> {c817d3d8-b9da-521d-971d-2c0a747ea697} -> No File
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1255664577-1147447546-4291453216-1000 -> No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\uf1ropz9.default
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=512435&p=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @RadioRage_4j.com/Plugin -> C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1255664577-1147447546-4291453216-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Extension: Avira Browser Safety - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\uf1ropz9.default\Extensions\abs@avira.com [2014-12-11]
FF Extension: DownloadHelper - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\uf1ropz9.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-05]
FF Extension: Auto Shutdown NG - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\uf1ropz9.default\Extensions\jid0-HZ5UvAEiWWAxT9TKLuhEgUCARqo@jetpack.xpi [2013-11-16]
FF Extension: ImTranslator - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\uf1ropz9.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2014-07-01]
FF Extension: Adblock Plus - C:\Users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\uf1ropz9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-11]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2015-01-10]
FF HKLM-x32\...\Firefox\Extensions: [BaseFlash@B1a2s3e4F5l6a7s8h9.es] - C:\Users\Julian\AppData\Roaming\BaseFlash\Firefox
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-02-15] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [919040 2014-05-17] (AnchorFree Inc.) [File not signed]
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2014-05-17] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [430344 2014-05-16] ()
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-12-27] ()
R2 rqpbhevlkc64; C:\Program Files\004\rqpbhevlkc64.exe [709120 2014-08-05] () [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Verifies and fixes application compatibility issues; C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [91304 2015-01-12] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2014-05-10] (VIA Technologies, Inc.)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 RadioRage_4jService; C:\PROGRA~2\RADIOR~1\bar\1.bin\4jbarsvc.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdide64; C:\Windows\System32\DRIVERS\amdide64.sys [11944 2015-01-12] (Advanced Micro Devices Inc.)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-11-04] (Advanced Micro Devices)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-10-30] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-15] (Avira Operations GmbH & Co. KG)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2013-12-23] ()
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2014-05-17] (AnchorFree Inc.)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-08] (QUALCOMM Incorporated)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-01-12] (REALiX(tm))
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-10-30] ()
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2014-07-25] (NetFilterSDK.com)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [450048 2015-01-12] (Realtek Semiconductor Corporation )
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-05-10] ()
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Program Files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [X]
S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-16 17:23 - 2015-01-16 17:23 - 00020442 _____ () C:\Users\Julian\Downloads\FRST.txt
2015-01-16 17:22 - 2015-01-16 17:22 - 00031091 _____ () C:\Users\Julian\Desktop\Combofix.txt
2015-01-16 17:19 - 2015-01-16 17:19 - 00031091 _____ () C:\ComboFix.txt
2015-01-16 17:15 - 2015-01-16 17:15 - 00003488 _____ () C:\Windows\System32\Tasks\AutoKMS
2015-01-16 17:02 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-16 17:02 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-16 17:02 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-16 17:02 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-16 17:02 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-16 17:02 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-16 17:02 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-16 17:02 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-16 17:00 - 2015-01-16 17:19 - 00000000 ____D () C:\Qoobox
2015-01-16 17:00 - 2015-01-16 17:10 - 00000110 _____ () C:\Users\Julian\Downloads\Neues Textdokument.txt
2015-01-16 16:59 - 2015-01-16 17:18 - 00000000 ____D () C:\Windows\erdnt
2015-01-16 16:55 - 2015-01-16 16:56 - 05609736 ____R (Swearware) C:\Users\Julian\Downloads\ComboFix.exe
2015-01-16 14:39 - 2015-01-16 14:40 - 00380416 _____ () C:\Users\Julian\Downloads\Gmer-19357.exe
2015-01-16 14:35 - 2015-01-16 14:35 - 00164760 _____ () C:\Users\Julian\Desktop\Ereignisse.txt
2015-01-16 14:09 - 2015-01-16 14:09 - 00036728 _____ () C:\Users\Julian\Desktop\FRST_16-01-2015_14-09-49.txt
2015-01-16 14:09 - 2015-01-16 14:09 - 00035870 _____ () C:\Users\Julian\Desktop\Addition_16-01-2015_14-09-49.txt
2015-01-16 14:06 - 2015-01-16 17:23 - 00000000 ____D () C:\FRST
2015-01-16 14:05 - 2015-01-16 14:06 - 02125312 _____ (Farbar) C:\Users\Julian\Downloads\FRST64.exe
2015-01-16 14:04 - 2015-01-16 14:04 - 00000000 _____ () C:\Users\Julian\defogger_reenable
2015-01-16 14:03 - 2015-01-16 14:03 - 00050477 _____ () C:\Users\Julian\Downloads\Defogger.exe
2015-01-16 12:13 - 2015-01-16 12:13 - 00000000 ____D () C:\Users\Julian\Documents\Studium
2015-01-16 12:13 - 2015-01-16 12:13 - 00000000 ____D () C:\Users\Julian\Documents\Mamas
2015-01-16 12:13 - 2015-01-16 12:13 - 00000000 ____D () C:\Users\Julian\Documents\Julis
2015-01-16 12:12 - 2015-01-16 12:12 - 00000000 ____D () C:\Users\Julian\Documents\Bout2
2015-01-16 12:11 - 2015-01-16 12:12 - 00000000 ____D () C:\Users\Julian\Documents\Bosstransformation
2015-01-16 12:10 - 2015-01-16 12:10 - 00000000 ____D () C:\Users\Julian\Documents\Trainingspläne
2015-01-16 12:09 - 2015-01-16 12:09 - 00000000 ____D () C:\Users\Julian\Downloads\Neuaufsetzung
2015-01-15 23:31 - 2015-01-16 00:07 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\.minecraft
2015-01-15 23:22 - 2015-01-15 23:30 - 00000000 ____D () C:\Program Files (x86)\Minecraft
2015-01-15 23:22 - 2015-01-15 23:22 - 00000961 _____ () C:\Users\Public\Desktop\Minecraft.lnk
2015-01-15 23:22 - 2015-01-15 23:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2015-01-13 10:24 - 2015-01-16 17:21 - 00000112 _____ () C:\ProgramData\0kj72BG6.dat
2015-01-12 13:47 - 2015-01-12 13:47 - 00000000 ____D () C:\Users\Julian\AppData\Local\calibre-cache
2015-01-12 13:46 - 2015-01-12 13:48 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\calibre
2015-01-12 13:46 - 2015-01-12 13:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management
2015-01-12 13:46 - 2015-01-12 13:46 - 00000000 ____D () C:\Program Files (x86)\Calibre2
2015-01-12 13:01 - 2014-12-13 01:47 - 00620176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-01-12 12:58 - 2014-12-13 11:08 - 32099472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 25460552 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 24764232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 20465808 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 17264312 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 13288360 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 13202520 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 10770120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 10710160 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 10345280 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-01-12 12:58 - 2014-12-13 11:08 - 03610440 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 03248968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 02897824 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 01895056 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434709.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 01556624 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434709.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00994384 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00968336 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00942400 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00928072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00906560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00876976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00496272 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00391488 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00346944 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00306328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00178632 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-01-12 12:58 - 2014-12-13 11:08 - 00165760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-01-12 12:58 - 2014-10-09 18:02 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-01-12 12:58 - 2014-10-09 18:02 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-01-12 12:58 - 2014-10-09 08:17 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco64.dll
2015-01-12 12:54 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-01-12 12:54 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-01-12 12:49 - 2015-01-12 12:49 - 00942808 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2015-01-12 12:49 - 2015-01-12 12:49 - 00073800 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2015-01-12 12:47 - 2015-01-12 12:47 - 00450048 _____ (Realtek Semiconductor Corporation ) C:\Windows\system32\Drivers\RTL8187B.sys
2015-01-12 11:44 - 2015-01-12 11:44 - 00011944 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\Drivers\amdide64.sys
2015-01-12 11:36 - 2015-01-12 11:36 - 00065408 _____ (Etron Technology Inc) C:\Windows\system32\Drivers\EtronHub3.sys
2015-01-12 11:29 - 2015-01-16 17:16 - 00002856 _____ () C:\Windows\System32\Tasks\Driver Booster SkipUAC (Julian)
2015-01-12 11:29 - 2015-01-12 11:29 - 00026528 _____ (REALiX(tm)) C:\Windows\SysWOW64\Drivers\HWiNFO64A.SYS
2015-01-12 11:29 - 2015-01-12 11:29 - 00003216 _____ () C:\Windows\System32\Tasks\Driver Booster Scan
2015-01-12 11:29 - 2015-01-12 11:29 - 00003160 _____ () C:\Windows\System32\Tasks\Driver Booster Update
2015-01-12 11:29 - 2015-01-12 11:29 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\IObit
2015-01-12 11:29 - 2015-01-12 11:29 - 00000000 ____D () C:\ProgramData\ProductData
2015-01-12 11:29 - 2015-01-12 11:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 2
2015-01-12 11:29 - 2015-01-12 11:29 - 00000000 ____D () C:\ProgramData\IObit
2015-01-12 11:29 - 2015-01-12 11:29 - 00000000 ____D () C:\Program Files (x86)\IObit
2015-01-11 13:34 - 2015-01-11 13:34 - 00003656 ____N () C:\bootsqm.dat
2015-01-11 08:18 - 2015-01-16 17:11 - 00005570 _____ () C:\Windows\PFRO.log
2015-01-10 23:21 - 2015-01-16 17:12 - 00003859 _____ () C:\Windows\setupact.log
2015-01-10 23:21 - 2015-01-10 23:21 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-10 17:46 - 2015-01-10 17:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-08 17:51 - 2015-01-16 17:16 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Compatibility Verifier
2015-01-06 16:12 - 2015-01-06 16:12 - 00000000 ____D () C:\Users\Julian\.tfo4
2015-01-06 16:10 - 2015-01-06 16:10 - 00000000 ____D () C:\Windows\Sun
2015-01-04 19:48 - 2015-01-04 19:48 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\java
2015-01-02 22:09 - 2015-01-02 22:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
2015-01-02 22:09 - 2015-01-02 22:09 - 00000000 ____D () C:\ProgramData\Hotspot Shield
2015-01-02 22:09 - 2015-01-02 22:09 - 00000000 ____D () C:\Program Files (x86)\Hotspot Shield
2015-01-02 22:09 - 2014-05-17 03:35 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2015-01-02 22:08 - 2015-01-02 22:08 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Hotspot Shield
2015-01-02 21:58 - 2015-01-02 21:58 - 01647396 _____ () C:\Windows\SysWOW64\PerfStringBackup.TMP
2014-12-30 20:24 - 2014-12-30 20:24 - 00000000 ____D () C:\Users\Julian\AppData\Local\Risen
2014-12-30 20:23 - 2014-12-30 20:24 - 00001484 _____ () C:\Users\Julian\Desktop\Risen.lnk
2014-12-30 20:18 - 2014-12-30 20:18 - 00000000 ____D () C:\Program Files (x86)\Deep Silver
2014-12-27 13:18 - 2014-12-27 13:16 - 00270408 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-12-27 13:16 - 2014-12-27 13:16 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-16 17:20 - 2009-07-14 05:45 - 00025184 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-16 17:20 - 2009-07-14 05:45 - 00025184 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-16 17:19 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-01-16 17:18 - 2014-03-21 22:31 - 00005080 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Julian-PC-Julian Julian-PC
2015-01-16 17:18 - 2013-07-07 16:31 - 01674625 _____ () C:\Windows\WindowsUpdate.log
2015-01-16 17:13 - 2013-07-08 11:32 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-16 17:13 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-16 17:12 - 2013-07-07 16:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-16 17:12 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-16 17:09 - 2013-07-07 16:31 - 00000000 ____D () C:\Users\Julian
2015-01-16 12:56 - 2014-06-19 22:21 - 01647396 _____ () C:\Windows\system32\PerfStringBackup.TMP
2015-01-16 12:14 - 2014-08-27 22:48 - 00000000 ____D () C:\Users\Julian\Documents\SpSe
2015-01-15 20:29 - 2013-07-14 20:55 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\vlc
2015-01-14 17:40 - 2013-07-10 12:41 - 00000000 ____D () C:\Users\Julian\AppData\Local\Paint.NET
2015-01-12 13:02 - 2013-12-13 20:29 - 00000000 ____D () C:\Temp
2015-01-12 13:02 - 2013-07-07 17:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-12 12:49 - 2014-05-10 10:31 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2015-01-12 12:40 - 2014-10-19 12:25 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-12 12:39 - 2014-10-19 12:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-12 12:38 - 2014-10-19 12:25 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-12 12:38 - 2014-10-19 12:24 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-12 12:21 - 2014-07-30 11:24 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-12 12:21 - 2014-07-30 11:24 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-12 11:57 - 2014-08-03 18:09 - 00000000 ____D () C:\Users\Julian\AppData\Local\Adobe
2015-01-12 11:36 - 2013-07-07 17:28 - 00094208 _____ (Etron Technology Inc) C:\Windows\system32\Drivers\EtronXHCI.sys
2015-01-12 11:18 - 2009-07-14 06:08 - 00032640 ____H () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-11 13:35 - 2013-08-11 13:40 - 00000000 ___HD () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-11 08:25 - 2014-04-15 12:54 - 00000000 ___HD () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-10 16:46 - 2014-05-24 21:49 - 00000000 ___HD () C:\Program Files\CCleaner
2015-01-10 16:46 - 2014-05-24 21:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-08 17:51 - 2014-05-10 20:06 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-02 21:42 - 2014-01-15 18:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-02 17:38 - 2014-10-18 16:22 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-30 20:21 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-12-30 20:18 - 2013-07-07 16:44 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-29 21:05 - 2013-12-30 17:18 - 00000990 ____H () C:\mountlist.INI
2014-12-29 21:04 - 2014-11-02 22:48 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-12-29 21:03 - 2013-10-06 20:00 - 00000000 ____D () C:\Users\Julian\AppData\Roaming\Ubisoft
2014-12-27 13:16 - 2013-10-06 20:00 - 00000000 ____D () C:\Users\Julian\AppData\Local\PunkBuster
Files to move or delete:
====================
C:\ProgramData\0kj72BG6.dat
Some zero byte size files/folders:
==========================
C:\Windows\System32\pbsvc.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-08 16:31
==================== End Of Log ============================
--- --- ---
--- --- --- Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2015 01
Ran by Julian at 2015-01-16 17:24:07
Running from C:\Users\Julian\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.03) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{3096080B-BFA4-F2E5-0E2B-D289933054C5}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.11 Beta1 - Michael Tippach)
Assassin's Creed Brotherhood (HKLM-x32\...\{BE4BA698-8533-4F77-9559-C7F3F78C0B05}) (Version: 1.03 - Ubisoft)
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
calibre (HKLM-x32\...\{4A7785E7-924F-4938-98C6-B08F2DAA0961}) (Version: 2.16.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
ContentMod2.6 (HKLM-x32\...\ContentMod_2.6) (Version: - )
ConvertHelper 2.2 (HKLM-x32\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version: - DownloadHelper)
Driver Booster 2.1 (HKLM-x32\...\Driver Booster_is1) (Version: 2.1 - IObit)
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.115 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology) Hidden
FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version: - Image-Line)
FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version: - )
Fraps (HKLM-x32\...\Fraps) (Version: - )
Free Studio version 2014 (HKLM-x32\...\Free Studio_is1) (Version: 6.4.0.1022 - DVDVideoSoft Ltd.)
Gothic-Patch 1.07c (HKLM-x32\...\Gothic-Patch 1.07c) (Version: - )
Grand Theft Auto IV (x32 Version: 1.0.0013.131 - Rockstar Games Inc.) Hidden
Grand Theft Auto: Episodes from Liberty City (x32 Version: 1.0.0003.135 - Rockstar Games Inc.) Hidden
Hotspot Shield 3.42 (HKLM-x32\...\HotspotShield) (Version: 3.42 - AnchorFree Inc.)
HTC BMP USB Driver (HKLM-x32\...\{31A559C1-9E4D-423B-9DD3-34A6C5398752}) (Version: 1.0.5375 - HTC)
HTC Sync (HKLM-x32\...\{CBDAE89D-8ABD-4DC5-9309-C2C58696B371}) (Version: 3.3.63 - HTC Corporation)
IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version: - Image-Line)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.9 - HTC)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{63227E62-F417-497E-9060-22B3A9A52D7A}) (Version: 1.0.1.0 - Mojang)
MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
Mozilla Firefox 35.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.09 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.09 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 1.006 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Risen (HKLM-x32\...\{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}) (Version: 1.00.0000 - Deep Silver)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.5.5.2 - Splashtop Inc.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
The Book of Unwritten Tales 2 (HKLM-x32\...\Steam App 279940) (Version: - KING Art)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
VLC media player 2.0.7 (HKLM\...\VLC media player) (Version: 2.0.7 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
ZOTAC FireStorm (HKLM-x32\...\ZOTAC FireStorm) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
12-01-2015 11:35:10 Driver Booster : Etron USB 3.0 Extensible Host Controller
12-01-2015 13:45:36 Installed calibre
14-01-2015 15:42:50 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 15:44:47 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
15-01-2015 23:17:10 Removed Minecraft
15-01-2015 23:22:02 Installed Minecraft
16-01-2015 10:01:40 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
16-01-2015 12:51:17 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2015-01-16 17:12 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {063F36A2-DA28-49BA-A432-8ED4903BD80C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {1CD9F664-1CE9-4792-AC31-9E026D56EBB9} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2013-09-03] ()
Task: {2024AAAF-F3D3-484C-A3CE-8858208FA564} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {28A1C036-2EA6-45F6-9BD8-CCB468C148DA} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {28BA7E7B-59AC-4593-8C87-6F7C8E8F08B7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {2A8E3FC5-B4B7-439E-94EC-3A25041EE8B0} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {42C06687-B6E6-44CC-B993-1AC23B407047} - \MySearchDial No Task File <==== ATTENTION
Task: {436447FB-6875-4C51-91D7-483901ACA3C5} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Julian-PC-Julian Julian-PC => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2014-04-08] (Microsoft Corporation)
Task: {4400F539-F5D9-4F1C-A5C5-E5F4CB56F3B5} - System32\Tasks\Driver Booster Scan => C:\Program Files (x86)\IObit\Driver Booster\Scheduler.exe [2014-12-17] (IObit)
Task: {531C5387-C864-4870-A5D2-550DD0E4F3A5} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {555FAC93-6B17-49B7-8822-15C0AFC6BCD1} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe [2014-12-09] (IObit)
Task: {59D1FBE4-F2E2-42CA-97B4-3B021CE747FD} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {5ADF46E9-5ADD-4DB0-A6E9-02ABC4A1DF34} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {71BB7FB5-E632-4C45-8E6E-F8C2AA01E33D} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {7A88E2BF-90FD-4DE8-8F26-472B7A7F9EA2} - System32\Tasks\{ACB8F629-9139-49C9-9556-FBE00D397565} => pcalua.exe -a C:\Users\Julian\Downloads\DRDK-1.2.exe -d C:\Users\Julian\Downloads
Task: {7FA7BFEA-ABB4-4B52-A702-F0ECB59C1DAE} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2013-07-09] ()
Task: {958DB910-B1A4-46AD-9402-22AC36F71AEF} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {9A241D03-1210-40C9-B88D-1AC050D50A26} - System32\Tasks\{867D2062-A0A7-4AEF-B040-2E7445FBA097} => pcalua.exe -a "C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\Uninstall.exe"
Task: {9B3782DD-8144-4D4A-91D4-4ECA8AA4073B} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {ABB2756F-7CC8-423C-BAD3-47F769650A78} - \EPUpdater No Task File <==== ATTENTION
Task: {B64F0C48-C782-4A96-B224-ED793AFBC497} - \BrowserDefendert No Task File <==== ATTENTION
Task: {CB23F56D-8238-4F04-9E6B-2D1F1EA08C02} - System32\Tasks\{FFB80721-6F26-4455-A369-155FCDBA5EBD} => pcalua.exe -a C:\Users\Julian\Downloads\4.exe -d C:\Users\Julian\Downloads
Task: {D012FAEA-CD88-417A-BAFA-DE880153037B} - System32\Tasks\Driver Booster SkipUAC (Julian) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2014-12-17] (IObit)
Task: {D281A038-CE18-4782-8523-24753CD939A1} - System32\Tasks\{09FA896C-3281-479A-A13E-28ADD7DF143F} => pcalua.exe -a C:\Users\Julian\Downloads\g2adb-4.0.exe -d C:\Users\Julian\Downloads
Task: {F64E284E-3216-4887-975C-4D2903EFD9F2} - System32\Tasks\{E1F933BE-398B-4FE2-8E87-16F94635EDF1} => pcalua.exe -a "C:\Program Files (x86)\Deep Silver\Risen 3\Uninstall.exe" -d "C:\Program Files (x86)\Deep Silver\Risen 3"
Task: {F7EB1CF4-9D5E-40B0-9A77-100CDF6704DA} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {F7EE4D68-270C-48E3-BF32-6BA88920130F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {FD68759C-77FC-499F-9EDF-53E99C295B40} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
==================== Loaded Modules (whitelisted) =============
2013-07-07 16:55 - 2014-12-13 09:03 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-02-15 03:59 - 2014-02-15 03:59 - 00214528 ____H () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2013-11-04 14:03 - 2013-11-04 14:03 - 00818688 ____H () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2013-11-04 14:03 - 2013-11-04 14:03 - 03650560 ____H () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2014-02-15 03:58 - 2014-02-15 03:58 - 00127488 ____H () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-05-16 23:34 - 2014-05-16 23:34 - 00430344 _____ () C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
2013-10-17 14:27 - 2013-10-17 14:27 - 00166912 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2014-12-27 13:16 - 2014-12-27 13:16 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-08-05 13:51 - 2014-08-05 13:51 - 00709120 _____ () C:\Program Files\004\rqpbhevlkc64.exe
2015-01-08 17:51 - 2015-01-12 13:55 - 00091304 _____ () C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
2015-01-08 17:51 - 2015-01-13 23:12 - 51548328 _____ () C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
2014-07-03 12:20 - 2014-07-03 12:20 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-05-17 01:11 - 2014-05-17 01:11 - 00908584 _____ () C:\Program Files (x86)\Hotspot Shield\bin\af_proxy.dll
2014-05-17 01:37 - 2014-05-17 01:37 - 00506664 _____ () C:\Program Files (x86)\Hotspot Shield\bin\HssRep.dll
2014-09-17 22:42 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-09-17 22:42 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-09-17 22:42 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-09-17 22:42 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-09-17 22:42 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-08-29 09:44 - 2014-11-11 19:48 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-08-29 09:44 - 2014-11-11 19:48 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-08-29 09:44 - 2014-11-11 19:48 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2013-05-06 16:05 - 2014-11-11 19:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-05-23 05:09 - 2014-11-18 21:23 - 02227904 _____ () C:\Program Files (x86)\Steam\video.dll
2014-08-29 09:44 - 2014-11-11 19:48 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-08-29 09:44 - 2014-11-11 19:48 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2013-06-06 13:06 - 2014-11-18 21:23 - 00690880 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-03-26 15:16 - 2014-11-11 19:48 - 34589888 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2015-01-08 17:51 - 2015-01-07 22:22 - 01360552 _____ () C:\Users\Julian\AppData\Roaming\Compatibility Verifier\libglesv2.dll
2015-01-08 17:51 - 2015-01-07 22:22 - 00214184 _____ () C:\Users\Julian\AppData\Roaming\Compatibility Verifier\libegl.dll
2015-01-08 17:51 - 2015-01-07 22:22 - 00985768 _____ () C:\Users\Julian\AppData\Roaming\Compatibility Verifier\ffmpegsumo.dll
2015-01-08 17:51 - 2015-01-07 22:22 - 16827048 _____ () C:\Users\Julian\AppData\Roaming\Compatibility Verifier\NPSWF32_15_0_0_189.dll
2015-01-10 17:46 - 2015-01-10 17:47 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: BstHdAndroidSvc => 2
MSCONFIG\Services: BstHdLogRotatorSvc => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MpsSvc => 2
MSCONFIG\Services: wlidsvc => 2
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-1255664577-1147447546-4291453216-500 - Administrator - Disabled)
Gast (S-1-5-21-1255664577-1147447546-4291453216-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1255664577-1147447546-4291453216-1003 - Limited - Enabled)
Julian (S-1-5-21-1255664577-1147447546-4291453216-1000 - Administrator - Enabled) => C:\Users\Julian
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/16/2015 05:13:42 PM) (Source: Avira Antivirus) (EventID: 4122) (User: NT-AUTORITÄT)
Description: Die Datei AvShadow konnte nicht geladen werden.
Fehlercode: 0x3fa
Error: (01/16/2015 05:12:44 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcCan't create NSS process. [0]
Error: (01/16/2015 05:12:44 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to create process. [1018]
Error: (01/16/2015 02:43:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54b5ebf9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54b5ebf9
Ausnahmecode: 0x80000003
Fehleroffset: 0x007fcc03
ID des fehlerhaften Prozesses: 0x1be8
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Error: (01/16/2015 02:25:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54b5ebf9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54b5ebf9
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022f8a0
ID des fehlerhaften Prozesses: 0x1798
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Error: (01/16/2015 02:25:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54b5ebf9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54b5ebf9
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022f8a0
ID des fehlerhaften Prozesses: 0x1118
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Error: (01/16/2015 00:56:37 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3009) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl) konnten nicht installiert werden. Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (01/16/2015 00:56:37 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3013) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID "007" definiert wurden, können nicht aktualisiert werden. Das erste DWORD im Datenbereich enthält den Fehlercode.
Error: (01/16/2015 00:47:06 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3009) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl) konnten nicht installiert werden. Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (01/16/2015 00:47:06 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3013) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID "007" definiert wurden, können nicht aktualisiert werden. Das erste DWORD im Datenbereich enthält den Fehlercode.
System errors:
=============
Error: (01/16/2015 05:14:30 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005
Error: (01/16/2015 05:12:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "RadioRageService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/16/2015 05:12:03 PM) (Source: Microsoft-Windows-Eventlog) (EventID: 22) (User: NT-AUTORITÄT)
Description: Der Ereignisprotokollierungsdienst hat einen Fehler beim Initialisieren der Veröffentlichung von Ressourcen für Kanal "Microsoft-RMS-MSIPC/Debug" erkannt. Falls ein direkter Kanal festgelegt ist, kann dies ein Hinweis darauf sein, dass auch das Protokollieren der Ressourcen nicht initialisiert werden konnte.
Error: (01/16/2015 05:12:03 PM) (Source: Microsoft-Windows-Eventlog) (EventID: 22) (User: NT-AUTORITÄT)
Description: Der Ereignisprotokollierungsdienst hat einen Fehler beim Initialisieren der Veröffentlichung von Ressourcen für Kanal "DebugChannel" erkannt. Falls ein direkter Kanal festgelegt ist, kann dies ein Hinweis darauf sein, dass auch das Protokollieren der Ressourcen nicht initialisiert werden konnte.
Error: (01/16/2015 05:10:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (01/16/2015 05:09:13 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (01/16/2015 05:05:48 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (01/16/2015 04:59:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Compatibility Verify" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (01/16/2015 04:51:34 PM) (Source: Microsoft-Windows-Eventlog) (EventID: 22) (User: NT-AUTORITÄT)
Description: Der Ereignisprotokollierungsdienst hat einen Fehler beim Initialisieren der Veröffentlichung von Ressourcen für Kanal "Microsoft-RMS-MSIPC/Debug" erkannt. Falls ein direkter Kanal festgelegt ist, kann dies ein Hinweis darauf sein, dass auch das Protokollieren der Ressourcen nicht initialisiert werden konnte.
Error: (01/16/2015 04:51:34 PM) (Source: Microsoft-Windows-Eventlog) (EventID: 22) (User: NT-AUTORITÄT)
Description: Der Ereignisprotokollierungsdienst hat einen Fehler beim Initialisieren der Veröffentlichung von Ressourcen für Kanal "DebugChannel" erkannt. Falls ein direkter Kanal festgelegt ist, kann dies ein Hinweis darauf sein, dass auch das Protokollieren der Ressourcen nicht initialisiert werden konnte.
Microsoft Office Sessions:
=========================
Error: (01/16/2015 05:13:42 PM) (Source: Avira Antivirus) (EventID: 4122) (User: NT-AUTORITÄT)
Description: AvShadow0x3fa
Error: (01/16/2015 05:12:44 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcCan't create NSS process. [0]
Error: (01/16/2015 05:12:44 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to create process. [1018]
Error: (01/16/2015 02:43:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054b5ebf9compatibilitycheck.exe0.0.0.054b5ebf980000003007fcc031be801d0318fffd3ed6cC:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exea99a2ede-9d85-11e4-b024-902b34a83f15
Error: (01/16/2015 02:25:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054b5ebf9compatibilitycheck.exe0.0.0.054b5ebf94000001f0022f8a0179801d03182c853aa14C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe300f2c11-9d83-11e4-b024-902b34a83f15
Error: (01/16/2015 02:25:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054b5ebf9compatibilitycheck.exe0.0.0.054b5ebf94000001f0022f8a0111801d03182c9016e88C:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Julian\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe300f0501-9d83-11e4-b024-902b34a83f15
Error: (01/16/2015 00:56:37 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3009) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl805000000C9120000
Error: (01/16/2015 00:56:37 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3013) (User: NT-AUTORITÄT)
Description: 0078050000005A0D0000
Error: (01/16/2015 00:47:06 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3009) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl805000000C9120000
Error: (01/16/2015 00:47:06 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3013) (User: NT-AUTORITÄT)
Description: 0078050000005A0D0000
CodeIntegrity Errors:
===================================
Date: 2015-01-16 17:09:13.745
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2015-01-16 17:09:13.714
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-06-27 21:07:47.721
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Julian\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-06-27 21:07:47.682
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Julian\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-06-27 21:07:47.447
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-06-27 21:07:47.407
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-12-23 18:33:12.689
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-12-23 18:33:12.619
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-12-23 18:33:11.319
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-12-23 18:33:11.249
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD FX(tm)-8320 Eight-Core Processor
Percentage of memory in use: 24%
Total physical RAM: 12269.24 MB
Available physical RAM: 9273.65 MB
Total Pagefile: 24536.66 MB
Available Pagefile: 21196.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:331.47 GB) NTFS
Drive e: (USB DISK) (Removable) (Total:14.91 GB) (Free:0.47 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 33E333E2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 14.9 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=14.9 GB) - (Type=0C)
==================== End Of Log ============================
|
Hinweis: 
AdwCleaner auf deinen Desktop.
Malwarebytes Anti-Malware 
GMER herunter: (Dateiname zufällig) 
SecurityCheck und:
