Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Computer gehackt, passwörter gestohlen (https://www.trojaner-board.de/171201-computer-gehackt-passwoerter-gestohlen.html)

0rbit 16.09.2015 19:43
Computer gehackt, passwörter gestohlen
 
Computer gehackt

hallo Trojaner Board Nutzer,
mein Pc wurde gehackt und es wurden die pw von 2 - mail Accounts und vom der spiele software steam.
Ich bin fraglos wie man so tief ins system eintreten konte und ich vermute einen Trojaner.
Ich habe natürlich einen virenscan gemacht und habe 2 funde gemacht.
hier der Log:
16.09.2015,14:53:36 [INFO] Online-Dienste stehen zur Verfügung.
16.09.2015,15:06:25 [INFO] Update-Auftrag gestartet!
16.09.2015,15:06:42 [INFO] ---------------------------------------------------------
16.09.2015,15:06:42 [INFO] Engine-Version: 8.3.34.26
16.09.2015,15:06:42 [INFO] VDF-Version: 8.12.9.94
16.09.2015,15:06:42 [INFO] APC-Version: 2.7.1.3
16.09.2015,15:06:42 [INFO] RDF-Version: 14.0.5.6
16.09.2015,15:06:42 [INFO] Echtzeit-Scanner-Version: 15.00.12.420
16.09.2015,17:57:43 [INFO] Die Datei wurde im Zwischenspeicher in 'C:\Users\metro\Downloads\avira_de_av_5963680833__wsm.exe' gefunden; der Scan Cloud-Sicherheit wurde übersprungen. SHA256 = CCD8FB65708571291A3D4CC965786918CEBA3F604E7979ED17572749556F9369
16.09.2015,18:23:51 [INFO] Cloud SDK Initialisierung und Lizenz überprüfen erfolgreich.
16.09.2015,18:23:51 [INFO] Die Datei 'C:\Users\metro\Downloads\SteamSetup.exe' wurde durch Cloud-Sicherheit geprüft. SHA256 = E63BD6119D13BFDA636C2165D32A46B80BBED198EA9E8E5A256A117ED986E762
16.09.2015,18:23:53 [INFO] Die Datei wurde im Zwischenspeicher in 'C:\Users\metro\Downloads\SteamSetup.exe' gefunden; der Scan Cloud-Sicherheit wurde übersprungen. SHA256 = E63BD6119D13BFDA636C2165D32A46B80BBED198EA9E8E5A256A117ED986E762
16.09.2015,18:23:55 [INFO] Die Datei 'C:\Users\metro\AppData\Local\Temp\nss5F92.tmp\nsDialogs.dll' wurde durch Cloud-Sicherheit geprüft. SHA256 = 416133DD86C0DFF6B0FCAF1F46DFE97FDC85B37F90EFFB2D369164A8F7E13AE6
16.09.2015,18:24:00 [INFO] Die Datei 'C:\Users\metro\AppData\Local\Temp\nss5F92.tmp\nsProcess.dll' wurde durch Cloud-Sicherheit geprüft. SHA256 = 30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
16.09.2015,19:05:37 [INFO] Update-Auftrag gestartet!
16.09.2015,19:05:55 [INFO] ---------------------------------------------------------
16.09.2015,19:05:55 [INFO] Engine-Version: 8.3.34.26
16.09.2015,19:05:55 [INFO] VDF-Version: 8.12.9.150
16.09.2015,19:05:55 [INFO] APC-Version: 2.7.1.3
16.09.2015,19:05:55 [INFO] RDF-Version: 14.0.5.6
16.09.2015,19:05:55 [INFO] Echtzeit-Scanner-Version: 15.00.12.420



Ich danke im vorraus.
Jonas

deeprybka 16.09.2015 19:56
:hallo:

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...:abklatsch:
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lies die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean :daumenhoc bekommst.



Los geht's:

Schritt 1
http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://deeprybka.trojaner-board.de/tdss/codetags.gif

0rbit 16.09.2015 20:09

FRST Logfile:
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:15-09-2015
durchgeführt von metro (Administrator) auf ICH_MAG_FLUGZEU (16-09-2015 21:08:50)
Gestartet von C:\Users\metro\Desktop
Geladene Profile: metro (Verfügbare Profile: metro & DefaultAppPool)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Cristi) C:\Program Files (x86)\Dual Monitor\DualMonitor.exe
(Roccat GmbH) C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(uWebb Software) C:\Program Files (x86)\ThrottleStop_500\ThrottleStop.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Spotify Ltd) C:\Users\metro\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM-x32\...\Run: [RoccatKova+] => C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE [539688 2011-03-17] (Roccat GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-08-26] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66936 2015-08-13] (Avira Operations GmbH & Co. KG)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-01-28] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Win32 Update] => C:\Users\metro\Documents\DCSCMIN\KRmc2Hf5eeiu\IMDCSC.exe
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [NetLimiter] => C:\Program Files\NetLimiter 3\NLClientApp.exe /tray
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [dualmonitor] => C:\Program Files (x86)\Dual Monitor\DualMonitor.exe [478720 2013-02-18] (Cristi)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Spotify Web Helper] => C:\Users\metro\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-09-16] (Spotify Ltd)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Spotify] => C:\Users\metro\AppData\Roaming\Spotify\Spotify.exe [7535672 2015-09-16] (Spotify Ltd)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2899136 2015-08-19] (Valve Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <======= ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{2AAD8167-C512-413D-AA3A-7828A6BB2078}: [DhcpNameServer] 192.168.192.1
Tcpip\..\Interfaces\{7302275D-D8D7-44EF-8A52-93C55917C0C9}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8C1455D7-177E-4384-89A6-E2BB602F0F79}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main,Start Page Before = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main,Search Page Before = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
URLSearchHook: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 - ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} -  Keine Datei
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=160&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.chatzum.com/?q={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.00000
SearchScopes: HKU\.DEFAULT -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL =
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> DefaultScope {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/?a=6Oz926P82k&loc=skw&search={searchTerms}&i=26
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=111789&tt=060612_5_&babsrc=SP_ss&mntrId=88b2be8300000000000060d81951991c
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {4C3D3E1F-361F-41E5-BCFF-545609429851} URL = hxxp://search.chatzum.com/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} URL = hxxp://search.chatzum.com/?q={SearchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=160&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/?a=6Oz926P82k&loc=skw&search={searchTerms}&i=26
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.00000
BHO: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension64.dll Keine Datei
BHO: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll [2011-05-05] (HP)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation)
BHO-x32: Browser Companion Helper -> {00cbb66b-1d3b-46d3-9577-323a336acb50} ->  Keine Datei
BHO-x32: Re-markit -> {22c3a57f-35ea-4347-8b39-43e1f7eb958a} ->  Keine Datei
BHO-x32: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} ->  Keine Datei
BHO-x32: Incredibar.com Helper Object -> {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} ->  Keine Datei
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-10-22] (Oracle Corporation)
BHO-x32: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll [2011-05-05] (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Browser Companion Helper Verifier -> {963B125B-8B21-49A2-A3A8-E37092276531} ->  Keine Datei
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-03-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-22] (Oracle Corporation)
BHO-x32: Softonic Helper Object -> {E87806B5-E908-45FD-AF5E-957D83E58E68} ->  Keine Datei
BHO-x32: TBSB09850 Class -> {FCBCCB87-9224-4B8D-B117-F56D924BEB18} ->  Keine Datei
Toolbar: HKLM - Kein Name - !{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} -  Keine Datei
Toolbar: HKLM - Kein Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  Keine Datei
Toolbar: HKLM - Kein Name - !{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
Toolbar: HKLM - Kein Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} -  Keine Datei
Toolbar: HKLM - Kein Name - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} -  Keine Datei
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  Keine Datei
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  Keine Datei
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  Keine Datei
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-03-21] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-18] ()
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll [Keine Datei]
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [Keine Datei]
FF Plugin: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelogx64.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-14] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-18] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [Keine Datei]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelog.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-22] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-4066131180-3669703069-1695776857-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll Keine Datei
FF Plugin HKU\S-1-5-21-4066131180-3669703069-1695776857-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-18] ()
FF user.js: detected! => C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\user.js [2014-09-02]
FF SearchPlugin: C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\searchplugins\MyStart Search.xml [2013-12-31]
FF Extension: Avira Browser Safety - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\abs@avira.com [2015-08-22]
FF Extension: Better Battlelog (BBLog) - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\jid1-qQSMEVsYTOjgYA@jetpack [2015-03-30]
FF Extension: YouTube Unblocker - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\youtubeunblocker@unblocker.yt [2015-08-22]
FF Extension: Adblock Plus - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-16]
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2014-03-19]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-11]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [xz123@ya456.com] - C:\Program Files (x86)\BetterSurf\ff
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Firefox\Extensions: [{e55007f4-80c5-418e-ac33-10c4d60db01e}] - C:\Program Files (x86)\Re-markit\135.xpi
StartMenuInternet: FIREFOX.EXE - firefox.exe
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2014-02-15] <==== ACHTUNG

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.youtube.com/feed/subscriptions","hxxps://www.facebook.com/","hxxps://twitter.com/","hxxps://www.google.de/"
CHR Profile: C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-09-13]
CHR Extension: (Google Drive) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-22]
CHR Extension: (YouTube) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-22]
CHR Extension: (Adblock Plus) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-22]
CHR Extension: (Steam inventory helper) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl [2015-03-05]
CHR Extension: (Google-Suche) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-22]
CHR Extension: (Black & white Thema) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmohofkmppcgglcmlccpbokkkefigipi [2015-05-25]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-05]
CHR Extension: (Vulcun Start Page) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkbinkdlcdmndhcjohbhkiplacebeilk [2015-09-06]
CHR Extension: (Better Battlelog (BBLog)) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjlfnjepjdmlppapoikepbaabbghofma [2013-11-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-25]
CHR Extension: (Google Mail) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-22]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx <nicht gefunden>
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\metro\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [bodddioamolcibagionmmobehnbhiakf] - C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [dcpfhaghaadpjpgocojgnlhjcieeooel] - C:\Program Files (x86)\Re-markit\135.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [dedmngkbaffkenlfdcbganndoghblmap] - C:\Program Files (x86)\BetterSurf\ch\Chrome.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-04-14]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]
StartMenuInternet: Google Chrome - Chrome.exe

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-08-26] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-08-26] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-08-26] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [228104 2015-08-13] (Avira Operations GmbH & Co. KG)
S4 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
S4 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2014-01-28] ()
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [Datei ist nicht signiert]
S4 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2372096 2011-02-19] (Realsil Microelectronics Inc.) [Datei ist nicht signiert]
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-21] (Microsoft Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2007048 2015-07-29] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-28] ()
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
S2 RzMaelstromVADStreamingService; "C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe" [X]
S2 Update ClearThink; "C:\Program Files (x86)\ClearThink\updateClearThink.exe" [X]
S2 Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 AndNetDiag2; C:\Windows\System32\DRIVERS\lgandnetdiag264.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-02-01] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2012-04-25] (AVM Berlin)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-17] (Avira Operations GmbH & Co. KG)
R3 CORK70; C:\Windows\System32\drivers\CORK70.sys [25600 2012-10-31] ( )
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 fwlanusb5; C:\Windows\System32\DRIVERS\fwlanusb5.sys [982784 2012-08-21] (AVM GmbH)
S3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] () [Datei ist nicht signiert]
S3 KovaPlusFltr; C:\Windows\System32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-02-01] ()
S3 MobileAdapter; C:\Windows\System32\DRIVERS\qscvusb.sys [118016 2009-03-10] (QUALCOMM Incorporated)
S3 RZMAELSTROMVADService; C:\Windows\System32\drivers\RzMaelstromVAD.sys [32768 2014-06-09] (Windows (R) Win 7 DDK provider)
R3 WinRing0_1_2_0; C:\Program Files (x86)\ThrottleStop_500\WinRing0x64.sys [14544 2008-07-26] (OpenLibSys.org)
R1 {c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64; C:\Windows\System32\drivers\{c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64.sys [61072 2014-08-31] (StdLib)
S3 NLNdisMP; system32\DRIVERS\nlndis.sys [X]
S3 NLNdisPT; system32\DRIVERS\nlndis.sys [X]
S3 pmem; \??\C:\Users\metro\AppData\Local\Temp\_MEI27242\drivers\winpmem64.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-09-16 21:07 - 2015-09-16 21:08 - 00091653 _____ C:\Users\metro\Desktop\Addition.txt
2015-09-16 21:06 - 2015-09-16 21:08 - 00031891 _____ C:\Users\metro\Desktop\FRST.txt
2015-09-16 21:05 - 2015-09-16 21:08 - 00000000 ____D C:\FRST
2015-09-16 21:05 - 2015-09-16 21:05 - 02191360 _____ (Farbar) C:\Users\metro\Desktop\FRST64.exe
2015-09-16 19:29 - 2015-09-16 20:44 - 00001895 _____ C:\Users\metro\Desktop\Neues Textdokument (2).txt
2015-09-16 18:25 - 2015-09-16 16:07 - 00011436 _____ C:\Users\metro\Desktop\config.cfg
2015-09-16 18:21 - 2015-09-16 18:22 - 01476720 _____ C:\Users\metro\Downloads\SteamSetup.exe
2015-09-16 18:06 - 2015-09-16 18:06 - 00000000 ____D C:\Users\metro\048298C9A4D3490B9FF9AB023A9238F3.TMP
2015-09-16 17:33 - 2015-09-16 17:33 - 00183752 _____ C:\Users\metro\Downloads\Nicht bestätigt 869834.crdownload
2015-09-16 17:33 - 2015-09-16 17:33 - 00183752 _____ C:\Users\metro\Downloads\Nicht bestätigt 795312.crdownload
2015-09-16 17:33 - 2015-09-16 17:33 - 00183752 _____ C:\Users\metro\Downloads\Nicht bestätigt 656893.crdownload
2015-09-16 17:32 - 2015-09-16 17:32 - 00183752 _____ C:\Users\metro\Downloads\Nicht bestätigt 527040.crdownload
2015-09-14 17:42 - 2015-09-14 17:42 - 00004377 _____ C:\Users\metro\Downloads\newf0restcfg.rar
2015-09-05 23:05 - 2013-08-09 20:20 - 00031232 _____ (Party Princess Palace) C:\Users\metro\Downloads\SAM.API.dll
2015-09-04 19:47 - 2015-09-04 19:47 - 00002291 _____ C:\Users\metro\Downloads\csgo_bananagaming.7z
2015-08-25 18:14 - 2015-08-25 18:14 - 00000000 ____D C:\Users\metro\AppData\Roaming\LolClient
2015-08-25 00:48 - 2015-08-25 00:48 - 00005100 _____ C:\Users\metro\Downloads\bibanator config Januar 2015.rar
2015-08-24 22:20 - 2015-08-24 22:20 - 00079716 _____ C:\Users\metro\Downloads\nooky-cfg-06-2015.zip
2015-08-19 00:04 - 2015-08-19 21:22 - 00000000 ____D C:\Users\metro\AppData\Local\The Witcher
2015-08-19 00:04 - 2015-08-19 00:48 - 00000000 ____D C:\Users\metro\Documents\The Witcher
2015-08-19 00:02 - 2015-08-19 23:06 - 00000000 ____D C:\Users\metro\AppData\Local\SniperV2

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-09-16 21:03 - 2012-03-29 19:34 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-16 20:52 - 2012-03-02 20:30 - 00000000 ____D C:\Program Files (x86)\Steam
2015-09-16 20:50 - 2015-07-30 21:57 - 00000000 ____D C:\Users\metro\AppData\Local\Spotify
2015-09-16 20:50 - 2015-07-30 21:55 - 00000000 ____D C:\Users\metro\AppData\Roaming\Spotify
2015-09-16 20:50 - 2013-11-22 18:55 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-16 19:46 - 2012-05-29 13:49 - 00000000 ____D C:\Users\metro\AppData\Roaming\TS3Client
2015-09-16 19:36 - 2012-07-30 15:14 - 00000000 ____D C:\Program Files\~Web Assistant
2015-09-16 19:29 - 2012-05-11 16:15 - 00009762 _____ C:\Users\metro\Desktop\alles.txt
2015-09-16 18:24 - 2012-03-02 20:30 - 00000927 _____ C:\Users\Public\Desktop\Steam.lnk
2015-09-16 18:24 - 2012-03-02 20:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-09-16 18:06 - 2011-12-17 17:14 - 00000000 ____D C:\Users\metro
2015-09-16 16:26 - 2014-09-17 16:22 - 00004837 _____ C:\Users\metro\Desktop\autoexec.cfg
2015-09-16 15:50 - 2013-11-22 18:55 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-16 15:45 - 2013-11-22 18:55 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-16 15:45 - 2013-11-22 18:55 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-16 15:02 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-16 15:02 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-16 14:55 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\inetsrv
2015-09-16 14:53 - 2013-11-16 13:06 - 00000384 _____ C:\Windows\Tasks\Re-markit Update.job
2015-09-16 14:53 - 2013-06-23 11:59 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-09-16 14:53 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-16 14:53 - 2009-07-14 06:51 - 00200320 _____ C:\Windows\setupact.log
2015-09-16 14:53 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-09-15 22:26 - 2011-09-23 01:41 - 01467751 _____ C:\Windows\WindowsUpdate.log
2015-09-15 19:06 - 2012-07-01 17:35 - 00000000 ____D C:\Users\metro\AppData\Local\Google
2015-09-15 17:44 - 2013-01-31 19:54 - 00003186 _____ C:\Windows\System32\Tasks\HPCeeScheduleFormetro
2015-09-15 17:44 - 2013-01-31 19:54 - 00000332 _____ C:\Windows\Tasks\HPCeeScheduleFormetro.job
2015-09-14 18:06 - 2012-01-25 00:25 - 00000000 ____D C:\Users\metro\AppData\Local\CrashDumps
2015-09-13 21:54 - 2011-07-15 22:11 - 00732534 _____ C:\Windows\DirectX.log
2015-09-12 17:14 - 2014-12-07 14:54 - 00000000 ____D C:\Users\metro\Desktop\Cloud Downloader 2.3
2015-09-10 14:41 - 2013-10-04 21:46 - 00000000 ____D C:\ProgramData\Package Cache
2015-09-09 23:14 - 2015-03-29 15:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-09-07 17:03 - 2010-11-21 05:47 - 02267234 _____ C:\Windows\PFRO.log
2015-09-06 20:07 - 2015-07-03 18:59 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2015-09-06 20:05 - 2014-01-01 17:08 - 00000000 ____D C:\Users\metro\AppData\Local\Battle.net
2015-09-06 20:04 - 2015-07-03 18:56 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-08-26 15:43 - 2012-05-29 13:47 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2015-08-18 17:03 - 2012-03-29 19:34 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-18 17:03 - 2012-03-29 19:34 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-18 17:03 - 2011-07-15 22:03 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2013-08-08 14:56 - 2014-01-05 15:35 - 0059904 ___SH () C:\Users\metro\AppData\Roaming\Thumbs.db
2012-12-22 23:55 - 2014-02-22 13:21 - 0023121 _____ () C:\Users\metro\AppData\Roaming\UserTile.png
2013-12-19 15:59 - 2014-01-15 16:36 - 0000088 _____ () C:\Users\metro\AppData\Roaming\WB.CFG
2012-03-31 17:18 - 2014-02-18 20:46 - 0005632 _____ () C:\Users\metro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-01-23 21:46 - 2012-01-23 21:46 - 0000093 _____ () C:\Users\metro\AppData\Local\fusioncache.dat
2012-11-30 15:43 - 2013-01-26 22:03 - 0000600 _____ () C:\Users\metro\AppData\Local\PUTTY.RND
2012-01-29 00:12 - 2013-12-21 16:23 - 0007595 _____ () C:\Users\metro\AppData\Local\Resmon.ResmonCfg
2012-06-14 14:22 - 2012-04-15 14:22 - 0000032 ____R () C:\ProgramData\hash.dat
2012-11-10 19:11 - 2012-11-10 19:20 - 0001039 _____ () C:\ProgramData\VodafoneConnectorService.log

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\ProgramData\hash.dat


Einige Dateien in TEMP:
====================
C:\Users\metro\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-09-03 19:25

==================== Ende von FRST.txt ============================
--- --- ---

0rbit 16.09.2015 20:13
FRST Additions Logfile:
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:15-09-2015
durchgeführt von metro (2015-09-16 21:09:25)
Gestartet von C:\Users\metro\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2011-12-17 15:14:30)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-4066131180-3669703069-1695776857-500 - Administrator - Disabled)
Gast (S-1-5-21-4066131180-3669703069-1695776857-501 - Limited - Disabled)
metro (S-1-5-21-4066131180-3669703069-1695776857-1000 - Administrator - Enabled) => C:\Users\metro

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Photoshop Elements 2.0 (HKLM-x32\...\Adobe Photoshop Elements 2.0) (Version: 2.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.9) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Assassins Creed IV Black Flag (HKLM-x32\...\Uplay Install 273) (Version:  - Ubisoft)
Audacity 2.0 (HKLM-x32\...\Audacity_is1) (Version:  - Audacity Team)
AuthenTec TrueAPI (Version: 1.3.0.111 - AuthenTec, Inc.) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.12.420 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{315dd168-0794-4cf1-8355-f195cde642fc}) (Version: 1.1.45.11819 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.1.45.11819 - Avira Operations GmbH & Co. KG) Hidden
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: 1.2.0.0 - AVM Berlin)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 1942™ (HKLM-x32\...\{5BE7BD06-512B-43bf-AD78-3BD2A5F5F7B3}) (Version: 1.6.20.0 - Electronic Arts)
Battlefield 2: Special Forces (HKLM-x32\...\{50D4CB89-AF34-4978-96DC-C3034062E901}) (Version:  - )
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.7.1 - EA Digital Illusions CE AB)
BF3 Settings Editor (HKLM\...\{5866DD36-8055-475B-A5C3-82C04091D14E}) (Version: 2.3 - Realmware)
Blobby Volley 2 Version 1.0RC3 (HKLM-x32\...\Blobby Volley 2 Version 1.0RC3_is1) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Borderlands (HKLM-x32\...\Steam App 8980) (Version:  - Gearbox Software)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Camtasia Studio 7 (HKLM-x32\...\{DE042823-C359-4B87-B66B-308057E8B6AF}) (Version: 7.0.1 - TechSmith Corporation)
ChatZum Toolbar (HKLM-x32\...\ChatZum Toolbar) (Version: 1.0.14 - ChatZum)
Cities: Skylines (HKLM-x32\...\Steam App 255710) (Version:  - Colossal Order Ltd.)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Corsair K70 Firmware Update Application (HKLM-x32\...\{8C9DA353-2101-4658-BAA7-53F88EA0D3AB}_is1) (Version:  - )
Counter-Strike (HKLM-x32\...\Steam App 10) (Version:  - Valve)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dual Monitor 1.22 (HKLM-x32\...\{64AA3F94-ED4A-4A4B-B72C-B7A1481ED5D8}_is1) (Version: 1.22.021813 - Cristi Diaconu)
Empire: Total War (HKLM-x32\...\Steam App 10500) (Version:  - The Creative Assembly)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
ESL Wire 1.18.0 (HKLM\...\ESL Wire_is1) (Version:  - Turtle Entertainment GmbH)
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Far Cry 3 Blood Dragon (HKLM-x32\...\{A071F478-73E0-4143-AE55-4DD6BABD74F5}) (Version: 1.02 - Ubisoft)
FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version:  - Image-Line)
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Free M4a to MP3 Converter 8.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
FXAA Post Process Injector (HKLM-x32\...\FXAA Post Process Injector) (Version:  - )
GameSpy Arcade (HKLM-x32\...\GameSpy Arcade) (Version:  - )
GameSpy Comrade (HKLM-x32\...\{176B3593-72F1-459C-829C-5E9671E2CB35}) (Version: 1.4.3.154 - GameSpy)
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.85 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
Half-Life (HKLM-x32\...\Half-Life) (Version:  - )
Half-Life Dedicated Server Update Tool (HKLM-x32\...\Half-Life Dedicated Server Update Tool) (Version:  - )
Half-Life: Source (HKLM-x32\...\Steam App 280) (Version:  - Valve)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
HitregFixByKuschel (HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\4fe4ded7dc05182b) (Version: 1.0.0.11 - HitregFixByKuschel)
HP Documentation (HKLM-x32\...\{25F3EC6C-BB03-4CEB-B36C-E656A9DD149E}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{8B52057C-15DB-433E-957C-E279BC7D07E3}) (Version: 3.1.0.9742 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
HP SimplePass PE 2011 (HKLM-x32\...\{31CEFF4E-B6D1-46A5-9169-7C67570E7FFA}) (Version: 5.3.0.163 - Hewlett-Packard)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6341.0 - IDT)
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line)
IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version:  - Image-Line)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Identity Protection Technology 1.1.2.0 (HKLM-x32\...\{C01A86F5-56E7-101F-9BC9-E3F1025EB779}) (Version: 1.1.2.0 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
Internet-TV für Windows Media Center (HKLM-x32\...\{9D318C86-AF4C-409F-A6AC-7183FF4CF424}) (Version: 4.2.2.0 - Microsoft Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java(TM) 6 Update 27 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416027FF}) (Version: 6.0.270 - Oracle)
Java(TM) SE Development Kit 7 Update 2 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170020}) (Version: 1.7.0.20 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LEGO® Star Wars™: Die Komplette Saga (HKLM-x32\...\InstallShield_{D596980D-17BE-4425-B8F0-5640719AADE9}) (Version: 1.00.0000 - LucasArts)
LEGO® Star Wars™: The Complete Saga (x32 Version: 1.00.0000 - LucasArts) Hidden
LG United Mobile Drivers (HKLM-x32\...\{5DB849D6-9392-4FB7-9ABB-87ED433152E5}) (Version: 3.8.1 - LG Electronics)
LibreOffice 4.3.6.2 (HKLM-x32\...\{9F410B70-8A45-4F28-985E-F9731219BCBC}) (Version: 4.3.6.2 - The Document Foundation)
Mass Effect 2 (HKLM-x32\...\Steam App 24980) (Version:  - BioWare)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Age of Empires Gold (HKLM-x32\...\Age of Empires Gold 1.0) (Version:  - )
Microsoft DirectX SDK (March 2009) (HKLM-x32\...\Microsoft DirectX SDK (March 2009)) (Version: 9.26.1590.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE (HKLM-x32\...\{F112F66E-25CA-42DD-983C-6118EB38F606}) (Version: 3.0.89.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}) (Version: 3.0.19.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.5128.5002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Native Instruments Massive (HKLM-x32\...\Native Instruments Massive) (Version:  - Native Instruments)
Native Instruments Service Center (HKLM-x32\...\Native Instruments Service Center) (Version:  - Native Instruments)
Native Instruments Traktor 2 (HKLM-x32\...\Native Instruments Traktor 2) (Version:  - Native Instruments)
NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.48.2 - Black Tree Gaming)
Nidhogg (HKLM-x32\...\Steam App 94400) (Version:  - Messhof)
Nidhogg v1.0 (HKLM-x32\...\Nidhogg v1.01.0) (Version: 1.0 - Friends in War)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
NVIDIA PhysX (HKLM-x32\...\{64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}) (Version: 9.12.0613 - NVIDIA Corporation)
Oblivion - Construction Set (HKLM-x32\...\{23D683DD-93C6-48E6-B84E-78B57778F126}) (Version: 1.00.0000 - Bethesda Softworks)
Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)
PAYDAY: The Heist (HKLM-x32\...\Steam App 24240) (Version:  - OVERKILL Software)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.13.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Risen (HKLM-x32\...\Steam App 40300) (Version:  - Piranha – Bytes)
ROCCAT Kova[+] Mouse Driver (HKLM-x32\...\{A86DDFE3-F661-461C-9BF2-876AC2CA57DE}) (Version: 1.10 - Roccat GmbH)
ROCCAT Power-Grid Version 0.458 (HKLM-x32\...\{953CF6E6-4EC8-4E55-A263-720CEBD591FE}_is1) (Version: 0.458 - ROCCAT GmbH)
Rome - Total War - Gold Edition (HKLM-x32\...\{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}) (Version: 1.6 - The Creative Assembly)
RuneScape Launcher 1.2.5 (HKLM-x32\...\{BB1810FD-EB25-4A9D-ADDD-3543190D429A}) (Version: 1.2.5 - Jagex Ltd)
Sid Meier's Civilization 4 Complete (HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}) (Version: 1.74 - Firaxis Games)
Sierra Utilities (HKLM-x32\...\Sierra Utilities) (Version:  - )
SimCity 4 Deluxe (HKLM-x32\...\{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}) (Version:  - )
Skype Click to Call (HKLM-x32\...\{BB285C9F-C821-4770-8970-56C4AB52C87E}) (Version: 7.2.15747.10003 - Microsoft Corporation)
Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Spotify) (Version: 1.0.13.108.gcd94e7db - Spotify AB)
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.29.0 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
Terraria (HKLM-x32\...\Steam App 105600) (Version:  - )
The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version:  - )
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD PROJEKT RED)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Uplay (HKLM-x32\...\Uplay) (Version: 4.0 - Ubisoft)
Vegas Pro 11.0 (HKLM-x32\...\{6BE7495E-8DF1-11E1-BB7D-F04DA23A5C58}) (Version: 11.0.682 - Sony)
Virtual Audio Cable 4.10 (HKLM\...\Virtual Audio Cable 4.10) (Version:  - )
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {024595A1-76BB-45DF-9834-EB4DC51081F8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {04D1D29B-7549-42A8-9EFB-9EC201443C88} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-18] (Adobe Systems Incorporated)
Task: {0ED1718D-5715-422C-8B3E-41806B79C4FE} - System32\Tasks\{BBAF9B04-B2F4-4FCC-A487-3C8F9F318E76} => C:\Users\metro\Desktop\Xpadder.exe
Task: {1BDF0D07-3E54-4CFB-AC2E-08A550973DB1} - System32\Tasks\Freemium1ClickMaint => C:\Program Files (x86)\Covus Freemium\Free System Utilities\1Click.exe
Task: {287BE362-A722-4F3B-9408-C1788E018A33} - System32\Tasks\{981383F9-0EAE-447F-82A4-B4C770ACF3A5} => pcalua.exe -a C:\Users\metro\Downloads\Win64_15319.exe -d C:\Users\metro\Downloads
Task: {30A9C240-8DC6-4BE8-AE13-70340B30A95D} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
Task: {3C7FD156-9994-4E69-93FD-536B4F264B9D} - System32\Tasks\{29E366F4-1142-4EE9-A065-E6BF4D5C5CD5} => C:\Users\metro\Desktop\Xpadder.exe
Task: {4DC4D267-5423-4BE8-BF8D-64B42D1F343E} - System32\Tasks\{3E0B4F13-CE11-45D9-86C3-7BF0BFFF8127} => pcalua.exe -a C:\Users\metro\Downloads\Win64_152818.exe -d C:\Users\metro\Downloads
Task: {4E9C8557-E219-454C-82D5-D9216E410B4B} - System32\Tasks\{518F9080-CE92-4DE8-9506-672A6DDD8024} => Firefox.exe Skype für den Desktop herunterladen
Task: {5313B9A6-3060-47B2-A008-6AE64A853423} - System32\Tasks\DealPly => C:\Users\metro\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE <==== ACHTUNG
Task: {5FC00EA8-639F-48A9-A182-36B8498FD310} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {619AF5F5-C00B-4E44-AA67-5781D86CBDA7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
Task: {8824345F-5A30-4247-B74A-EC6DCD32BD9A} - System32\Tasks\{B440AB5E-9D02-4CF8-8872-28B57078D7DC} => pcalua.exe -a "C:\Program Files (x86)\Image-Line\FL Studio 10\Fruity Loops Studio XXL v9.0.3 + Reg. SETUP.exe" -d "C:\Program Files (x86)\Image-Line\FL Studio 10"
Task: {949D16FA-4A04-4677-8298-C320177E5456} - System32\Tasks\HPCeeScheduleFormetro => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {A1442DB8-6F9A-4D85-B866-07B1F33B0245} - System32\Tasks\Re-markit Update => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe <==== ACHTUNG
Task: {A7DFEB4A-00C8-455D-81AA-5276CCC57CA7} - System32\Tasks\{6AA18B79-0AC6-4342-BAA0-9E235973B323} => C:\Program Files\xpadder\Xpadder.exe
Task: {AE1AD61A-1666-4676-BE7F-05106ED41ACC} - System32\Tasks\Software Updater => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe <==== ACHTUNG
Task: {BC4F5676-3434-4957-8EE5-22EB81220614} - System32\Tasks\{67BD2AAA-929B-4492-8CFE-B671EA14B26E} => C:\Users\metro\Desktop\Xpadder.exe
Task: {C883AFBC-9935-422C-A61B-4A3F22D14503} - System32\Tasks\{A20702B7-9501-4271-96C3-CE169D55B83F} => C:\Users\metro\Desktop\Xpadder.exe
Task: {EA85218A-658A-40D0-B596-581F63DEDBBE} - System32\Tasks\{6566CC79-A541-44DD-833B-AE361D66545D} => pcalua.exe -a C:\Users\metro\Downloads\age2upa-ger.exe -d C:\Users\metro\Downloads
Task: {EEA7CCDC-2C85-4A34-A52B-257E8AC92DDB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {F4098062-A1EA-41D4-A686-137B7B3A0BF7} - System32\Tasks\{053CE014-2F6D-4F9E-B7A6-DE4D033022F9} => pcalua.exe -a "C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma.cpl" -c Adobe Gamma
Task: {F49058C1-E6E5-4DDD-AD23-4414D8540AD1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleFormetro.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\Re-markit Update.job => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe <==== ACHTUNG

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2014-08-17 20:29 - 2014-01-28 12:40 - 00663056 _____ () C:\Program Files\EslWire\service\WireHelperSvc.exe
2014-08-17 20:29 - 2014-10-09 16:22 - 00214016 _____ () C:\Program Files\EslWire\service\NocIPC64.dll
2013-05-09 15:39 - 2014-06-28 14:57 - 00076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-09-10 18:34 - 2013-02-18 08:23 - 00695808 _____ () C:\Program Files (x86)\Dual Monitor\ExplorerHook64.dll
2012-01-17 18:26 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 14:05 - 2014-10-11 14:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-23 17:33 - 2010-05-29 15:57 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\hiddriver.dll
2014-10-23 17:27 - 2014-10-23 17:27 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\c152a64e30c5b94894d75ac86aa7aad2\IsdiInterop.ni.dll
2011-09-23 01:39 - 2011-04-30 00:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-09-05 19:42 - 2015-08-28 02:17 - 01501512 _____ () C:\Program Files (x86)\Google\Chrome\Application\45.0.2454.85\libglesv2.dll
2015-09-05 19:42 - 2015-08-28 02:17 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\45.0.2454.85\libegl.dll
2015-09-16 18:37 - 2015-07-03 18:12 - 00778240 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-09-16 18:37 - 2015-07-03 18:12 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-09-16 18:37 - 2015-07-03 18:12 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-09-16 18:37 - 2015-07-03 18:12 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2015-09-16 18:37 - 2015-08-19 22:39 - 02413248 _____ () C:\Program Files (x86)\Steam\video.dll
2015-09-16 18:37 - 2014-12-01 23:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2015-09-16 18:37 - 2014-12-01 23:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2015-09-16 18:37 - 2014-12-01 23:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2015-09-16 18:37 - 2014-12-01 23:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2015-09-16 18:37 - 2014-12-01 23:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2015-09-16 18:37 - 2015-08-19 22:39 - 00704192 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2015-09-16 18:37 - 2015-07-27 03:13 - 00171008 _____ () C:\Program Files (x86)\Steam\bin\openvr_api.dll
2015-09-16 18:37 - 2015-07-03 18:12 - 39553928 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\sony.com -> sony.com


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\metro\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: c2cautoupdatesvc => 2
MSCONFIG\Services: c2cpnrsvc => 2
MSCONFIG\Services: FPLService => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HPClientSvc => 2
MSCONFIG\Services: hpqwmiex => 3
MSCONFIG\Services: HPWMISVC => 2
MSCONFIG\Services: IconMan_R => 2
MSCONFIG\Services: IePluginService => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: sxhsshtiaq64 => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk => C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^metro^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^tbhcn.lnk => C:\Windows\pss\tbhcn.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: AVMWlanClient => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe
MSCONFIG\startupreg: Easybits Recovery => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
MSCONFIG\startupreg: GamingKeyboard => "C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe"
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: HP Quick Launch => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
MSCONFIG\startupreg: HPOSD => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
MSCONFIG\startupreg: HPQuickWebProxy => "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Magic Desktop for HP notification => "C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe"
MSCONFIG\startupreg: Overwolf => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: Razer Synapse => "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{90BCB190-92A0-42F0-A2D3-D46DCCCBD2EA}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3BE356E0-4966-4504-ADF4-2FEAE2CCA21D}] => (Allow) LPort=2869
FirewallRules: [{0710ED40-7B05-487B-BA3A-77FE05D5E919}] => (Allow) LPort=1900
FirewallRules: [{7E03CF85-3451-474A-99E6-3D7DA311D573}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{58333EF8-215F-4899-8F5A-5994A017972D}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{BC25C063-1432-46CF-B820-8DC9FA5F67B9}] => (Allow) C:\Windows\system32\ezSharedSvcHost.exe
FirewallRules: [{B2EC6924-9CCD-4BD1-A350-9351F7BC397B}] => (Allow) C:\Program Files (x86)\EasyBits For Kids\ezDesktop.exe
FirewallRules: [{9BABCA3C-769C-4855-B61D-FF332DBE73DA}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0AB6ACFA-E007-4237-B19C-670BBBD32822}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A6BE4866-092E-4056-9068-AB4FC2E555AA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DD75002F-AEB4-4A75-B7A4-E4001534ED20}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6850C08F-F784-4E1E-8FED-40C7E44F177E}] => (Allow) C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe
FirewallRules: [{266C6F1C-2C00-4E8A-B7A9-624FE8F185AD}] => (Allow) C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe
FirewallRules: [{610FE73C-4188-4401-937D-65A7FE77ECCF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{DEEE5263-6B81-48F9-A167-EDBDCAD9AFA5}C:\program files\java\jre7\bin\javaw.exe] => (Block) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{91B29C0C-0FA3-4FA7-B272-383E749A29E8}C:\program files\java\jre7\bin\javaw.exe] => (Block) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{BD345D7C-1D82-4A10-8361-A4D335C7B74C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\hendrix238\counter-strike source\hl2.exe
FirewallRules: [{9F293667-0EF4-4C63-9711-C97DB1707FDA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\hendrix238\counter-strike source\hl2.exe
FirewallRules: [{1701984B-4CD5-4815-86A2-D60F02D1892C}] => (Allow) C:\Program Files (x86)\Origin Games\Mass Effect 3 Demo\Binaries\Win32\MassEffect3Demo.exe
FirewallRules: [{BA7CB437-ABC7-44BB-A1CC-BAB89A0FBBEC}] => (Allow) C:\Program Files (x86)\Origin Games\Mass Effect 3 Demo\Binaries\Win32\MassEffect3Demo.exe
FirewallRules: [{320E4B72-27CF-4482-AA13-139564447B66}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
FirewallRules: [{544D1652-C6EB-4DF5-9AAD-CCA18F873CD5}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
FirewallRules: [{FCE5B4D7-58A7-4BC0-B073-2879C21E8D8B}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
FirewallRules: [{D5612DE3-C57C-456C-8918-1924CBB4A2BD}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
FirewallRules: [{07352F76-EFC0-4F6C-81BA-0571F5023F3A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\risen 2\system\Risen2.exe
FirewallRules: [{1458A98A-9A68-4463-91FE-D4B6463B30B4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\risen 2\system\Risen2.exe
FirewallRules: [{4E5643FA-7092-41E2-BE13-BCB8825D2D32}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{B2581E78-393F-43BE-9C26-6D32C8CCB0EE}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{E6011205-A0C7-4E42-A89A-376F87C25ECB}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{F20111AF-50BC-4431-81DF-A8A7D96D86E6}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{C9EF77E4-D301-4F6B-8672-B6A2D8FA60E3}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{D987668C-3A88-4B52-9B0A-09079DD3D0B1}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{CBB0F9F6-8EA4-4B90-B8BA-C7016E02C4CB}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{4B8026F0-639C-4EF7-84E6-8059F6AE06D6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\arma 2 free\ArmA2Free.exe
FirewallRules: [{F1C5FEF3-A164-4BEB-ABBF-1755D3FD21DE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\arma 2 free\ArmA2Free.exe
FirewallRules: [{18C7D517-87A7-436F-A892-F661EF8E0D72}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\apb reloaded\Binaries\APB.exe
FirewallRules: [{31EDE278-9485-4C36-8ED8-62FB3E02236A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\apb reloaded\Binaries\APB.exe
FirewallRules: [{EE1CD60E-B1F9-4993-B0FC-986177543F27}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\apb reloaded\Binaries\VivoxVoiceService.exe
FirewallRules: [{448B5FFA-22AF-476B-9402-7938A46F0202}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\apb reloaded\Binaries\VivoxVoiceService.exe
FirewallRules: [{3A0D0B35-E681-4910-93E3-DC8003BD1F8C}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\swtor\retailclient\swtor.exe
FirewallRules: [{90B45477-4FBF-4D61-B3D4-25372E4FD1DD}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\swtor\retailclient\swtor.exe
FirewallRules: [{CDA3F436-988F-4846-A3AC-48B114A3421D}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{F6E62756-BD29-40A7-AC2B-EDBD98F59B1D}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{660ADF32-DB2C-49D8-A74C-9A7DD329AB49}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\star wars jedi knight\JK.EXE
FirewallRules: [{F6CE4F70-6B28-4812-9D59-DD628C754C1B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\star wars jedi knight\JK.EXE
FirewallRules: [{31461EAC-9946-4918-9216-42A29A6DF4E7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\jedi knight mysteries of the sith\JKM.EXE
FirewallRules: [{5A00998F-F03C-4EA7-A54A-E51EC1F69AEF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\jedi knight mysteries of the sith\JKM.EXE
FirewallRules: [{8871A8F5-6B92-4E70-961C-5115479F3B64}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Jedi Outcast\GameData\jk2sp.exe
FirewallRules: [{821F9589-5641-4EFF-A372-11259C26120A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Jedi Outcast\GameData\jk2sp.exe
FirewallRules: [{230F6BFC-8FFF-4F77-8166-E4EDB7B74420}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Jedi Outcast\GameData\jk2mp.exe
FirewallRules: [{94C0F7E4-AEDD-4AB6-84F1-5E0A98C5245F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Jedi Outcast\GameData\jk2mp.exe
FirewallRules: [{30B15730-7EC3-4825-ABD2-6B4A7D21E32B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Assassins Creed\AssassinsCreed_Game.exe
FirewallRules: [{93279997-3D47-4743-A9C4-EEDBED006D51}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Assassins Creed\AssassinsCreed_Game.exe
FirewallRules: [{64C55DC2-CAEB-41CB-A782-7A32E9AF31C5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dark forces\DosBox\dosbox.exe
FirewallRules: [{86C9CEAA-7FB9-4C8F-AE1A-F41B2EFFBB7D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dark forces\DosBox\dosbox.exe
FirewallRules: [{E70D07FE-93BD-4FBC-AA5A-8593D9847DE9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Jedi Academy\GameData\jasp.exe
FirewallRules: [{F93A768C-97DF-4CB2-A4E8-D6CF8A0A10F9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Jedi Academy\GameData\jasp.exe
FirewallRules: [{3F8CC01E-670E-4B53-9CFA-E05E311FBAFB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Jedi Academy\GameData\jamp.exe
FirewallRules: [{C6A465BD-1F2D-452D-8EF1-D516FEF402AB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Jedi Academy\GameData\jamp.exe
FirewallRules: [{12219437-810E-4DA7-85B6-E2CEF9BC49AD}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{CCBC57AA-B395-45B5-8FA7-9FD67BF6A5A4}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{34AC9326-44D0-498F-9B16-80ADD60584B2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Assassins Creed Brotherhood\ACBSP.exe
FirewallRules: [{94E5329F-82BE-41E8-B813-8F7458932FA8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Assassins Creed Brotherhood\ACBSP.exe
FirewallRules: [{801C674E-B35A-4309-B371-5AAE015050ED}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dark forces\DosBox\dosbox.exe
FirewallRules: [{84F3A1AA-74B9-4FD1-BB52-EECA075D17A5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dark forces\DosBox\dosbox.exe
FirewallRules: [{90C236D0-C527-4A28-96E8-6D97D4F1357F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\darkness ii demo\DarknessII.exe
FirewallRules: [{DE51E95C-839F-46D4-9FBC-2C7869F5F5C8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\darkness ii demo\DarknessII.exe
FirewallRules: [{A73B8BB7-95D7-47A9-B9EF-A45F29B1FD40}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dungeon Defenders\Binaries\Win32\DungeonDefenders.exe
FirewallRules: [{C5F68A28-3684-4629-9938-EF93BAF44E2B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dungeon Defenders\Binaries\Win32\DungeonDefenders.exe
FirewallRules: [{707F0974-A6C0-4363-A85C-695B220C1593}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Darksiders 2\Darksiders2.exe
FirewallRules: [{F3313BD9-49C2-4643-ACF3-42EC84AD6477}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Darksiders 2\Darksiders2.exe
FirewallRules: [{C3DDF0C5-5254-4E2C-BE09-14DF21A8E591}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the binding of isaac\Isaac.exe
FirewallRules: [{7D7968EE-784F-4BA1-A39A-754AFC9A4F2A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the binding of isaac\Isaac.exe
FirewallRules: [{AC3A9EB3-B7F3-4AA2-87A1-A8AF5C8C8C00}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Terraria\Terraria.exe
FirewallRules: [{D047856D-7EA0-4FA8-BBDB-C7DF24A8F91B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Terraria\Terraria.exe
FirewallRules: [{BCB4D23B-5D5C-4358-88E6-33F3BCFBB641}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\homefront\Binaries\HOMEFRONT.exe
FirewallRules: [{BA5608CF-BA6C-43E0-936D-C010F7AA87FC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\homefront\Binaries\HOMEFRONT.exe
FirewallRules: [{C3DA37D3-22FC-4DBD-9488-2AF7C4BC0F60}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\PlanetSide 2\LaunchPad.exe
FirewallRules: [{B715F2AB-6E46-4E8D-9235-7CC6516363D6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\PlanetSide 2\LaunchPad.exe
FirewallRules: [{CABC207B-424F-4225-A764-81A0DF2A79DA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Red Faction II\Red Faction II.exe
FirewallRules: [{848A6AF9-4EEA-47F2-8470-550860532B1E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Red Faction II\Red Faction II.exe
FirewallRules: [{B5AD33A0-3B7A-4D8A-B6EE-27C46CBAFB49}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Mass Effect\docs\EA Help\Electronic_Arts_Technical_Support.htm
FirewallRules: [{1D564931-06E9-4F38-A5FC-821BB147E069}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Mass Effect\docs\EA Help\Electronic_Arts_Technical_Support.htm
FirewallRules: [{25F13ED4-14B3-4AE0-8379-EB8F81FC45AA}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 1942\BF1942.exe
FirewallRules: [{6C90D3C3-DF65-4C48-83B4-08F069074C8B}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 1942\BF1942.exe
FirewallRules: [{8D27D605-F0EB-4FAE-BAD9-ECAD4F6B5567}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ManiaPlanet_SMStorm\ManiaPlanetLauncher.exe
FirewallRules: [{BC165FE5-4E37-463D-8360-F0CB0ACA2226}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ManiaPlanet_SMStorm\ManiaPlanetLauncher.exe
FirewallRules: [{65A96DA1-1F3C-4F10-936E-FBBBA71E6B24}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ManiaPlanet_SMStorm\ManiaPlanet.exe
FirewallRules: [{BA2B0CB3-6366-439C-9998-C8C1A959E445}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ManiaPlanet_SMStorm\ManiaPlanet.exe
FirewallRules: [{611F8E47-E1E8-4DEB-80E7-0AA3C9C0D806}] => (Allow) C:\Windows\System32\dmwu.exe
FirewallRules: [{599CF77F-1435-4D37-BEFB-6EFE8E7CA4A0}] => (Allow) C:\Windows\System32\dmwu.exe
FirewallRules: [{44793134-570F-45E5-A815-3FE30EE7BD8A}] => (Allow) C:\Windows\System32\ARFC\wrtc.exe
FirewallRules: [{B8A23757-70F9-44E2-8FD2-D3EBE2036D71}] => (Allow) C:\Windows\System32\ARFC\wrtc.exe
FirewallRules: [{2C9C9B3C-5B1A-4A14-A684-EF126B94A226}] => (Allow) C:\Windows\System32\dmwu.exe
FirewallRules: [{CB43465C-E086-4DA9-AB45-815E6DADA3C7}] => (Allow) C:\Windows\System32\dmwu.exe
FirewallRules: [{297B2C45-E45F-4AF7-8CB6-FEBD8811DA20}] => (Allow) C:\Windows\System32\ARFC\wrtc.exe
FirewallRules: [{42F35ED7-3D34-4277-99CA-9EC1E27D55A4}] => (Allow) C:\Windows\System32\ARFC\wrtc.exe
FirewallRules: [TCP Query User{659E2D48-D977-4970-BF19-52A582AEEB7E}C:\users\metro\appdata\local\temp\rar$ex93.456\iw4m.dat] => (Allow) C:\users\metro\appdata\local\temp\rar$ex93.456\iw4m.dat
FirewallRules: [UDP Query User{10DC9687-AB3B-4666-8916-3932AE9ED7DA}C:\users\metro\appdata\local\temp\rar$ex93.456\iw4m.dat] => (Allow) C:\users\metro\appdata\local\temp\rar$ex93.456\iw4m.dat
FirewallRules: [TCP Query User{127D3F19-AA17-4C9E-82D0-6D0290B689E8}C:\users\metro\appdata\local\temp\rar$ex40.456\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex40.456\iw4m.dat
FirewallRules: [UDP Query User{C7526B76-17D6-4E1B-AFBF-A10021BC4D44}C:\users\metro\appdata\local\temp\rar$ex40.456\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex40.456\iw4m.dat
FirewallRules: [TCP Query User{B477E603-29C2-4DD8-B186-EC4F80A57D85}C:\program files (x86)\steam\steamapps\common\borderlands\binaries\borderlands.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\borderlands\binaries\borderlands.exe
FirewallRules: [UDP Query User{D609EE6C-AC46-416D-A211-ABA79654689D}C:\program files (x86)\steam\steamapps\common\borderlands\binaries\borderlands.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\borderlands\binaries\borderlands.exe
FirewallRules: [TCP Query User{D5AF9AC5-B70E-45A8-A70E-43C02A8F1237}C:\users\metro\appdata\local\temp\rar$ex05.112\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex05.112\iw4m.dat
FirewallRules: [UDP Query User{4DFAD261-6A3B-487E-8755-336099AC3CFF}C:\users\metro\appdata\local\temp\rar$ex05.112\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex05.112\iw4m.dat
FirewallRules: [TCP Query User{1C59E2E7-BFFB-4589-8BF7-3177C5996CD4}C:\users\metro\appdata\local\temp\rar$ex38.016\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex38.016\iw4m.dat
FirewallRules: [UDP Query User{F0805BD8-541E-476C-B80B-79F48525E492}C:\users\metro\appdata\local\temp\rar$ex38.016\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex38.016\iw4m.dat
FirewallRules: [TCP Query User{2435C7EB-11E9-4EA4-917A-E76FF11EEE4A}C:\users\metro\appdata\local\temp\rar$ex62.856\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex62.856\iw4m.dat
FirewallRules: [UDP Query User{476F62D5-F265-4F5A-9F3E-E89A4FFC97D3}C:\users\metro\appdata\local\temp\rar$ex62.856\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex62.856\iw4m.dat
FirewallRules: [{298E5700-59AE-44EC-8276-74C8666A961D}] => (Allow) C:\Windows\SysWOW64\ARFC\wrtc.exe
FirewallRules: [{08BC14D0-4AE4-42E0-A7F4-E452BEF2E95F}] => (Allow) C:\Windows\SysWOW64\ARFC\wrtc.exe
FirewallRules: [TCP Query User{F92A9CC9-727A-4FC2-BA42-8425203A152B}C:\users\metro\appdata\local\temp\rar$ex03.824\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex03.824\iw4m.dat
FirewallRules: [UDP Query User{4B5C4238-24F1-4E45-9A7F-0A789B4E0BC8}C:\users\metro\appdata\local\temp\rar$ex03.824\iw4m.dat] => (Block) C:\users\metro\appdata\local\temp\rar$ex03.824\iw4m.dat
FirewallRules: [{3E8DAAE0-8376-448A-BC16-E2E6DCA9DF1C}] => (Allow) C:\Windows\SysWOW64\ARFC\wrtc.exe
FirewallRules: [{DF4DD910-9D6F-41C6-A8CE-BB6DA430220E}] => (Allow) C:\Windows\SysWOW64\ARFC\wrtc.exe
FirewallRules: [TCP Query User{5667F6BC-92D9-4F96-886A-F2730BE4384A}C:\windows\syswow64\javaw.exe] => (Allow) C:\windows\syswow64\javaw.exe
FirewallRules: [UDP Query User{5E78CC09-5DE1-4B98-86DA-2DE6DDB4C0C3}C:\windows\syswow64\javaw.exe] => (Allow) C:\windows\syswow64\javaw.exe
FirewallRules: [TCP Query User{07CF3334-6D0A-447C-AD27-D17039D95ECF}C:\windows\syswow64\javaw.exe] => (Allow) C:\windows\syswow64\javaw.exe
FirewallRules: [UDP Query User{3682CB8D-C924-4D77-BF45-890307B1E48D}C:\windows\syswow64\javaw.exe] => (Allow) C:\windows\syswow64\javaw.exe
FirewallRules: [TCP Query User{C88146F9-0923-4174-B90B-3677B53888D6}C:\program files (x86)\microsoft games\age of empires\empiresx.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires\empiresx.exe
FirewallRules: [UDP Query User{BF18B022-6ACD-4938-BEA1-7E5BEBEC303F}C:\program files (x86)\microsoft games\age of empires\empiresx.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires\empiresx.exe
FirewallRules: [TCP Query User{EC54CCBC-1080-472C-A11D-89FAD7AF37E9}C:\windows\syswow64\dplaysvr.exe] => (Allow) C:\windows\syswow64\dplaysvr.exe
FirewallRules: [UDP Query User{BAEFEB22-FA36-479B-9391-6211332A86D8}C:\windows\syswow64\dplaysvr.exe] => (Allow) C:\windows\syswow64\dplaysvr.exe
FirewallRules: [{77CC37E2-3B6A-4BE2-9EC9-68DD9A3652C1}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{710918C6-1F26-4899-9219-C9FFA11E2121}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [TCP Query User{F51ABDA5-ED8D-4AE6-8CFE-476FD12982EF}C:\program files (x86)\smart port forwarding\spf.exe] => (Allow) C:\program files (x86)\smart port forwarding\spf.exe
FirewallRules: [UDP Query User{4BEEA556-24CD-4396-9CF1-0DE76B7EFDB5}C:\program files (x86)\smart port forwarding\spf.exe] => (Allow) C:\program files (x86)\smart port forwarding\spf.exe
FirewallRules: [TCP Query User{06B492D6-A3CA-4958-B4FA-F0F9D90403FB}C:\program files (x86)\smart port forwarding\spf.exe] => (Allow) C:\program files (x86)\smart port forwarding\spf.exe
FirewallRules: [UDP Query User{975C20AF-62E8-431D-A104-394463A053D1}C:\program files (x86)\smart port forwarding\spf.exe] => (Allow) C:\program files (x86)\smart port forwarding\spf.exe
FirewallRules: [{ADA51E52-F41D-4BA9-B660-C1FBFF13E1D2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\borderlands\Binaries\Borderlands.exe
FirewallRules: [{5B2BF9BF-FF1B-401A-96B3-B99B34DEDBEF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\borderlands\Binaries\Borderlands.exe
FirewallRules: [TCP Query User{E87F8A78-FF10-4DD0-A320-8B0A489F117A}C:\users\metro\desktop\neuer ordner\iw4m.dat] => (Block) C:\users\metro\desktop\neuer ordner\iw4m.dat
FirewallRules: [UDP Query User{863B0D87-14A7-4131-B45E-57418D4C0AA1}C:\users\metro\desktop\neuer ordner\iw4m.dat] => (Block) C:\users\metro\desktop\neuer ordner\iw4m.dat
FirewallRules: [TCP Query User{603F42D1-80AF-497A-A571-98998FC2B66C}C:\users\metro\desktop\cube world\server.exe] => (Allow) C:\users\metro\desktop\cube world\server.exe
FirewallRules: [UDP Query User{BFE12393-1C84-4A32-9D62-19DA01A38A3A}C:\users\metro\desktop\cube world\server.exe] => (Allow) C:\users\metro\desktop\cube world\server.exe
FirewallRules: [{BDE65C65-B81B-4F34-9274-DCB3A7C191E3}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 1942\BF1942.exe
FirewallRules: [{0A3852AC-CC28-4691-A9BE-D7C5B9656D94}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 1942\BF1942.exe
FirewallRules: [TCP Query User{770A9AEF-C953-4CC0-A5A8-C6471985AF48}C:\counterstrike\hl.exe] => (Allow) C:\counterstrike\hl.exe
FirewallRules: [UDP Query User{3A8F2627-8668-4628-8246-D16B08B1A73A}C:\counterstrike\hl.exe] => (Allow) C:\counterstrike\hl.exe
FirewallRules: [TCP Query User{1340334E-966D-4D52-BB19-6ECF13E4FA22}C:\counterstrike\hl.exe] => (Allow) C:\counterstrike\hl.exe
FirewallRules: [UDP Query User{1F8A7981-5277-4325-A1CA-3077D9D3CC4A}C:\counterstrike\hl.exe] => (Allow) C:\counterstrike\hl.exe
FirewallRules: [TCP Query User{07F5D5D2-7007-4415-B451-99D08FC7C218}C:\program files (x86)\devpro\devpro.dll] => (Block) C:\program files (x86)\devpro\devpro.dll
FirewallRules: [UDP Query User{8262C6BB-A1E1-4F2B-8814-4A2314B91A56}C:\program files (x86)\devpro\devpro.dll] => (Block) C:\program files (x86)\devpro\devpro.dll
FirewallRules: [TCP Query User{A748D10D-B302-4FE1-9A1B-101FD427887A}C:\program files (x86)\devpro\devpro.dll] => (Allow) C:\program files (x86)\devpro\devpro.dll
FirewallRules: [UDP Query User{66A75449-B869-4C2C-A028-10DEC55D2BFD}C:\program files (x86)\devpro\devpro.dll] => (Allow) C:\program files (x86)\devpro\devpro.dll
FirewallRules: [TCP Query User{52EF2A8A-82AD-4A99-96FC-17FC3F00E58C}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [UDP Query User{4318929A-5767-4DE3-9D43-A2C3308CB6E1}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [TCP Query User{D432C6BD-EC79-4385-B3F8-330CB209DAC5}C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut.exe
FirewallRules: [UDP Query User{0CA2B7CC-6898-4811-AA29-07E1F6F0F66F}C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut.exe
FirewallRules: [TCP Query User{2E38654D-3B62-47CC-A81C-B5CD21865119}C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut_dx11.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut_dx11.exe
FirewallRules: [UDP Query User{3F9BAE37-BBB1-4C89-B403-74B360A6BDD1}C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut_dx11.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut_dx11.exe
FirewallRules: [TCP Query User{7DCF1915-92CD-418F-8CB7-6DE495A876BF}C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut_dx11.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut_dx11.exe
FirewallRules: [UDP Query User{33885083-A986-4B40-BBFD-3D04086DC4EE}C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut_dx11.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_uncut_dx11.exe
FirewallRules: [TCP Query User{9F8622D1-1C79-49BC-B099-946F6DD96833}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe
FirewallRules: [UDP Query User{2ECBAC6E-2FF4-4E45-BBD7-B964935833D6}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe
FirewallRules: [{D047C1E0-E915-4911-A730-A2EDA2A8E778}] => (Allow) C:\Windows\SysWOW64\dplaysvr.exe
FirewallRules: [{521DBE74-B4A7-47A1-892A-76BE5F144A68}] => (Allow) C:\Windows\SysWOW64\dplaysvr.exe
FirewallRules: [{EBA8A3D3-FA15-4AEE-B68B-97082C40B971}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{884722FA-9DEA-4BFC-8880-DC6DE5B13941}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [TCP Query User{2EA1C441-D155-4E8B-BD87-ACB08E0B5730}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe
FirewallRules: [UDP Query User{19FA8238-1AE3-4F9A-93DB-A4E79884D546}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe
FirewallRules: [{B140CFBE-369E-4E96-A1E6-051C9923C8FF}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{945F2293-9A43-4BD2-9AAE-EB615BE07F16}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{09DA93FC-77A0-46AC-B32B-9CB3903DD010}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{C7075BFB-2C31-4364-BD60-F45009BE1E03}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{7889DEC0-DD94-4971-83C9-CE643FF7BAF6}] => (Allow) C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\SonarHost.exe
FirewallRules: [{86C4C064-E75A-4AD4-885D-5480CEAB034D}] => (Allow) C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\SonarHost.exe
FirewallRules: [{4A9617A8-0B00-4A81-A560-F89A9234E93E}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4 Beta\bf4.exe
FirewallRules: [{5AC2109C-E519-404D-91C1-ABD39E72AB3C}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4 Beta\bf4.exe
FirewallRules: [{B5178A33-F778-4D33-9B28-19A55D6A9CD4}] => (Allow) C:\ProgramData\eSafe\eGdpSvc.exe
FirewallRules: [TCP Query User{2C735E73-74AE-46F8-907B-7D16C88B6D39}C:\program files (x86)\roccat\power-grid\roccatpowergrid.exe] => (Allow) C:\program files (x86)\roccat\power-grid\roccatpowergrid.exe
FirewallRules: [UDP Query User{EE264D0B-540F-4AA3-AC55-913266B043E4}C:\program files (x86)\roccat\power-grid\roccatpowergrid.exe] => (Allow) C:\program files (x86)\roccat\power-grid\roccatpowergrid.exe
FirewallRules: [{7754ACA2-63C2-4536-8877-0084D2BA7A06}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed III\AC3SP.exe
FirewallRules: [{50C8B8CB-5311-45D8-8B9B-728972CD58A3}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed III\AC3SP.exe
FirewallRules: [{ACA8A874-B2E5-4D43-BE0B-6F8F57ECB27D}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed III\AC3MP.exe
FirewallRules: [{E7D98F97-5081-499C-84B7-1B20D68DF769}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed III\AC3MP.exe
FirewallRules: [{B8038B57-8836-4D09-B43A-E2D535B7D8D4}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed III\AssassinsCreed3.exe
FirewallRules: [{B74D2CA8-0F0C-4B76-90FF-F1021F39E96C}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed III\AssassinsCreed3.exe
FirewallRules: [{0C1B719F-BD04-4D05-8752-4738C16EB5A3}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [{81775F25-D295-43AB-88BA-05846D75C184}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\games\Assassin's Creed IV Black Flag\AC4BFSP.exe
FirewallRules: [{939FB206-8BDF-461D-8FA8-E78C3E36C73C}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\games\Assassin's Creed IV Black Flag\AC4BFMP.exe
FirewallRules: [{0952E8C9-9117-44D3-8336-7B62CC2A418A}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield Bad Company 2\BFBC2Game.exe
FirewallRules: [{3A26ED57-05F5-4171-BCB8-AD423CC17CDD}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield Bad Company 2\BFBC2Game.exe
FirewallRules: [TCP Query User{E30D62D7-E269-4A91-B3A3-5E3CB9852EFD}E:\counterstrike\hl.exe] => (Allow) E:\counterstrike\hl.exe
FirewallRules: [UDP Query User{3571CAD4-EAB5-453C-977D-4E62B405CCE7}E:\counterstrike\hl.exe] => (Allow) E:\counterstrike\hl.exe
FirewallRules: [{1C6C3778-E249-4DC8-B90D-56BFDDAD7842}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Terraria\Terraria.exe
FirewallRules: [{42DCE636-7BB6-4565-A717-79783FE2275A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Terraria\Terraria.exe
FirewallRules: [{C3AFF060-BEAA-4B48-A4B1-62A2CC42F3BC}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{B651D43E-D8FE-4027-A472-A556677EB639}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{E9E0328D-B8BD-40BA-925E-A0C09BA46396}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2514\Agent.exe
FirewallRules: [{F116B58C-6438-4658-95A2-35013E24FB24}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2514\Agent.exe
FirewallRules: [{69339385-8244-4884-A740-FE241B905EC9}] => (Allow) C:\Program Files (x86)\Diablo III\Diablo III.exe
FirewallRules: [{19396EEA-E7A7-4253-9638-399CBB00A1D7}] => (Allow) C:\Program Files (x86)\Diablo III\Diablo III.exe
FirewallRules: [{FFA2F425-C7DD-4ACF-873B-C827B35A12C0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{5955F5A4-2294-41BA-A89F-504E8974A06E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{C6BDC068-E2A6-41DB-93CD-A592A86A8F72}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2514\Agent.exe
FirewallRules: [{5F2EF3A4-AB96-47BF-BC44-2BE0251803E7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2514\Agent.exe
FirewallRules: [TCP Query User{94F5DFFA-E618-4A75-BE5A-86CC3812B261}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{D74E0B9C-7904-43FB-B04A-3A18AB45D9FD}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{F0F98799-4A17-4DA8-9B54-D742D4C987A4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2581\Agent.exe
FirewallRules: [{9AA9C028-32FE-45EC-9349-CBC6E7AF8FE0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2581\Agent.exe
FirewallRules: [{AA6E13EE-C41D-4569-BD6E-E9363FE1CDA1}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2581\Agent.exe
FirewallRules: [{897290ED-6C29-4368-B891-09E97874D718}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2581\Agent.exe
FirewallRules: [{BA3BC632-0DF1-44C6-8049-C38A2A070D2C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2680\Agent.exe
FirewallRules: [{CA4F28D7-4E44-4337-8228-1A9E957BCD68}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2680\Agent.exe
FirewallRules: [{F335F2F5-E32D-4F42-A7C7-4FC39E5CAB23}] => (Allow) C:\Users\metro\AppData\Roaming\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe
FirewallRules: [{82BEA993-FD52-425C-B941-EB8BCDE40BAA}] => (Allow) C:\Users\metro\AppData\Roaming\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe
FirewallRules: [{CD98AE05-B56B-4812-8939-4BA7E518DCBE}] => (Allow) C:\Users\metro\AppData\Roaming\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe
FirewallRules: [{76FA8355-6FC4-49B1-8DE4-641E66488B3C}] => (Allow) C:\Users\metro\AppData\Roaming\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe
FirewallRules: [{51543B13-9279-4EAA-9410-2ECE3D7B72FC}] => (Allow) C:\Users\metro\AppData\Roaming\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe
FirewallRules: [{78A63B1F-33D2-4DD2-B39E-BF328BAAC24F}] => (Allow) C:\Users\metro\AppData\Roaming\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe
FirewallRules: [{D51E7BF6-DD74-4C4D-B65A-577F9E687E3B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{74BAC65C-01B7-4872-BF49-CD8C72D3624B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{F1AF9C83-27B0-4993-9DB5-A2F64B5EF57C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Terraria\Terraria.exe
FirewallRules: [{7961F1DF-37B3-4536-9A13-092939235FA9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Terraria\Terraria.exe
FirewallRules: [TCP Query User{26333FBE-A932-42F5-9A6B-DC6D770F87AD}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{D105DD48-F58C-4C81-895E-33F56941244A}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{6AAA6EBA-E382-4348-ABF6-3526E40DE20D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{49E35511-8E08-43B4-A43A-71E77F404DC6}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{5226D633-7802-49D7-943A-9D293715477D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{04E80BEF-3994-4B54-BF57-6E90847A096E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{CD7CB496-F8CC-49D5-A283-A324B5968BC2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{C0307B38-15A4-4469-94EB-A08AB0460D31}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [TCP Query User{BDF5266C-D033-4225-A409-80EC84D3CBE0}C:\users\metro\desktop\company of heroes™\reliccoh.exe] => (Allow) C:\users\metro\desktop\company of heroes™\reliccoh.exe
FirewallRules: [UDP Query User{BCF8AAF1-13F8-45BD-AA4B-2E97D338CAD6}C:\users\metro\desktop\company of heroes™\reliccoh.exe] => (Allow) C:\users\metro\desktop\company of heroes™\reliccoh.exe
FirewallRules: [TCP Query User{BA9009E1-E971-4479-833E-E7C0F53D2BFD}C:\program files (x86)\counter strike 1.6 reloaded\hl.exe] => (Allow) C:\program files (x86)\counter strike 1.6 reloaded\hl.exe
FirewallRules: [UDP Query User{40A4953B-DA91-4547-BEB4-29061E92BF33}C:\program files (x86)\counter strike 1.6 reloaded\hl.exe] => (Allow) C:\program files (x86)\counter strike 1.6 reloaded\hl.exe
FirewallRules: [{2DE761BB-67BC-48F1-A916-4A842E2F107E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2737\Agent.exe
FirewallRules: [{FD738B58-5DDE-4F2F-BAAA-AF911A070F97}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2737\Agent.exe
FirewallRules: [{5A168724-8832-48A3-836F-3A993ABB705E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{59A2DC97-CD02-4116-B1E1-C7A26F2014A2}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{43EC6B65-B425-4DD1-97F9-99456354A79F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2753\Agent.exe
FirewallRules: [{E9D6AD7E-7E29-4C21-A69B-F96070B02151}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2753\Agent.exe
FirewallRules: [{B9445E31-64EA-4AD0-A305-71F7D0022A80}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{3159393B-9985-4CD3-8F30-34019E91EE0E}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [TCP Query User{C6A0C23E-8152-441E-BC4C-5291CEA2BE68}C:\program files (x86)\origin games\dead space\dead space.exe] => (Allow) C:\program files (x86)\origin games\dead space\dead space.exe
FirewallRules: [UDP Query User{203DBAE9-050A-4E29-86C7-A297458C1D19}C:\program files (x86)\origin games\dead space\dead space.exe] => (Allow) C:\program files (x86)\origin games\dead space\dead space.exe
FirewallRules: [{76A9C39A-165C-4713-A6FF-8650B405C581}] => (Allow) C:\Program Files (x86)\Origin Games\Plants vs. Zombies\PlantsVsZombies.exe
FirewallRules: [{A36A31A7-9DCB-4E8B-B0D8-2CC883295EF2}] => (Allow) C:\Program Files (x86)\Origin Games\Plants vs. Zombies\PlantsVsZombies.exe
FirewallRules: [{CF45858C-F191-4E15-BC29-3D18BA86B08A}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{B3441DB9-6DF5-4C05-981D-EC43157B8F79}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{81D1AAEC-D37F-4391-B076-5A62BDDFB6F2}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{E8CF7072-34C0-42B5-9578-F1C3D285CBF7}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{5E23A407-EBCB-4F14-BB2E-21CC657D4934}C:\program files (x86)\origin games\bfh beta\bfh.exe] => (Allow) C:\program files (x86)\origin games\bfh beta\bfh.exe
FirewallRules: [UDP Query User{BDB79AA0-5541-47C9-ADD6-15A2349A889C}C:\program files (x86)\origin games\bfh beta\bfh.exe] => (Allow) C:\program files (x86)\origin games\bfh beta\bfh.exe
FirewallRules: [TCP Query User{FE84F1BC-F72D-4CDE-87B0-E19692C85906}C:\users\metro\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\metro\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{223B0435-2C82-4DF0-AB87-C45C923E6A17}C:\users\metro\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\metro\appdata\roaming\spotify\spotify.exe
FirewallRules: [{F1C19011-0893-4C9F-B88E-51AF76ED40FC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{FEFC4468-6704-4823-B3CE-5422D12D2FBD}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{988E88B0-B3A3-4496-8C2D-98C7871541B7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{510141ED-F025-453E-81AC-FE06223F9438}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{6406D86E-BD32-4726-9C7E-361BC998CCA1}] => (Allow) C:\Program Files (x86)\Ubisoft\Far Cry 3 Blood Dragon\bin\fc3_blooddragon.exe
FirewallRules: [{44E4D6F7-54C2-47F8-B30C-30B9EE2B4470}] => (Allow) C:\Program Files (x86)\Ubisoft\Far Cry 3 Blood Dragon\bin\fc3_blooddragon.exe
FirewallRules: [{A29770B3-68A2-465D-93FA-AF29D8CDCA0C}] => (Allow) C:\Program Files (x86)\Ubisoft\Far Cry 3 Blood Dragon\bin\fc3_blooddragon_d3d11.exe
FirewallRules: [{4E2F1B92-20C6-4055-830E-264C0F17BAE3}] => (Allow) C:\Program Files (x86)\Ubisoft\Far Cry 3 Blood Dragon\bin\fc3_blooddragon_d3d11.exe
FirewallRules: [{9F9E06C4-00BE-46A3-9B76-73379D7381C6}] => (Allow) C:\Program Files (x86)\Ubisoft\Far Cry 3 Blood Dragon\bin\FC3BDUpdater.exe
FirewallRules: [{44140116-C08E-4F81-8ED4-12083D4DEE32}] => (Allow) C:\Program Files (x86)\Ubisoft\Far Cry 3 Blood Dragon\bin\FC3BDUpdater.exe
FirewallRules: [{13601BFC-D60E-425A-9403-31ACA5D11AE0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{7452ADAC-9911-48C7-84FC-47AB0BF3BB4D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{4EFCE689-2E69-4EEF-9112-9D5B7B0259C1}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2753\Agent.exe
FirewallRules: [{FC9572F9-55DD-48B9-B422-D3B208624243}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2753\Agent.exe
FirewallRules: [{A545C9EB-CC46-4052-B691-6D286E0CE352}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{908BF43D-DB86-4E2B-A4E6-B43637FE5E57}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [TCP Query User{13905316-B3D7-4E8C-98A8-DAD143745A0A}C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe
FirewallRules: [UDP Query User{9744AA3C-6465-4FF1-BF71-B55EBDE46D05}C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe
FirewallRules: [TCP Query User{42E9A5F9-2AA2-43BE-91AD-6E88F87A92AF}C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe
FirewallRules: [UDP Query User{CB7E6776-1CE1-4EC7-B51A-8E172DE2150A}C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe
FirewallRules: [TCP Query User{141B3B73-F947-4A2E-91BB-0CF9C0A5ADEA}C:\program files (x86)\ea games\battlefield 2\bf2_w32ded.exe] => (Allow) C:\program files (x86)\ea games\battlefield 2\bf2_w32ded.exe
FirewallRules: [UDP Query User{EE965725-3D9E-472C-A026-B98D9C71F228}C:\program files (x86)\ea games\battlefield 2\bf2_w32ded.exe] => (Allow) C:\program files (x86)\ea games\battlefield 2\bf2_w32ded.exe
FirewallRules: [{F627C1F8-5A9E-415B-97F7-3F967C8FC1F4}] => (Block) C:\program files (x86)\ea games\battlefield 2\bf2_w32ded.exe
FirewallRules: [{9BE17636-A524-4363-8E20-21BF8A909ABE}] => (Block) C:\program files (x86)\ea games\battlefield 2\bf2_w32ded.exe
FirewallRules: [{B290239D-F504-44A8-8738-15EC8CD9D045}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risen\bin\Risen.exe
FirewallRules: [{D054E7BE-19EF-43D4-A0FC-E8A6F6404CA6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risen\bin\Risen.exe
FirewallRules: [{FCCD9B82-75B8-4E55-A43E-53371426FBE2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\PAYDAY The Heist\payday_win32_release.exe
FirewallRules: [{9E7FDDBA-6B07-498E-B1F9-62E976F7CF31}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\PAYDAY The Heist\payday_win32_release.exe
FirewallRules: [{7C59339B-E5DC-43F6-ABEE-D1C68A33428E}] => (Allow) C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
FirewallRules: [{C0D45DEA-A122-4C98-AE9F-67B52C426846}] => (Allow) C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
FirewallRules: [{BA93F40C-3E93-446D-9925-66BA7E2127B6}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{8B56E299-1539-48B7-A71E-F291D04F7376}] => (Allow) C:\Program Files\EslWire\wire.exe
FirewallRules: [{78A79BE5-EBAF-46C2-8F3D-C044419529D1}] => (Allow) C:\Program Files\EslWire\wire.exe
FirewallRules: [{9DB39CD0-1A25-43E3-B038-FCD3AE1E51A0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{FCC430B9-C37D-4FEC-8A78-7DB17A376FDE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{56CEEDB3-584C-464A-BAB0-E33E2363E680}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{4917D621-14F3-4D50-9865-0FC383F93D76}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{0F6EC68F-5629-4E82-A914-565C8ECC19BC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{6604C7B7-36FE-48D1-AB10-1D124EF1104A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{EB4A0DE3-8A1C-4218-9317-7B4F3E39D5A2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Cities_Skylines\Cities.exe
FirewallRules: [{DA51BBB1-4B37-43E8-911D-C6004737B83B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Cities_Skylines\Cities.exe
FirewallRules: [TCP Query User{3A119D1B-6204-4A75-8942-EBE3E0254106}C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{18F5F9B6-8597-4E60-9C77-FDE8A9829E30}C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\javaw.exe
FirewallRules: [{7EC4A2D3-D76D-44A4-B86D-D1EC0DADBA91}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Nidhogg\Nidhogg.exe
FirewallRules: [{6EB81B06-8FEE-4B3D-A5AC-DBA8C3E5C201}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Nidhogg\Nidhogg.exe
FirewallRules: [{82B37CE3-EA3F-40C8-BBA0-15FFD499EB2F}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{D7868847-C572-41C8-9222-D8DBD384B562}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{A934AF74-1C87-44F3-9CBC-118C4E7CEC55}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{931F2EB6-4C58-4198-8051-0A56A6712703}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{5BE0F094-3C5C-4D29-8508-6428C7914760}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Half-Life\hl.exe
FirewallRules: [{95335F4E-EDFE-4D2C-871B-E24C6C559A97}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Half-Life\hl.exe
FirewallRules: [{3DAE71F8-8802-4A42-8153-A413C5C4EBDE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Witcher Enhanced Edition\System\witcher.exe
FirewallRules: [{894BF7A0-0B17-40FC-A840-9F4CAC9AFC3F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Witcher Enhanced Edition\System\witcher.exe
FirewallRules: [{1508A54F-2845-40BA-833A-2D6E4F5A96AF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Witcher Enhanced Edition\System\djinni!.exe
FirewallRules: [{4A3AE544-4E6B-4FE5-B99B-F859C98A07DC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Witcher Enhanced Edition\System\djinni!.exe
FirewallRules: [{C79A991A-6709-4D67-B3CB-49E63F0871CC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe
FirewallRules: [{D3FCC650-C8E9-4FD5-AAC9-2601AA03CACC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe
FirewallRules: [{439EA533-9EF4-4847-B721-CBB46528EDCA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Empire Total War\Empire.exe
FirewallRules: [{7133A7D5-93CF-4A0C-A3EB-74ABB4F48ACB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Empire Total War\Empire.exe
FirewallRules: [{BE88F271-A49E-48EB-B315-19606C4020C8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Half-Life 2\hl2.exe
FirewallRules: [{75E3550C-C3B0-4397-A3E3-8D1A27DB3544}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Half-Life 2\hl2.exe
FirewallRules: [{20C3429B-7D8F-4677-8287-2CFCFC6D2051}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{BCCC179B-B4CC-46D9-87A0-5E31F835CABA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{997A5368-E39A-47E0-AA2A-F62A7E06CA9D}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Ralink RT5390 802.11b/g/n WiFi Adapter
Description: Ralink RT5390 802.11b/g/n WiFi Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Ralink Technology, Corp.
Service: netr28x
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: HP Webcam-101
Description: USB-Videogerät
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Microsoft
Service: usbvideo
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (09/16/2015 06:07:27 PM) (Source: MsiInstaller) (EventID: 11730) (User: ICH_MAG_FLUGZEU)
Description: Produkt: Steam -- Fehler 1730. Sie müssen über Administratorrechte verfügen, um diese Anwendung entfernen zu können. Melden Sie sich als Administrator an oder wenden Sie sich an den technischen Support, um Unterstützung zu erhalten.

Error: (09/16/2015 02:53:42 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz  konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet.  0x0.

Error: (09/16/2015 02:53:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/16/2015 02:53:40 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Kontext:  Anwendung, SystemIndex Katalog

Error: (09/16/2015 02:53:40 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Error: (09/15/2015 03:09:45 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz  konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet.  0x0.

Error: (09/15/2015 03:09:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2015 03:09:43 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Kontext:  Anwendung, SystemIndex Katalog

Error: (09/15/2015 03:09:43 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Error: (09/14/2015 06:06:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: csgo.exe, Version: 0.0.0.0, Zeitstempel: 0x55ce3d41
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0x1d40
Startzeit der fehlerhaften Anwendung: 0xcsgo.exe0
Pfad der fehlerhaften Anwendung: csgo.exe1
Pfad des fehlerhaften Moduls: csgo.exe2
Berichtskennung: csgo.exe3


Systemfehler:
=============
Error: (09/16/2015 08:46:03 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (09/16/2015 08:14:18 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (09/16/2015 07:09:27 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (09/16/2015 06:38:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (09/16/2015 06:38:02 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (09/16/2015 06:32:02 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (09/16/2015 06:26:37 PM) (Source: volsnap) (EventID: 14) (User: )
Description: Die Schattenkopien von Volume "C:" wurden aufgrund eines E/A-Fehlers auf Volume "C:" abgebrochen.

Error: (09/16/2015 04:10:13 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (09/16/2015 02:55:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (09/16/2015 02:54:36 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)


CodeIntegrity:
===================================
  Date: 2014-05-26 11:01:53.425
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-26 11:01:53.379
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-26 11:01:49.354
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-26 11:01:49.323
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-26 11:00:57.764
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-26 11:00:57.701
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-22 16:54:12.231
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\igdpmd64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-22 16:54:05.897
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\igdpmd64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-02 13:58:51.974
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\igdpmd64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-02 13:58:51.849
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\igdpmd64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5-2430M CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 63%
Installierter physikalischer RAM: 4043.86 MB
Verfügbarer physikalischer RAM: 1481.76 MB
Summe virtueller Speicher: 10085.9 MB
Verfügbarer virtueller Speicher: 6629.13 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:445.34 GB) (Free:78.81 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]
Drive d: (Recovery) (Fixed) (Total:16.26 GB) (Free:1.76 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]
Drive e: (ALLES MÖGLI) (Fixed) (Total:3.96 GB) (Free:2 GB) FAT32

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F36AF300)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=445.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16.3 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)

==================== Ende von Addition.txt ============================
--- --- ---

deeprybka 16.09.2015 20:22
Zitat:
Zitat von 0rbit (Beitrag 1516016)
Ich bin fraglos wie man so tief ins system eintreten konte und ich vermute einen Trojaner.
Ja, sieht nach DarkComet aus.

Bis zu einem möglichen clean von mir, keine sensiblen Logins mehr von diesem PC. Passwörter mit Handy oder sauberem PC ändern.

Wir machen so weiter:


Schritt 1
Echtzeitschutz des Virenscanners abschalten.

http://www.deeprybka.trojaner-board.de/zoek/avira.gif

Schritt 2
http://deeprybka.trojaner-board.de/b...s/combofix.pngScan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

0rbit 17.09.2015 09:01
Hallo,
ich kann Avira nicht ausschalten... soll ich trotzdem weitermachen?
Grüße Jonas

deeprybka 17.09.2015 10:05
Nein.

Wo liegt denn das Problem mit Avira?

0rbit 17.09.2015 10:30
Hallo deeprybka,
ich habe nach vielen versuchen Avira ausschalten können und habe das Programm ausgeführt

Combofix Logfile:
Code:
ComboFix 15-09-07.01 - metro 17.09.2015  11:00:35.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4044.2413 [GMT 2:00]
ausgeführt von:: c:\users\metro\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\metro\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\metro\AppData\Roaming\.#
c:\users\metro\AppData\Roaming\dclogs
c:\users\metro\AppData\Roaming\dclogs\2014-01-18-7.dc
c:\users\metro\AppData\Roaming\dclogs\2014-01-19-1.dc
c:\users\metro\AppData\Roaming\dclogs\2014-01-20-2.dc
c:\users\metro\AppData\Roaming\dclogs\2014-01-21-3.dc
c:\users\metro\AppData\Roaming\dclogs\2014-01-22-4.dc
c:\users\metro\AppData\Roaming\dclogs\2014-01-28-3.dc
c:\users\metro\AppData\Roaming\dclogs\2014-01-29-4.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-02-1.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-03-2.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-04-3.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-05-4.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-06-5.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-07-6.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-08-7.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-12-4.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-14-6.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-15-7.dc
c:\users\metro\AppData\Roaming\dclogs\2014-02-23-1.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-01-7.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-02-1.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-03-2.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-04-3.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-05-4.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-06-5.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-07-6.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-08-7.dc
c:\users\metro\AppData\Roaming\dclogs\2014-03-09-1.dc
c:\windows\IsUn0407.exe
c:\windows\msdownld.tmp
c:\windows\SysWow64\SETFC73.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2015-08-17 bis 2015-09-17  ))))))))))))))))))))))))))))))
.
.
2015-09-16 19:05 . 2015-09-16 19:09        --------        d-----w-        C:\FRST
2015-09-16 16:06 . 2015-09-16 16:06        --------        d-----w-        c:\users\metro\048298C9A4D3490B9FF9AB023A9238F3.TMP
2015-08-25 16:14 . 2015-08-25 16:14        --------        d-----w-        c:\users\metro\AppData\Roaming\LolClient
2015-08-18 22:04 . 2015-08-19 19:22        --------        d-----w-        c:\users\metro\AppData\Local\The Witcher
2015-08-18 22:02 . 2015-08-19 21:06        --------        d-----w-        c:\users\metro\AppData\Local\SniperV2
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-08-18 15:03 . 2012-03-29 17:34        778440        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2015-08-18 15:03 . 2011-07-15 20:03        142536        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-07-29 09:38 . 2013-05-09 13:39        348360        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2015-07-29 09:38 . 2012-08-31 17:28        348360        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2015-07-29 09:37 . 2013-05-09 13:39        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2015-07-25 12:34 . 2015-03-29 17:25        162528        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2015-07-25 12:34 . 2015-03-29 17:25        141416        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2015-07-18 00:03 . 2015-07-18 00:03        1192831        ----a-w-        c:\windows\unins000.exe
2015-07-04 13:12 . 2015-07-04 13:12        0        ----a-w-        c:\windows\SysWow64\sho368B.tmp
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dualmonitor"="c:\program files (x86)\Dual Monitor\DualMonitor.exe" [2013-02-18 478720]
"Spotify Web Helper"="c:\users\metro\AppData\Roaming\Spotify\SpotifyWebHelper.exe" [2015-09-16 2018360]
"Spotify"="c:\users\metro\AppData\Roaming\Spotify\Spotify.exe" [2015-09-16 7535672]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2015-08-19 2899136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2015-08-26 782008]
"Avira SystrayStartTrigger"="c:\program files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe" [2015-08-13 66936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 RzMaelstromVADStreamingService;Razer Surround Audio Service;c:\programdata\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe;c:\programdata\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe [x]
R2 Update ClearThink;Update ClearThink;c:\program files (x86)\ClearThink\updateClearThink.exe;c:\program files (x86)\ClearThink\updateClearThink.exe [x]
R2 Web Assistant Updater;Web Assistant Updater;c:\program files\Web Assistant\ExtensionUpdaterService.exe;c:\program files\Web Assistant\ExtensionUpdaterService.exe [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 AndNetDiag2;LGE AndroidNet For Diagnostics Port;c:\windows\system32\DRIVERS\lgandnetdiag264.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag264.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 GameKB;SHARKOON Skiller;c:\windows\system32\drivers\GameKB.sys;c:\windows\SYSNATIVE\drivers\GameKB.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 KovaPlusFltr;ROCCAT Kova[+] Mouse;c:\windows\system32\drivers\KovaPlusFltr.sys;c:\windows\SYSNATIVE\drivers\KovaPlusFltr.sys [x]
R3 MobileAdapter;Mobile Adapter USB Modem and USB Serial;c:\windows\system32\DRIVERS\qscvusb.sys;c:\windows\SYSNATIVE\DRIVERS\qscvusb.sys [x]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys;c:\windows\SYSNATIVE\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys;c:\windows\SYSNATIVE\DRIVERS\nlndis.sys [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
R3 RZMAELSTROMVADService;Razer Surround Audio Enhancer Service;c:\windows\system32\drivers\RzMaelstromVAD.sys;c:\windows\SYSNATIVE\drivers\RzMaelstromVAD.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\ThrottleStop_500\WinRing0x64.sys;c:\program files (x86)\ThrottleStop_500\WinRing0x64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R4 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
R4 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
R4 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [x]
R4 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
R4 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 {c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64;{c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64;c:\windows\system32\drivers\{c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64.sys;c:\windows\SYSNATIVE\drivers\{c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\Launcher\Avira.ServiceHost.exe;c:\program files (x86)\Avira\Launcher\Avira.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 EslWireHelper;ESL Wire Helper Service;c:\program files\EslWire\service\WireHelperSvc.exe;c:\program files\EslWire\service\WireHelperSvc.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 CORK70;Corsair K70 Gaming Keyboard;c:\windows\system32\drivers\CORK70.sys;c:\windows\SYSNATIVE\drivers\CORK70.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys;c:\windows\SYSNATIVE\DRIVERS\vrtaucbl.sys [x]
S3 fwlanusb5;FRITZ!WLAN N v2;c:\windows\system32\DRIVERS\fwlanusb5.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusb5.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs        REG_MULTI_SZ          w3svc was
apphost        REG_MULTI_SZ          apphostsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-09-05 17:41        997704        ----a-w-        c:\program files (x86)\Google\Chrome\Application\45.0.2454.85\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-09-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 15:03]
.
2015-09-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-22 17:34]
.
2015-09-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-22 17:34]
.
2015-09-15 c:\windows\Tasks\HPCeeScheduleFormetro.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-06-07 1128448]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-15 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-15 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-15 416024]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://safesearch.avira.com/#web/result?source=art&q=
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = https://safesearch.avira.com/#web/result?source=art&q=
mStart Page = https://safesearch.avira.com/#web/result?source=art&q=
mDefault_Search_URL = https://safesearch.avira.com/#web/result?source=art&q=
mDefault_Page_URL = https://safesearch.avira.com/#web/result?source=art&q=
mSearch Page = https://safesearch.avira.com/#web/result?source=art&q=
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{00cbb66b-1d3b-46d3-9577-323a336acb50} - (no file)
BHO-{22c3a57f-35ea-4347-8b39-43e1f7eb958a} - (no file)
BHO-{336D0C35-8A85-403a-B9D2-65C292C39087} - (no file)
BHO-{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - (no file)
BHO-{E87806B5-E908-45FD-AF5E-957D83E58E68} - (no file)
Toolbar-10 - (no file)
Toolbar-!{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} - (no file)
Toolbar-!{5018CFD2-804D-4C99-9F81-25EAEA2769DE} - (no file)
Toolbar-!{F9639E4A-801B-4843-AEE3-03D9DA199E77} - (no file)
Wow6432Node-HKCU-Run-Win32 Update - c:\users\metro\Documents\DCSCMIN\KRmc2Hf5eeiu\IMDCSC.exe
Wow6432Node-HKCU-Run-NetLimiter - c:\program files\NetLimiter 3\NLClientApp.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-10 - (no file)
Toolbar-!{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-Sierra Utilities - c:\program files (x86)\Sierra On-Line\sutil32.exe
AddRemove-WildTangentGameProvider-hp-genres - c:\program files (x86)\HP Games\Game Explorer Categories - genres\Uninstall.exe
AddRemove-WildTangentGDF-hp-clubpenguin - c:\program files (x86)\HP Games\Web Link - Club Penguin\Uninstall.exe
AddRemove-WildTangentGDF-hp-darkorbit - c:\program files (x86)\HP Games\Web Link - Dark Orbit\Uninstall.exe
AddRemove-WildTangentGDF-hp-gunbros - c:\program files (x86)\HP Games\Web Link - Gun Bros\Uninstall.exe
AddRemove-WildTangentGDF-hp-seafight - c:\program files (x86)\HP Games\Web Link - Seafight\Uninstall.exe
AddRemove-WildTangentGDF-hp-shaiya - c:\program files (x86)\HP Games\Web Link - Shaiya\Uninstall.exe
AddRemove-WildTangentGDF-hp-worldofwarcraft - c:\program files (x86)\HP Games\Web Link - World of Warcraft\Uninstall.exe
AddRemove-Winamp - c:\program files (x86)\Winamp\UninstWA.exe
AddRemove-{980A182F-E0A2-4A40-94C1-AE0C1235902E} - c:\program files (x86)\Pando Networks\Media Booster\uninst.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{99079A25-328F-4BD4-BE04-00955ACAA0A7}"=hex:51,66,7a,6c,4c,1d,38,12,4b,99,14,
  9d,bd,7c,ba,0e,c1,12,43,d5,5f,94,e4,b3
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
  89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
"{00CBB66B-1D3B-46D3-9577-323A336ACB50}"=hex:51,66,7a,6c,4c,1d,38,12,05,b5,d8,
  04,09,53,bd,03,ea,61,71,7a,36,34,8f,44
"{11111111-1111-1111-1111-110211301130}"=hex:51,66,7a,6c,4c,1d,38,12,7f,12,02,
  15,23,5f,7f,54,6e,07,52,42,14,6e,55,24
"{2EECD738-5844-4A99-B4B6-146BF802613B}"=hex:51,66,7a,6c,4c,1d,38,12,56,d4,ff,
  2a,76,16,f7,0f,cb,a0,57,2b,fd,5c,25,2f
"{336D0C35-8A85-403A-B9D2-65C292C39087}"=hex:51,66,7a,6c,4c,1d,38,12,5b,0f,7e,
  37,b7,c4,54,05,c6,c4,26,82,97,9d,d4,93
"{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}"=hex:51,66,7a,6c,4c,1d,38,12,8f,de,00,
  6a,5c,65,a0,03,f4,70,9f,cb,f6,31,2f,8d
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
  72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}"=hex:51,66,7a,6c,4c,1d,38,12,00,8b,83,
  81,be,a2,af,06,dc,3a,a7,82,b5,e8,7d,4f
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
  94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{963B125B-8B21-49A2-A3A8-E37092276531}"=hex:51,66,7a,6c,4c,1d,38,12,35,11,28,
  92,13,c5,cc,0c,dc,be,a0,30,97,79,21,25
"{9D717F81-9148-4F12-8568-69135F087DB0}"=hex:51,66,7a,6c,4c,1d,38,12,ef,7c,62,
  99,7a,df,7c,0a,fa,7e,2a,53,5a,56,39,a4
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,
  aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
  d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
  df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{E76FD755-C1BA-4DCB-9F13-99BD91223ADE}"=hex:51,66,7a,6c,4c,1d,38,12,3b,d4,7c,
  e3,88,8f,a5,08,e0,05,da,fd,94,7c,7e,ca
"{E87806B5-E908-45FD-AF5E-957D83E58E68}"=hex:51,66,7a,6c,4c,1d,38,12,db,05,6b,
  ec,3a,a7,93,00,d0,48,d6,3d,86,bb,ca,7c
"{FCBCCB87-9224-4B8D-B117-F56D924BEB18}"=hex:51,66,7a,6c,4c,1d,38,12,e9,c8,af,
  f8,16,dc,e3,0e,ce,01,b6,2d,97,15,af,0c
.
[HKEY_USERS\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\SecuROM\License information*]
"datasecu"=hex:d9,88,3a,88,38,a3,46,38,5d,0a,a7,33,1e,38,ad,6f,d6,9e,24,dd,b6,
  94,ec,1f,a6,78,45,2a,45,45,ac,e1,7d,d2,fe,93,88,5e,67,5b,31,fb,bd,a9,60,1f,\
"rkeysecu"=hex:f8,c6,89,69,3e,93,8b,6e,50,37,4e,53,54,52,c5,d3
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_232_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_232_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{722b3793-5367-4446-b6bb-db89b05c1f24}\LocalServer32]
@DACL=(02 0000)
@=expand:"%SystemRoot%\\System32\\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_232.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.18"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_232.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_232.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_232.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\07\00\01\0f\"\17?"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\ezSharedSvcHost.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-09-17  11:22:42 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-09-17 09:22
.
Vor Suchlauf: 24 Verzeichnis(se), 85.031.628.800 Bytes frei
Nach Suchlauf: 34 Verzeichnis(se), 86.857.719.808 Bytes frei
.
- - End Of File - - F2DC4AADEC2576B651DA1B99371C11A0
--- --- ---

deeprybka 17.09.2015 12:05
Gut gemacht! :daumenhoc

Schritt 1

http://deeprybka.trojaner-board.de/m...mbamlogo4a.pnghttp://deeprybka.trojaner-board.de/m...mbamlogo4b.png
  • Download und Anleitung
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Unter Einstellungen/ Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
  • Gehe zurück zum Armaturenbrett und klicke auf "Jetzt scannen".
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben und poste mir das Log.


Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



Schritt 3

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, und drücke auf Untersuchen.
Bitte poste mir den Inhalt des Logs.

0rbit 17.09.2015 13:20
Ich danke dir sehr bisher ich hoffe es funktioniert!!

hier die log datei vom 1.programm

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 17.09.2015
Suchlaufzeit: 13:16
Protokolldatei: anti malware.txt
Administrator: Ja

Version: 2.1.8.1057
Malware-Datenbank: v2015.09.17.02
Rootkit-Datenbank: v2015.08.16.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: metro

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 446025
Abgelaufene Zeit: 1 Std., 1 Min., 51 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 135
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\APPID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}, , [5d99f739b9d2f0463c6e0bd4a35f40c0],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}, , [5d99f739b9d2f0463c6e0bd4a35f40c0],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}, , [5d99f739b9d2f0463c6e0bd4a35f40c0],
PUP.Optional.CouponBar, HKLM\SOFTWARE\CLASSES\APPID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}, , [38be82ae2962ce6810fb469833cf8e72],
PUP.Optional.CouponBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}, , [38be82ae2962ce6810fb469833cf8e72],
PUP.Optional.CouponBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}, , [38be82ae2962ce6810fb469833cf8e72],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{00cbb66b-1d3b-46d3-9577-323a336acb50}, , [4bab5fd1226951e58813506517eb3bc5],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{00CBB66B-1D3B-46D3-9577-323A336ACB50}, , [4bab5fd1226951e58813506517eb3bc5],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00CBB66B-1D3B-46D3-9577-323A336ACB50}, , [4bab5fd1226951e58813506517eb3bc5],
PUP.Optional.ReMarkIt, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{22c3a57f-35ea-4347-8b39-43e1f7eb958a}, , [985e58d8d8b367cf089f7f6606fc25db],
PUP.Optional.ReMarkIt, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{22C3A57F-35EA-4347-8B39-43E1F7EB958A}, , [985e58d8d8b367cf089f7f6606fc25db],
PUP.Optional.ReMarkIt, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{22C3A57F-35EA-4347-8B39-43E1F7EB958A}, , [985e58d8d8b367cf089f7f6606fc25db],
PUP.Optional.HomePageProtector, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [4caa44ecff8c37ffe6e9528ffd0510f0],
PUP.Optional.HomePageProtector, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{336D0C35-8A85-403A-B9D2-65C292C39087}, , [4caa44ecff8c37ffe6e9528ffd0510f0],
PUP.Optional.HomePageProtector, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}, , [4caa44ecff8c37ffe6e9528ffd0510f0],
PUP.Optional.SofTonic, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, , [9264161a117abc7a2d64f8eeb9499c64],
PUP.Optional.SofTonic, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, , [9264161a117abc7a2d64f8eeb9499c64],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [9f5763cdef9ca88e801cc0f52dd5cd33],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [9f5763cdef9ca88e801cc0f52dd5cd33],
PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}, , [34c2a888b9d2b680d52405d771919d63],
PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}, , [34c2a888b9d2b680d52405d771919d63],
PUP.Optional.Incredibar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}, , [34c2a888b9d2b680d52405d771919d63],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{963B125B-8B21-49A2-A3A8-E37092276531}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\TYPELIB\{955B782E-CDC8-4CEE-B6F6-AD7D541A8D8A}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\INTERFACE\{9F0C17EB-EF2C-4278-9136-2D547656BC03}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{9F0C17EB-EF2C-4278-9136-2D547656BC03}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9F0C17EB-EF2C-4278-9136-2D547656BC03}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{955B782E-CDC8-4CEE-B6F6-AD7D541A8D8A}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{955B782E-CDC8-4CEE-B6F6-AD7D541A8D8A}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\updatebho.TimerBHO.1, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\updatebho.TimerBHO, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\updatebho.TimerBHO, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\updatebho.TimerBHO, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{963B125B-8B21-49A2-A3A8-E37092276531}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\updatebho.TimerBHO.1, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\updatebho.TimerBHO.1, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{963B125B-8B21-49A2-A3A8-E37092276531}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{963B125B-8B21-49A2-A3A8-E37092276531}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.Blabbers, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{963B125B-8B21-49A2-A3A8-E37092276531}, , [d71f49e79fecf4422773aa0bb949b44c],
PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}, , [b3432808ff8cec4a6b32decc0002e719],
PUP.Optional.SearchQu, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}, , [b3432808ff8cec4a6b32decc0002e719],
PUP.Optional.Softomate, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}, , [e5116ec26e1d71c55b26ecfaa85ab749],
PUP.Optional.Softomate, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}, , [e5116ec26e1d71c55b26ecfaa85ab749],
PUP.Optional.SofTonic, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}, , [de18b17ffa910b2bab116680dd25cf31],
PUP.Optional.SofTonic, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, , [de18b17ffa910b2bab116680dd25cf31],
PUP.Optional.SofTonic, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}, , [de18b17ffa910b2bab116680dd25cf31],
PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}, , [19dd9c94a6e5d46231c9598336cc7789],
PUP.Optional.Incredibar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}, , [19dd9c94a6e5d46231c9598336cc7789],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\TYPELIB\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{0FA32667-9A8A-4E9C-902F-CA3323180003}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{2A42D13C-D427-4787-821B-CF6973855778}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{6B458F62-592F-4B25-8967-E6A350A59328}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\INTERFACE\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{0FA32667-9A8A-4E9C-902F-CA3323180003}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{2A42D13C-D427-4787-821B-CF6973855778}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6B458F62-592F-4B25-8967-E6A350A59328}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{0FA32667-9A8A-4E9C-902F-CA3323180003}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2A42D13C-D427-4787-821B-CF6973855778}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{6B458F62-592F-4B25-8967-E6A350A59328}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.BestToolBar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [f9fd76ba4a415ed8e2acf1eea65c40c0],
PUP.Optional.Babylon, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, , [24d2919f7417fe38f66c27b8a2608878],
PUP.Optional.SweetPacks, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EEE6C360-6118-11DC-9C72-001320C79847}, , [3db9df518dfed5615ad046a1e0229d63],
PUP.Optional.SweetPacks, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EEE6C360-6118-11DC-9C72-001320C79847}, , [3db9df518dfed5615ad046a1e0229d63],
PUP.Optional.Sanbreel, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64, , [6e8848e80f7ccb6b1ae2f2bf768e03fd],
PUP.Optional.AdPeak, HKLM\SOFTWARE\LevelQualityWatcher, , [d52189a791fa01357b2be59b54b06a96],
PUP.Optional.RRSavings, HKLM\SOFTWARE\rrsavings, , [14e2ae825c2f0a2c3146cee3dc2813ed],
PUP.Optional.SweetIM, HKLM\SOFTWARE\SweetIM, , [ad49919f7b1043f3fe17a516af555fa1],
PUP.Optional.Incredibar, HKLM\SOFTWARE\CLASSES\esrv.IncredibarESrvc, , [f303ab859eed5ed882ba5a43bf456997],
PUP.Optional.Incredibar, HKLM\SOFTWARE\CLASSES\esrv.IncredibarESrvc.1, , [9f57c36dbfcc0a2c6eceb5e86e96936d],
PUP.Optional.SofTonic, HKLM\SOFTWARE\CLASSES\srv.SoftonicSrvc, , [b442b7793d4ef046d8d33681d92bfc04],
PUP.Optional.SofTonic, HKLM\SOFTWARE\CLASSES\srv.SoftonicSrvc.1, , [15e18ba5701bbc7a505b6e498084926e],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\APPID\wit4ie.DLL, , [5b9bd15f6724043266cf4143ae5656aa],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\BASE64, , [985e2a068cff2e08738b69b743c12dd3],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\CHROME, , [0aeceb450b801125df20829eec1858a8],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\PROX, , [738373bdf59677bff60a4dd434d00ff1],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\wit4ie.DLL, , [0ee8b27eff8c4fe7bf76afd5dd27ee12],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\PROTOCOLS\HANDLER\BASE64, , [b5412709bad1a5910fef6cb49173da26],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\PROTOCOLS\HANDLER\CHROME, , [8076cf61286361d5c639f12ff014a35d],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\PROTOCOLS\HANDLER\PROX, , [9561d25e4c3f92a4e41c8f92f3116f91],
PUP.Optional.Incredibar, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, , [a0567bb5b8d3b581d26fb6e7ef150ef2],
PUP.Optional.SearchResults, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, , [94628ca46d1e60d6be2acde621e3db25],
PUP.Optional.DealPly, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\DealPly, , [ef078da37417b87e04796c2441c3ed13],
PUP.Optional.DoSearch.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\do-searchSoftware, , [b83eca66375481b52338a2a742c1b749],
PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\Incredibar.com, , [a74f062a7f0c91a544ff3a630301fc04],
PUP.Optional.Qone8.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\qone8Software, , [4bab052bb8d3af8752d1421c09fb659b],
PUP.Optional.SweetIM, HKLM\SOFTWARE\WOW6432NODE\SweetIM, , [cc2a161a563567cfa075ba01de26827e],
PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\esrv.IncredibarESrvc, , [53a319178803ef47e854fca1d52f1ee2],
PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\CLASSES\esrv.IncredibarESrvc.1, , [7d79cf611e6d72c4be7e0e8f956f1ce4],
PUP.Optional.SofTonic, HKLM\SOFTWARE\WOW6432NODE\CLASSES\srv.SoftonicSrvc, , [fdf9ee424249d363cdde67500ef6867a],
PUP.Optional.SofTonic, HKLM\SOFTWARE\WOW6432NODE\CLASSES\srv.SoftonicSrvc.1, , [2ec8f9372f5cc86e911a823550b4af51],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\wit4ie.DLL, , [14e2b878ccbf7eb886af4c38bc4837c9],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\PROTOCOLS\HANDLER\BASE64, , [65910a26cbc0979fb14d51cf44c0f10f],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\PROTOCOLS\HANDLER\CHROME, , [857156dac3c845f1f10e38e883817b85],
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\PROTOCOLS\HANDLER\PROX, , [36c0ee42d0bbc96d926ed34e22e2dd23],
PUP.Optional.BrowserCompanion, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\bodddioamolcibagionmmobehnbhiakf, , [0ee827094f3c01351744671f6a9ade22],
PUP.Optional.ReMarkIt, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dcpfhaghaadpjpgocojgnlhjcieeooel, , [6492f8387a11171fe9b6c9e7758f2cd4],
PUP.Optional.BetterSurf, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dedmngkbaffkenlfdcbganndoghblmap, , [48ae1d134843e74fcb1392f17391de22],
PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, , [eb0b5cd4d0bb7db9f64b1c8132d2827e],
PUP.Optional.Bandoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2D7C0C1F-286A-4417-A346-5F714CDF01C4}, , [6b8b69c7216a5dd9da1a730f0103b848],
PUP.Optional.ChatZum, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, , [1fd781af3c4fb18525eab0d8e91b5ea2],
PUP.Optional.ClearThink, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update ClearThink, , [f402b17fb7d450e6b6a9f693c24219e7],
PUP.Optional.SweetIM, HKU\S-1-5-18\SOFTWARE\SweetIM, , [28cef53beba0261014fcb70430d4a15f],
PUP.Optional.Feven, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\Feven 1.5, , [876f44ec107ba492cc5c30650df7fd03],
PUP.Optional.InstallBrain, HKU\S-1-5-18\SOFTWARE\WNLT, , [d224939ddfac64d28a4b584542c201ff],
PUP.Optional.Blabbers, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\Blabbers, , [a3534ee2078422147c3603ca00042cd4],
PUP.Optional.Blabbers, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\Blabbers , , [f50182ae0d7e57dfc3effad3d232a45c],
PUP.Optional.Incredibar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\Incredibar.com, , [9a5c76badbb047ef043a524b778df50b],
PUP.Optional.SweetIM, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\SweetIM, , [a2545ed27219b086a8687c3f3cc832ce],
PUP.Optional.ReMarkIt, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, , [7c7ae44cddaed95df6a6aa06c0440ef2],
PUP.Optional.RRSavings, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\APPDATALOW\SOFTWARE\Rr Savings, , [926439f7a6e5d36385ed7b364db77e82],
PUP.Optional.SerachQU, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\APPDATALOW\SOFTWARE\searchqutoolbar, , [52a4220e078456e0af9fb500c34118e8],
PUP.Optional.ChatZum, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{4C3D3E1F-361F-41E5-BCFF-545609429851}, , [5f97022eacdf1b1b28e694f46b9957a9],
PUP.Optional.ChatZum, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E}, , [22d4d65a96f54cea54ba8800b05415eb],
PUP.Optional.SearchResults, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, , [7d795ed26a211a1c8166e7cc7c88d42c],
PUP.Optional.Incredibar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}, , [16e0c66a8efdd165ff40abf2ee168b75],

Registrierungswerte: 37
PUP.Optional.HomePageProtector, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\Web Assistant\Firefox, , [4caa44ecff8c37ffe6e9528ffd0510f0]
PUP.Optional.HomePageProtector, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\Web Assistant\Firefox, , [4caa44ecff8c37ffe6e9528ffd0510f0]
PUP.Optional.HomePageProtector, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [04f233fd266549edf5da30b1fa08be42],
PUP.Optional.HomePageProtector, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [c92de050d4b7290d616e766b4fb315eb],
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\BASE64|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [985e2a068cff2e08738b69b743c12dd3]
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\CHROME|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [0aeceb450b801125df20829eec1858a8]
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\PROTOCOLS\HANDLER\PROX|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [738373bdf59677bff60a4dd434d00ff1]
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\PROTOCOLS\HANDLER\BASE64|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [b5412709bad1a5910fef6cb49173da26]
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\PROTOCOLS\HANDLER\CHROME|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [8076cf61286361d5c639f12ff014a35d]
PUP.Optional.Blabbers, HKLM\SOFTWARE\CLASSES\WOW6432NODE\PROTOCOLS\HANDLER\PROX|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [9561d25e4c3f92a4e41c8f92f3116f91]
PUP.Optional.SearchResults, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|URL, hxxp://dts.search-results.com/sr?src=ieb&appid=160&systemid=406&sr=0&q={searchTerms}, , [94628ca46d1e60d6be2acde621e3db25]
PUP.Optional.SearchQu, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SuggestionsURL_JSON, hxxp://www.searchqu.com/suggest.php?src=ieb&appid=160&systemid=406&qu={searchTerms}&ft=json, , [b6409c94c4c760d6d015773cb2520000]
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\PROTOCOLS\HANDLER\BASE64|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [65910a26cbc0979fb14d51cf44c0f10f]
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\PROTOCOLS\HANDLER\CHROME|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [857156dac3c845f1f10e38e883817b85]
PUP.Optional.Blabbers, HKLM\SOFTWARE\WOW6432NODE\CLASSES\PROTOCOLS\HANDLER\PROX|CLSID, {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}, , [36c0ee42d0bbc96d926ed34e22e2dd23]
PUP.Optional.ReMarkIt, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dcpfhaghaadpjpgocojgnlhjcieeooel|Path, C:\Program Files (x86)\Re-markit\135.crx, , [8b6b41ef1774c2745b43931d9c6820e0]
PUP.Optional.Bandoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2D7C0C1F-286A-4417-A346-5F714CDF01C4}|AppPath, C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar, , [6b8b69c7216a5dd9da1a730f0103b848]
PUP.Optional.ChatZum, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|URL, hxxp://search.chatzum.com/?q={searchTerms}, , [1fd781af3c4fb18525eab0d8e91b5ea2]
PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SuggestionsURL_JSON, hxxp://www.searchqu.com/suggest.php?src=ieb&appid=160&systemid=406&qu={searchTerms}&ft=json, , [19dd6bc56328e74f53922a89877d13ed]
PUP.Optional.ChatZum, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|TopResultURLFallback, hxxp://search.chatzum.com/?q={searchTerms}, , [718545ebfb90cd699c73e2a64bb9ce32]
PUP.Optional.SweetIM, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EEE6C360-6118-11DC-9C72-001320C79847}|URL, hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.00000, , [49ad4ee25932ec4a69aad8e34fb540c0]
PUP.Optional.BetterSurf, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|xz123@ya456.com, C:\Program Files (x86)\BetterSurf\ff, , [fcfa1c14098273c37c6be49fb74db749]
PUP.Optional.InstallBrain, HKU\S-1-5-18\SOFTWARE\WNLT|URL, MYSTART, , [d224939ddfac64d28a4b584542c201ff]
PUP.Optional.Babylon, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}|URL, hxxp://search.babylon.com/?q={searchTerms}&affID=111789&tt=060612_5_&babsrc=SP_ss&mntrId=88b2be8300000000000060d81951991c, , [f5019d937d0e80b66b5985fd57adf30d]
PUP.Optional.ChatZum, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{4C3D3E1F-361F-41E5-BCFF-545609429851}|URL, hxxp://search.chatzum.com/?q={searchTerms}, , [5f97022eacdf1b1b28e694f46b9957a9]
PUP.Optional.SofTonic, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{4C3D3E1F-361F-41E5-BCFF-545609429851}|FaviconURL, hxxp://search.softonic.com/favicon.ico, , [688e7bb51378e84e9916b9fee12358a8]
PUP.Optional.ChatZum, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{4C3D3E1F-361F-41E5-BCFF-545609429851}|TopResultURLFallback, hxxp://search.chatzum.com/?q={searchTerms}, , [d026f7390b8047ef1bf3870161a304fc]
PUP.Optional.ChatZum, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}|URL, hxxp://search.chatzum.com/?q={SearchTerms}, , [22d4d65a96f54cea54ba8800b05415eb]
PUP.Optional.SearchResults, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|URL, hxxp://dts.search-results.com/sr?src=ieb&appid=160&systemid=406&sr=0&q={searchTerms}, , [7d795ed26a211a1c8166e7cc7c88d42c]
PUP.Optional.SearchQu, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SuggestionsURL_JSON, hxxp://www.searchqu.com/suggest.php?src=ieb&appid=160&systemid=406&qu={searchTerms}&ft=json, , [e31343ede0ab4cea944e5d560ef67c84]
PUP.Optional.Incredibar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}|FaviconURL, hxxp://mystart.incredibar.com/favicon.ico, , [16e0c66a8efdd165ff40abf2ee168b75]
PUP.Optional.Incredibar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}|FaviconURLFallback, hxxp://mystart.incredibar.com/favicon.ico, , [27cf052b7d0ed16552ed287539cb2dd3]
PUP.Optional.Incredibar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}|TopResultURL, hxxp://mystart.incredibar.com/?a=6Oz926P82k&loc=skw&search={searchTerms}&i=26, , [f7ffd759c0cbbb7bd768a3fad92bc040]
PUP.Optional.Incredibar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}|TopResultURLFallback, hxxp://mystart.incredibar.com/?a=6Oz926P82k&loc=skw&search={searchTerms}&i=26, , [48aef33de9a2c571cb74465746bea957]
PUP.Optional.Incredibar, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}|URL, hxxp://mystart.incredibar.com/?a=6Oz926P82k&loc=skw&search={searchTerms}&i=26, , [7284121ecbc075c1023d8716fe06d927]
PUP.Optional.SweetIM, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EEE6C360-6118-11DC-9C72-001320C79847}|URL, hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.00000, , [966049e77d0e53e3e926bcff3ec64cb4]
PUP.Optional.MarkIt, HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{e55007f4-80c5-418e-ac33-10c4d60db01e}, C:\Program Files (x86)\Re-markit\135.xpi, , [63938da36b202a0cd385089a897bc23e]

Registrierungsdaten: 2
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[6096a888d3b8f64012f33e2f2ed7e51b]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[3bbb1f117219e0568c7977f60cf9da26]

Ordner: 14
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.OpenCandy, C:\Users\metro\AppData\Roaming\OpenCandy, , [6393b27e3b507fb7caa0cd2a48baa65a],
PUP.Optional.OpenCandy, C:\Users\metro\AppData\Roaming\OpenCandy\8866007A9DB444E7B69782F847BF97A0, , [6393b27e3b507fb7caa0cd2a48baa65a],
PUP.Optional.Babylon, C:\Users\metro\AppData\LocalLow\BabylonToolbar, , [cf279d935239c86e402040c2f11211ef],
PUP.Optional.Babylon, C:\Users\metro\AppData\LocalLow\BabylonToolbar\BabylonToolbar, , [cf279d935239c86e402040c2f11211ef],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.DataMngr, C:\Users\metro\AppData\LocalLow\DataMngr, , [c23418181774fc3aad1947c7d42f5aa6],
PUP.Optional.Incredibar, C:\Users\metro\AppData\LocalLow\Incredibar.com, , [8f6750e0078458de903266af2fd4a759],
PUP.Optional.Incredibar, C:\Users\metro\AppData\LocalLow\Incredibar.com\incredibar, , [8f6750e0078458de903266af2fd4a759],
PUP.Optional.SearchQu, C:\Users\metro\AppData\LocalLow\searchquband, , [f10544ece7a4c076a6d35dc4c93a50b0],
PUP.Optional.Babylon, C:\ProgramData\Babylon, , [0de963cde7a4b185cd8e0e1c40c311ef],
PUP.Optional.Babylon, C:\Users\metro\AppData\Roaming\Babylon, , [56a05cd42c5f50e65506c763f40ff10f],

Dateien: 62
PUP.Optional.SweetPacks, C:\Program Files\~Web Assistant\ExtensionUpdaterService.exe, , [b0469f91f695ed496fe7645bd03152ae],
PUP.Optional.AdPeak, C:\Windows\System32\drivers\netfilter64.sys, , [f8fe121e9af1ad896be16f34d530e11f],
RiskWare.MisusedLegit.AI, C:\Users\metro\VOKYV\498875.exe, , [43b31a16f09bb482efdb9846eb16cc34],
PUP.Optional.MyStartSearch.ShrtCln, C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\searchplugins\MyStart Search.xml, , [fdf97eb22863c472ad8bb294a95af60a],
PUP.Optional.Boost, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.boostsaves.com_0.localstorage, , [ea0c5fd1612a5dd926a2ee963dc75da3],
PUP.Optional.Boost, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.boostsaves.com_0.localstorage-journal, , [fef8c66ad2b9e056cbfd9ce8bf45c838],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_baodmgdpdoelldjmkhknbolcldnfjegg_0.localstorage, , [3db940f09fece45219c84c4048bcbb45],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_baodmgdpdoelldjmkhknbolcldnfjegg_0.localstorage-journal, , [d5210c242c5fec4ab32e820a82829a66],
PUP.Optional.DealPly, C:\Windows\System32\Tasks\DealPly, , [e90dff314a41082ee588a8e8c143cf31],
PUP.Optional.Sanbreel, C:\Windows\System32\drivers\{c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64.sys, , [6e8848e80f7ccb6b1ae2f2bf768e03fd],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\BCHelper.exe, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\fix2.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\fix3.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\fix4.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\icon.png, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\jquery4toolbar.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\lock.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\witapi.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\witmain.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\wittoolbar.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\witwidgetapi.js, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\0324adea3b6ec02af09ea4ae9424591b, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\0324adea3b6ec02af09ea4ae9424591b_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\2a86ac4f3322238b4f27d14a09839275, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\2a86ac4f3322238b4f27d14a09839275_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\2e74403c227112bec523796d5a77d77e, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\2e74403c227112bec523796d5a77d77e_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\3b507b6d0186efd3615b9b9233c5f708, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\3b507b6d0186efd3615b9b9233c5f708_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\3f4c369984312570237a35269aa95f36, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\3f4c369984312570237a35269aa95f36_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\4d3d10bd28ff623813254a49b26be41f, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\4d3d10bd28ff623813254a49b26be41f_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\e919434ec29526b28593c426e4264271, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\e919434ec29526b28593c426e4264271_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\f03527c67e08602d2e4c18ae7867300d, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\f03527c67e08602d2e4c18ae7867300d_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\fa74672918974682c82b8d91dfbe0d6b, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\fa74672918974682c82b8d91dfbe0d6b_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\ff4d692d5e7cccbc4b3e9ef4062b1c6f, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\ff4d692d5e7cccbc4b3e9ef4062b1c6f_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\82b4f0c1e811cd6734e34efd57aeb8b4, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\82b4f0c1e811cd6734e34efd57aeb8b4_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\8ffbb13aa6f702b0cafab391f90d1db7, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\8ffbb13aa6f702b0cafab391f90d1db7_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\95e27106b94ddbdcca97c33f02110074, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\95e27106b94ddbdcca97c33f02110074_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\a35ec2adf572a908b47081c94acefc6d, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\a35ec2adf572a908b47081c94acefc6d_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\dc6668d28979688b1e2066d1dcaef0f6, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.Blabbers, C:\Users\metro\AppData\LocalLow\bbrs_002.tb\content\cache\dc6668d28979688b1e2066d1dcaef0f6_expire, , [9264022eb4d72d09e0dd886e5aa842be],
PUP.Optional.OpenCandy, C:\Users\metro\AppData\Roaming\OpenCandy\8866007A9DB444E7B69782F847BF97A0\TuneUpUtilities2013-2200217_de-DE.exe, , [6393b27e3b507fb7caa0cd2a48baa65a],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg\000020.ldb, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg\000022.ldb, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg\000023.log, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg\CURRENT, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg\LOCK, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg\LOG, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg\LOG.old, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\baodmgdpdoelldjmkhknbolcldnfjegg\MANIFEST-000021, , [55a11f11ff8c86b00cdb45c7976cbd43],
PUP.Optional.Babylon, C:\Users\metro\AppData\Roaming\Babylon\log_file.txt, , [56a05cd42c5f50e65506c763f40ff10f],
PUP.Optional.CrossRider, C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.crossrider.bic", "1427a981730b3918df5ced95769dffb4");), ,[886e10204c3f96a070e5bceaa95cd828]

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)

0rbit 17.09.2015 15:04
FRST Logfile:
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:15-09-2015
durchgeführt von metro (Administrator) auf ICH_MAG_FLUGZEU (17-09-2015 15:01:39)
Gestartet von C:\Users\metro\Desktop
Geladene Profile: metro (Verfügbare Profile: metro & DefaultAppPool)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Cristi) C:\Program Files (x86)\Dual Monitor\DualMonitor.exe
(Spotify Ltd) C:\Users\metro\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Roccat GmbH) C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM-x32\...\Run: [RoccatKova+] => C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE [539688 2011-03-17] (Roccat GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-08-26] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66936 2015-08-13] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [dualmonitor] => C:\Program Files (x86)\Dual Monitor\DualMonitor.exe [478720 2013-02-18] (Cristi)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Spotify Web Helper] => C:\Users\metro\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-09-16] (Spotify Ltd)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Spotify] => C:\Users\metro\AppData\Roaming\Spotify\Spotify.exe [7535672 2015-09-16] (Spotify Ltd)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2899136 2015-08-19] (Valve Corporation)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{2AAD8167-C512-413D-AA3A-7828A6BB2078}: [DhcpNameServer] 192.168.192.1
Tcpip\..\Interfaces\{7302275D-D8D7-44EF-8A52-93C55917C0C9}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8C1455D7-177E-4384-89A6-E2BB602F0F79}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> DefaultScope {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL =
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll [2011-05-05] (HP)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-10-22] (Oracle Corporation)
BHO-x32: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll [2011-05-05] (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-03-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-22] (Oracle Corporation)
Toolbar: HKLM - Kein Name - !{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
Toolbar: HKLM - Kein Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} -  Keine Datei
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-03-21] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-18] ()
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll [Keine Datei]
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [Keine Datei]
FF Plugin: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelogx64.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-14] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-18] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [Keine Datei]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelog.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-22] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-4066131180-3669703069-1695776857-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll Keine Datei
FF Plugin HKU\S-1-5-21-4066131180-3669703069-1695776857-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-18] ()
FF Extension: Avira Browser Safety - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\abs@avira.com [2015-08-22]
FF Extension: Better Battlelog (BBLog) - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\jid1-qQSMEVsYTOjgYA@jetpack [2015-03-30]
FF Extension: YouTube Unblocker - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\youtubeunblocker@unblocker.yt [2015-08-22]
FF Extension: Adblock Plus - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-16]
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2014-03-19]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-11]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2014-02-15] <==== ACHTUNG

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.youtube.com/feed/subscriptions","hxxps://www.facebook.com/","hxxps://twitter.com/","hxxps://www.google.de/"
CHR Profile: C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-09-13]
CHR Extension: (Google Drive) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-22]
CHR Extension: (YouTube) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-22]
CHR Extension: (Adblock Plus) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-22]
CHR Extension: (Steam inventory helper) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl [2015-03-05]
CHR Extension: (Google-Suche) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-22]
CHR Extension: (Black & white Thema) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmohofkmppcgglcmlccpbokkkefigipi [2015-05-25]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-05]
CHR Extension: (Vulcun Start Page) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkbinkdlcdmndhcjohbhkiplacebeilk [2015-09-06]
CHR Extension: (Better Battlelog (BBLog)) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjlfnjepjdmlppapoikepbaabbghofma [2013-11-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-25]
CHR Extension: (Google Mail) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-22]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\metro\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-04-14]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-08-26] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-08-26] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-08-26] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [228104 2015-08-13] (Avira Operations GmbH & Co. KG)
S4 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
S4 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2014-01-28] ()
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [Datei ist nicht signiert]
S4 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2372096 2011-02-19] (Realsil Microelectronics Inc.) [Datei ist nicht signiert]
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-21] (Microsoft Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2007048 2015-07-29] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-28] ()
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
S2 RzMaelstromVADStreamingService; "C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 AndNetDiag2; C:\Windows\System32\DRIVERS\lgandnetdiag264.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-02-01] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2012-04-25] (AVM Berlin)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-17] (Avira Operations GmbH & Co. KG)
R3 CORK70; C:\Windows\System32\drivers\CORK70.sys [25600 2012-10-31] ( )
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 fwlanusb5; C:\Windows\System32\DRIVERS\fwlanusb5.sys [982784 2012-08-21] (AVM GmbH)
S3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] () [Datei ist nicht signiert]
S3 KovaPlusFltr; C:\Windows\System32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-02-01] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S3 MobileAdapter; C:\Windows\System32\DRIVERS\qscvusb.sys [118016 2009-03-10] (QUALCOMM Incorporated)
S3 RZMAELSTROMVADService; C:\Windows\System32\drivers\RzMaelstromVAD.sys [32768 2014-06-09] (Windows (R) Win 7 DDK provider)
S3 WinRing0_1_2_0; C:\Program Files (x86)\ThrottleStop_500\WinRing0x64.sys [14544 2008-07-26] (OpenLibSys.org)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NLNdisMP; system32\DRIVERS\nlndis.sys [X]
S3 NLNdisPT; system32\DRIVERS\nlndis.sys [X]
S3 pmem; \??\C:\Users\metro\AppData\Local\Temp\_MEI27242\drivers\winpmem64.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-09-17 15:01 - 2015-09-17 15:03 - 00024121 _____ C:\Users\metro\Desktop\FRST.txt
2015-09-17 14:43 - 2015-09-17 14:45 - 00000000 ____D C:\AdwCleaner
2015-09-17 14:26 - 2015-09-17 14:26 - 01660416 _____ C:\Users\metro\Desktop\AdwCleaner_5.007.exe
2015-09-17 14:18 - 2015-09-17 14:19 - 00040634 _____ C:\Users\metro\Desktop\anti malware.txt
2015-09-17 13:14 - 2015-09-17 14:22 - 00001060 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-09-17 13:14 - 2015-09-17 13:16 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-17 13:14 - 2015-09-17 13:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-09-17 13:14 - 2015-09-17 13:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-17 13:14 - 2015-09-17 13:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-09-17 13:14 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-17 13:14 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-17 13:14 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-17 13:12 - 2015-09-17 13:13 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\metro\Desktop\mbam-setup-2.1.8.1057.exe
2015-09-17 11:22 - 2015-09-17 11:22 - 00027959 _____ C:\ComboFix.txt
2015-09-17 10:57 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-09-17 10:57 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-09-17 10:57 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-09-17 09:51 - 2015-09-17 09:42 - 05635119 ____R (Swearware) C:\Users\metro\Downloads\ComboFix.exe
2015-09-17 09:45 - 2015-09-17 11:22 - 00000000 ____D C:\Qoobox
2015-09-17 09:42 - 2015-09-17 11:21 - 00000000 ____D C:\Windows\erdnt
2015-09-17 09:41 - 2015-09-17 09:42 - 05635119 ____R (Swearware) C:\Users\metro\Desktop\ComboFix.exe
2015-09-16 21:05 - 2015-09-17 15:01 - 00000000 ____D C:\FRST
2015-09-16 21:05 - 2015-09-16 21:05 - 02191360 _____ (Farbar) C:\Users\metro\Desktop\FRST64.exe
2015-09-16 19:29 - 2015-09-16 20:44 - 00001895 _____ C:\Users\metro\Desktop\Neues Textdokument (2).txt
2015-09-16 18:25 - 2015-09-16 16:07 - 00011436 _____ C:\Users\metro\Desktop\config.cfg
2015-09-16 18:21 - 2015-09-16 18:22 - 01476720 _____ C:\Users\metro\Downloads\SteamSetup.exe
2015-09-16 18:06 - 2015-09-16 18:06 - 00000000 ____D C:\Users\metro\048298C9A4D3490B9FF9AB023A9238F3.TMP
2015-09-14 17:42 - 2015-09-14 17:42 - 00004377 _____ C:\Users\metro\Downloads\newf0restcfg.rar
2015-09-05 23:05 - 2013-08-09 20:20 - 00031232 _____ (Party Princess Palace) C:\Users\metro\Downloads\SAM.API.dll
2015-09-04 19:47 - 2015-09-04 19:47 - 00002291 _____ C:\Users\metro\Downloads\csgo_bananagaming.7z
2015-08-25 18:14 - 2015-08-25 18:14 - 00000000 ____D C:\Users\metro\AppData\Roaming\LolClient
2015-08-25 00:48 - 2015-08-25 00:48 - 00005100 _____ C:\Users\metro\Downloads\bibanator config Januar 2015.rar
2015-08-24 22:20 - 2015-08-24 22:20 - 00079716 _____ C:\Users\metro\Downloads\nooky-cfg-06-2015.zip
2015-08-19 00:04 - 2015-08-19 21:22 - 00000000 ____D C:\Users\metro\AppData\Local\The Witcher
2015-08-19 00:04 - 2015-08-19 00:48 - 00000000 ____D C:\Users\metro\Documents\The Witcher
2015-08-19 00:02 - 2015-08-19 23:06 - 00000000 ____D C:\Users\metro\AppData\Local\SniperV2

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-09-17 15:03 - 2012-03-29 19:34 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-17 15:00 - 2015-07-30 21:55 - 00000000 ____D C:\Users\metro\AppData\Roaming\Spotify
2015-09-17 15:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\inetsrv
2015-09-17 14:59 - 2015-07-30 21:57 - 00000000 ____D C:\Users\metro\AppData\Local\Spotify
2015-09-17 14:59 - 2013-06-23 11:59 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-09-17 14:59 - 2012-03-02 20:30 - 00000000 ____D C:\Program Files (x86)\Steam
2015-09-17 14:58 - 2013-11-22 18:55 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-17 14:58 - 2010-11-21 05:47 - 02291564 _____ C:\Windows\PFRO.log
2015-09-17 14:58 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-17 14:58 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-17 14:58 - 2009-07-14 06:51 - 00200544 _____ C:\Windows\setupact.log
2015-09-17 14:57 - 2011-09-23 01:41 - 01549288 _____ C:\Windows\WindowsUpdate.log
2015-09-17 14:53 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-17 14:53 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-17 14:50 - 2013-11-22 18:55 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-17 14:50 - 2012-01-16 23:07 - 00000008 __RSH C:\Users\metro\ntuser.pol
2015-09-17 14:50 - 2011-12-17 17:14 - 00000000 ____D C:\Users\metro
2015-09-17 14:22 - 2015-07-14 21:14 - 00001607 _____ C:\Users\Public\Desktop\League of Legends.lnk
2015-09-17 14:22 - 2015-07-03 18:59 - 00001113 _____ C:\Users\Public\Desktop\Hearthstone.lnk
2015-09-17 14:22 - 2015-07-03 18:56 - 00001076 _____ C:\Users\Public\Desktop\Battle.net.lnk
2015-09-17 14:22 - 2015-02-13 19:21 - 00000817 _____ C:\Users\Public\Desktop\ESL Wire.lnk
2015-09-17 14:22 - 2015-01-17 11:24 - 00001737 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-09-17 14:22 - 2014-04-07 11:28 - 00000996 _____ C:\Users\Public\Desktop\Traktor 2.lnk
2015-09-17 14:22 - 2014-03-09 21:23 - 00000928 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2015-09-17 14:22 - 2013-11-16 13:37 - 00001111 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-09-17 14:22 - 2013-11-05 20:15 - 00002026 _____ C:\Users\Public\Desktop\FL Studio 11.lnk
2015-09-17 14:22 - 2013-11-05 20:13 - 00002044 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FL Studio 11.lnk
2015-09-17 14:22 - 2013-04-03 20:29 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 2.0.lnk
2015-09-17 14:22 - 2012-07-30 15:37 - 00001011 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2015-09-17 14:22 - 2012-06-12 16:11 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-09-17 14:22 - 2012-03-02 20:30 - 00000921 _____ C:\Users\Public\Desktop\Steam.lnk
2015-09-17 14:22 - 2012-01-12 17:05 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-09-17 14:22 - 2011-12-17 17:15 - 00002205 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MusicStation.lnk
2015-09-17 14:22 - 2011-09-23 01:34 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2015-09-17 14:22 - 2011-09-23 01:34 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2015-09-17 14:22 - 2011-07-15 22:14 - 00001293 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
2015-09-17 14:22 - 2011-07-15 22:13 - 00001446 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-09-17 14:22 - 2011-07-15 22:13 - 00001362 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
2015-09-17 14:22 - 2011-07-15 22:12 - 00002474 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2015-09-17 14:22 - 2011-07-15 22:09 - 00002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2010.lnk
2015-09-17 14:22 - 2009-07-14 06:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-09-17 14:22 - 2009-07-14 06:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
2015-09-17 14:22 - 2009-07-14 06:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2015-09-17 14:22 - 2009-07-14 06:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2015-09-17 14:22 - 2009-07-14 06:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2015-09-17 14:21 - 2015-07-30 21:57 - 00001812 _____ C:\Users\metro\Desktop\Spotify.lnk
2015-09-17 14:21 - 2015-07-30 21:57 - 00001798 _____ C:\Users\metro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-09-17 14:21 - 2015-06-11 16:21 - 00002066 _____ C:\Users\metro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RuneScape.lnk
2015-09-17 14:21 - 2015-06-11 16:21 - 00002036 _____ C:\Users\metro\Desktop\RuneScape.lnk
2015-09-17 14:21 - 2015-05-29 19:25 - 00000366 _____ C:\Users\metro\Desktop\Intel® Grafik und Medien.lnk
2015-09-17 14:21 - 2015-01-03 21:18 - 00000196 _____ C:\Users\metro\Desktop\SRS Premium Sound.lnk
2015-09-17 14:21 - 2014-11-24 18:17 - 00001521 _____ C:\Users\metro\Desktop\CINEMA 4D.lnk
2015-09-17 14:21 - 2014-11-23 14:50 - 00006046 _____ C:\Users\metro\Desktop\ctcp - Verknüpfung.lnk
2015-09-17 14:21 - 2014-10-30 19:57 - 00001758 _____ C:\Users\metro\Desktop\BF3 Settings Editor.lnk
2015-09-17 14:21 - 2014-08-31 20:24 - 00003210 _____ C:\Users\metro\Desktop\FTB_Launcher.lnk
2015-09-17 14:21 - 2014-06-20 18:52 - 00001518 _____ C:\Users\metro\Desktop\ThrottleStop.lnk
2015-09-17 14:21 - 2014-04-18 23:12 - 00002287 _____ C:\ProgramData\Microsoft\Windows\Start Menu\FXAA Tool.lnk
2015-09-17 14:21 - 2014-04-15 15:18 - 00002261 _____ C:\Users\metro\Desktop\Skyrim (SKSE).lnk
2015-09-17 14:21 - 2014-02-03 23:58 - 00002070 _____ C:\Users\metro\Desktop\BFHD 1942.lnk
2015-09-17 14:21 - 2014-01-18 20:05 - 00002717 _____ C:\Users\metro\Desktop\Microsoft Office Excel 2003.lnk
2015-09-17 14:21 - 2014-01-18 20:05 - 00002685 _____ C:\Users\metro\Desktop\Microsoft Office Word 2003.lnk
2015-09-17 14:21 - 2013-09-25 18:10 - 00001814 _____ C:\Users\metro\Desktop\age of empire.lnk
2015-09-17 14:21 - 2013-06-20 20:14 - 00000983 _____ C:\Users\metro\Desktop\Origin.lnk
2015-09-17 14:21 - 2012-08-21 16:01 - 00000572 _____ C:\Users\metro\Desktop\Fraps.lnk
2015-09-17 14:21 - 2012-01-24 14:44 - 00000000 ____D C:\Users\metro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-09-17 14:21 - 2012-01-17 18:26 - 00000983 _____ C:\Users\metro\Desktop\WinRAR.lnk
2015-09-17 14:21 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-09-17 14:21 - 2009-07-14 07:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2015-09-17 14:21 - 2009-07-14 06:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2015-09-17 14:20 - 2013-11-30 11:45 - 00000000 __SHD C:\Users\metro\VOKYV
2015-09-17 11:24 - 2014-08-23 22:32 - 00000000 ____D C:\Users\metro\AppData\Local\Apps\2.0
2015-09-17 11:22 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-09-17 11:15 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-09-17 09:33 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-09-16 19:46 - 2012-05-29 13:49 - 00000000 ____D C:\Users\metro\AppData\Roaming\TS3Client
2015-09-16 19:29 - 2012-05-11 16:15 - 00009762 _____ C:\Users\metro\Desktop\alles.txt
2015-09-16 18:24 - 2012-03-02 20:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-09-16 16:26 - 2014-09-17 16:22 - 00004837 _____ C:\Users\metro\Desktop\autoexec.cfg
2015-09-16 15:45 - 2013-11-22 18:55 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-16 15:45 - 2013-11-22 18:55 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-15 19:06 - 2012-07-01 17:35 - 00000000 ____D C:\Users\metro\AppData\Local\Google
2015-09-15 17:44 - 2013-01-31 19:54 - 00003186 _____ C:\Windows\System32\Tasks\HPCeeScheduleFormetro
2015-09-15 17:44 - 2013-01-31 19:54 - 00000332 _____ C:\Windows\Tasks\HPCeeScheduleFormetro.job
2015-09-14 18:06 - 2012-01-25 00:25 - 00000000 ____D C:\Users\metro\AppData\Local\CrashDumps
2015-09-13 21:54 - 2011-07-15 22:11 - 00732534 _____ C:\Windows\DirectX.log
2015-09-12 17:14 - 2014-12-07 14:54 - 00000000 ____D C:\Users\metro\Desktop\Cloud Downloader 2.3
2015-09-10 14:41 - 2013-10-04 21:46 - 00000000 ____D C:\ProgramData\Package Cache
2015-09-09 23:14 - 2015-03-29 15:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-09-06 20:07 - 2015-07-03 18:59 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2015-09-06 20:05 - 2014-01-01 17:08 - 00000000 ____D C:\Users\metro\AppData\Local\Battle.net
2015-09-06 20:04 - 2015-07-03 18:56 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-08-26 15:43 - 2012-05-29 13:47 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2015-08-18 17:03 - 2012-03-29 19:34 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-18 17:03 - 2012-03-29 19:34 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-18 17:03 - 2011-07-15 22:03 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2013-08-08 14:56 - 2014-01-05 15:35 - 0059904 ___SH () C:\Users\metro\AppData\Roaming\Thumbs.db
2012-12-22 23:55 - 2014-02-22 13:21 - 0023121 _____ () C:\Users\metro\AppData\Roaming\UserTile.png
2013-12-19 15:59 - 2014-01-15 16:36 - 0000088 _____ () C:\Users\metro\AppData\Roaming\WB.CFG
2012-03-31 17:18 - 2014-02-18 20:46 - 0005632 _____ () C:\Users\metro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-01-23 21:46 - 2012-01-23 21:46 - 0000093 _____ () C:\Users\metro\AppData\Local\fusioncache.dat
2012-11-30 15:43 - 2013-01-26 22:03 - 0000600 _____ () C:\Users\metro\AppData\Local\PUTTY.RND
2012-01-29 00:12 - 2013-12-21 16:23 - 0007595 _____ () C:\Users\metro\AppData\Local\Resmon.ResmonCfg
2012-06-14 14:22 - 2012-04-15 14:22 - 0000032 ____R () C:\ProgramData\hash.dat
2012-11-10 19:11 - 2012-11-10 19:20 - 0001039 _____ () C:\ProgramData\VodafoneConnectorService.log

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\ProgramData\hash.dat


Einige Dateien in TEMP:
====================
C:\Users\metro\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-09-03 19:25

==================== Ende von FRST.txt ============================
--- --- ---



FRST Logfile:
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:15-09-2015
durchgeführt von metro (Administrator) auf ICH_MAG_FLUGZEU (17-09-2015 15:01:39)
Gestartet von C:\Users\metro\Desktop
Geladene Profile: metro (Verfügbare Profile: metro & DefaultAppPool)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forum

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Cristi) C:\Program Files (x86)\Dual Monitor\DualMonitor.exe
(Spotify Ltd) C:\Users\metro\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Roccat GmbH) C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM-x32\...\Run: [RoccatKova+] => C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE [539688 2011-03-17] (Roccat GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-08-26] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66936 2015-08-13] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [dualmonitor] => C:\Program Files (x86)\Dual Monitor\DualMonitor.exe [478720 2013-02-18] (Cristi)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Spotify Web Helper] => C:\Users\metro\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-09-16] (Spotify Ltd)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Spotify] => C:\Users\metro\AppData\Roaming\Spotify\Spotify.exe [7535672 2015-09-16] (Spotify Ltd)
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2899136 2015-08-19] (Valve Corporation)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{2AAD8167-C512-413D-AA3A-7828A6BB2078}: [DhcpNameServer] 192.168.192.1
Tcpip\..\Interfaces\{7302275D-D8D7-44EF-8A52-93C55917C0C9}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8C1455D7-177E-4384-89A6-E2BB602F0F79}: [DhcpNameServer] 192.168.2.1

Internet Explorer:
==================
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> DefaultScope {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL =
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-4066131180-3669703069-1695776857-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll [2011-05-05] (HP)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-10-22] (Oracle Corporation)
BHO-x32: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll [2011-05-05] (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-03-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-22] (Oracle Corporation)
Toolbar: HKLM - Kein Name - !{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
Toolbar: HKLM - Kein Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} -  Keine Datei
Toolbar: HKLM-x32 - Kein Name - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} -  Keine Datei
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21] (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-03-21] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-18] ()
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll [Keine Datei]
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [Keine Datei]
FF Plugin: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelogx64.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-14] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-18] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [Keine Datei]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelog.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-22] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-4066131180-3669703069-1695776857-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll Keine Datei
FF Plugin HKU\S-1-5-21-4066131180-3669703069-1695776857-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-18] ()
FF Extension: Avira Browser Safety - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\abs@avira.com [2015-08-22]
FF Extension: Better Battlelog (BBLog) - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\jid1-qQSMEVsYTOjgYA@jetpack [2015-03-30]
FF Extension: YouTube Unblocker - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\youtubeunblocker@unblocker.yt [2015-08-22]
FF Extension: Adblock Plus - C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-16]
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2014-03-19]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-11]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2014-02-15] <==== ACHTUNG

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.youtube.com/feed/subscriptions","hxxps://www.facebook.com/","hxxps://twitter.com/","hxxps://www.google.de/"
CHR Profile: C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-09-13]
CHR Extension: (Google Drive) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-22]
CHR Extension: (YouTube) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-22]
CHR Extension: (Adblock Plus) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-22]
CHR Extension: (Steam inventory helper) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl [2015-03-05]
CHR Extension: (Google-Suche) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-22]
CHR Extension: (Black & white Thema) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmohofkmppcgglcmlccpbokkkefigipi [2015-05-25]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-05]
CHR Extension: (Vulcun Start Page) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkbinkdlcdmndhcjohbhkiplacebeilk [2015-09-06]
CHR Extension: (Better Battlelog (BBLog)) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjlfnjepjdmlppapoikepbaabbghofma [2013-11-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-25]
CHR Extension: (Google Mail) - C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-22]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\metro\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-04-14]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-08-26] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-08-26] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-08-26] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [228104 2015-08-13] (Avira Operations GmbH & Co. KG)
S4 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
S4 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2014-01-28] ()
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [Datei ist nicht signiert]
S4 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2372096 2011-02-19] (Realsil Microelectronics Inc.) [Datei ist nicht signiert]
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-21] (Microsoft Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2007048 2015-07-29] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-28] ()
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
S2 RzMaelstromVADStreamingService; "C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 AndNetDiag2; C:\Windows\System32\DRIVERS\lgandnetdiag264.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-02-01] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2012-04-25] (AVM Berlin)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-17] (Avira Operations GmbH & Co. KG)
R3 CORK70; C:\Windows\System32\drivers\CORK70.sys [25600 2012-10-31] ( )
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 fwlanusb5; C:\Windows\System32\DRIVERS\fwlanusb5.sys [982784 2012-08-21] (AVM GmbH)
S3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] () [Datei ist nicht signiert]
S3 KovaPlusFltr; C:\Windows\System32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-02-01] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S3 MobileAdapter; C:\Windows\System32\DRIVERS\qscvusb.sys [118016 2009-03-10] (QUALCOMM Incorporated)
S3 RZMAELSTROMVADService; C:\Windows\System32\drivers\RzMaelstromVAD.sys [32768 2014-06-09] (Windows (R) Win 7 DDK provider)
S3 WinRing0_1_2_0; C:\Program Files (x86)\ThrottleStop_500\WinRing0x64.sys [14544 2008-07-26] (OpenLibSys.org)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NLNdisMP; system32\DRIVERS\nlndis.sys [X]
S3 NLNdisPT; system32\DRIVERS\nlndis.sys [X]
S3 pmem; \??\C:\Users\metro\AppData\Local\Temp\_MEI27242\drivers\winpmem64.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-09-17 15:01 - 2015-09-17 15:03 - 00024121 _____ C:\Users\metro\Desktop\FRST.txt
2015-09-17 14:43 - 2015-09-17 14:45 - 00000000 ____D C:\AdwCleaner
2015-09-17 14:26 - 2015-09-17 14:26 - 01660416 _____ C:\Users\metro\Desktop\AdwCleaner_5.007.exe
2015-09-17 14:18 - 2015-09-17 14:19 - 00040634 _____ C:\Users\metro\Desktop\anti malware.txt
2015-09-17 13:14 - 2015-09-17 14:22 - 00001060 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-09-17 13:14 - 2015-09-17 13:16 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-17 13:14 - 2015-09-17 13:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-09-17 13:14 - 2015-09-17 13:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-17 13:14 - 2015-09-17 13:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-09-17 13:14 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-17 13:14 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-17 13:14 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-17 13:12 - 2015-09-17 13:13 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\metro\Desktop\mbam-setup-2.1.8.1057.exe
2015-09-17 11:22 - 2015-09-17 11:22 - 00027959 _____ C:\ComboFix.txt
2015-09-17 10:57 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-09-17 10:57 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-09-17 10:57 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-09-17 10:57 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-09-17 09:51 - 2015-09-17 09:42 - 05635119 ____R (Swearware) C:\Users\metro\Downloads\ComboFix.exe
2015-09-17 09:45 - 2015-09-17 11:22 - 00000000 ____D C:\Qoobox
2015-09-17 09:42 - 2015-09-17 11:21 - 00000000 ____D C:\Windows\erdnt
2015-09-17 09:41 - 2015-09-17 09:42 - 05635119 ____R (Swearware) C:\Users\metro\Desktop\ComboFix.exe
2015-09-16 21:05 - 2015-09-17 15:01 - 00000000 ____D C:\FRST
2015-09-16 21:05 - 2015-09-16 21:05 - 02191360 _____ (Farbar) C:\Users\metro\Desktop\FRST64.exe
2015-09-16 19:29 - 2015-09-16 20:44 - 00001895 _____ C:\Users\metro\Desktop\Neues Textdokument (2).txt
2015-09-16 18:25 - 2015-09-16 16:07 - 00011436 _____ C:\Users\metro\Desktop\config.cfg
2015-09-16 18:21 - 2015-09-16 18:22 - 01476720 _____ C:\Users\metro\Downloads\SteamSetup.exe
2015-09-16 18:06 - 2015-09-16 18:06 - 00000000 ____D C:\Users\metro\048298C9A4D3490B9FF9AB023A9238F3.TMP
2015-09-14 17:42 - 2015-09-14 17:42 - 00004377 _____ C:\Users\metro\Downloads\newf0restcfg.rar
2015-09-05 23:05 - 2013-08-09 20:20 - 00031232 _____ (Party Princess Palace) C:\Users\metro\Downloads\SAM.API.dll
2015-09-04 19:47 - 2015-09-04 19:47 - 00002291 _____ C:\Users\metro\Downloads\csgo_bananagaming.7z
2015-08-25 18:14 - 2015-08-25 18:14 - 00000000 ____D C:\Users\metro\AppData\Roaming\LolClient
2015-08-25 00:48 - 2015-08-25 00:48 - 00005100 _____ C:\Users\metro\Downloads\bibanator config Januar 2015.rar
2015-08-24 22:20 - 2015-08-24 22:20 - 00079716 _____ C:\Users\metro\Downloads\nooky-cfg-06-2015.zip
2015-08-19 00:04 - 2015-08-19 21:22 - 00000000 ____D C:\Users\metro\AppData\Local\The Witcher
2015-08-19 00:04 - 2015-08-19 00:48 - 00000000 ____D C:\Users\metro\Documents\The Witcher
2015-08-19 00:02 - 2015-08-19 23:06 - 00000000 ____D C:\Users\metro\AppData\Local\SniperV2

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-09-17 15:03 - 2012-03-29 19:34 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-17 15:00 - 2015-07-30 21:55 - 00000000 ____D C:\Users\metro\AppData\Roaming\Spotify
2015-09-17 15:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\inetsrv
2015-09-17 14:59 - 2015-07-30 21:57 - 00000000 ____D C:\Users\metro\AppData\Local\Spotify
2015-09-17 14:59 - 2013-06-23 11:59 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-09-17 14:59 - 2012-03-02 20:30 - 00000000 ____D C:\Program Files (x86)\Steam
2015-09-17 14:58 - 2013-11-22 18:55 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-17 14:58 - 2010-11-21 05:47 - 02291564 _____ C:\Windows\PFRO.log
2015-09-17 14:58 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-17 14:58 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-17 14:58 - 2009-07-14 06:51 - 00200544 _____ C:\Windows\setupact.log
2015-09-17 14:57 - 2011-09-23 01:41 - 01549288 _____ C:\Windows\WindowsUpdate.log
2015-09-17 14:53 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-17 14:53 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-17 14:50 - 2013-11-22 18:55 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-17 14:50 - 2012-01-16 23:07 - 00000008 __RSH C:\Users\metro\ntuser.pol
2015-09-17 14:50 - 2011-12-17 17:14 - 00000000 ____D C:\Users\metro
2015-09-17 14:22 - 2015-07-14 21:14 - 00001607 _____ C:\Users\Public\Desktop\League of Legends.lnk
2015-09-17 14:22 - 2015-07-03 18:59 - 00001113 _____ C:\Users\Public\Desktop\Hearthstone.lnk
2015-09-17 14:22 - 2015-07-03 18:56 - 00001076 _____ C:\Users\Public\Desktop\Battle.net.lnk
2015-09-17 14:22 - 2015-02-13 19:21 - 00000817 _____ C:\Users\Public\Desktop\ESL Wire.lnk
2015-09-17 14:22 - 2015-01-17 11:24 - 00001737 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-09-17 14:22 - 2014-04-07 11:28 - 00000996 _____ C:\Users\Public\Desktop\Traktor 2.lnk
2015-09-17 14:22 - 2014-03-09 21:23 - 00000928 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2015-09-17 14:22 - 2013-11-16 13:37 - 00001111 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-09-17 14:22 - 2013-11-05 20:15 - 00002026 _____ C:\Users\Public\Desktop\FL Studio 11.lnk
2015-09-17 14:22 - 2013-11-05 20:13 - 00002044 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FL Studio 11.lnk
2015-09-17 14:22 - 2013-04-03 20:29 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 2.0.lnk
2015-09-17 14:22 - 2012-07-30 15:37 - 00001011 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2015-09-17 14:22 - 2012-06-12 16:11 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-09-17 14:22 - 2012-03-02 20:30 - 00000921 _____ C:\Users\Public\Desktop\Steam.lnk
2015-09-17 14:22 - 2012-01-12 17:05 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-09-17 14:22 - 2011-12-17 17:15 - 00002205 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MusicStation.lnk
2015-09-17 14:22 - 2011-09-23 01:34 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2015-09-17 14:22 - 2011-09-23 01:34 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2015-09-17 14:22 - 2011-07-15 22:14 - 00001293 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
2015-09-17 14:22 - 2011-07-15 22:13 - 00001446 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-09-17 14:22 - 2011-07-15 22:13 - 00001362 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
2015-09-17 14:22 - 2011-07-15 22:12 - 00002474 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2015-09-17 14:22 - 2011-07-15 22:09 - 00002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2010.lnk
2015-09-17 14:22 - 2009-07-14 06:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-09-17 14:22 - 2009-07-14 06:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
2015-09-17 14:22 - 2009-07-14 06:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2015-09-17 14:22 - 2009-07-14 06:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2015-09-17 14:22 - 2009-07-14 06:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2015-09-17 14:21 - 2015-07-30 21:57 - 00001812 _____ C:\Users\metro\Desktop\Spotify.lnk
2015-09-17 14:21 - 2015-07-30 21:57 - 00001798 _____ C:\Users\metro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-09-17 14:21 - 2015-06-11 16:21 - 00002066 _____ C:\Users\metro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RuneScape.lnk
2015-09-17 14:21 - 2015-06-11 16:21 - 00002036 _____ C:\Users\metro\Desktop\RuneScape.lnk
2015-09-17 14:21 - 2015-05-29 19:25 - 00000366 _____ C:\Users\metro\Desktop\Intel® Grafik und Medien.lnk
2015-09-17 14:21 - 2015-01-03 21:18 - 00000196 _____ C:\Users\metro\Desktop\SRS Premium Sound.lnk
2015-09-17 14:21 - 2014-11-24 18:17 - 00001521 _____ C:\Users\metro\Desktop\CINEMA 4D.lnk
2015-09-17 14:21 - 2014-11-23 14:50 - 00006046 _____ C:\Users\metro\Desktop\ctcp - Verknüpfung.lnk
2015-09-17 14:21 - 2014-10-30 19:57 - 00001758 _____ C:\Users\metro\Desktop\BF3 Settings Editor.lnk
2015-09-17 14:21 - 2014-08-31 20:24 - 00003210 _____ C:\Users\metro\Desktop\FTB_Launcher.lnk
2015-09-17 14:21 - 2014-06-20 18:52 - 00001518 _____ C:\Users\metro\Desktop\ThrottleStop.lnk
2015-09-17 14:21 - 2014-04-18 23:12 - 00002287 _____ C:\ProgramData\Microsoft\Windows\Start Menu\FXAA Tool.lnk
2015-09-17 14:21 - 2014-04-15 15:18 - 00002261 _____ C:\Users\metro\Desktop\Skyrim (SKSE).lnk
2015-09-17 14:21 - 2014-02-03 23:58 - 00002070 _____ C:\Users\metro\Desktop\BFHD 1942.lnk
2015-09-17 14:21 - 2014-01-18 20:05 - 00002717 _____ C:\Users\metro\Desktop\Microsoft Office Excel 2003.lnk
2015-09-17 14:21 - 2014-01-18 20:05 - 00002685 _____ C:\Users\metro\Desktop\Microsoft Office Word 2003.lnk
2015-09-17 14:21 - 2013-09-25 18:10 - 00001814 _____ C:\Users\metro\Desktop\age of empire.lnk
2015-09-17 14:21 - 2013-06-20 20:14 - 00000983 _____ C:\Users\metro\Desktop\Origin.lnk
2015-09-17 14:21 - 2012-08-21 16:01 - 00000572 _____ C:\Users\metro\Desktop\Fraps.lnk
2015-09-17 14:21 - 2012-01-24 14:44 - 00000000 ____D C:\Users\metro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-09-17 14:21 - 2012-01-17 18:26 - 00000983 _____ C:\Users\metro\Desktop\WinRAR.lnk
2015-09-17 14:21 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-09-17 14:21 - 2009-07-14 07:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2015-09-17 14:21 - 2009-07-14 06:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2015-09-17 14:20 - 2013-11-30 11:45 - 00000000 __SHD C:\Users\metro\VOKYV
2015-09-17 11:24 - 2014-08-23 22:32 - 00000000 ____D C:\Users\metro\AppData\Local\Apps\2.0
2015-09-17 11:22 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-09-17 11:15 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-09-17 09:33 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-09-16 19:46 - 2012-05-29 13:49 - 00000000 ____D C:\Users\metro\AppData\Roaming\TS3Client
2015-09-16 19:29 - 2012-05-11 16:15 - 00009762 _____ C:\Users\metro\Desktop\alles.txt
2015-09-16 18:24 - 2012-03-02 20:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-09-16 16:26 - 2014-09-17 16:22 - 00004837 _____ C:\Users\metro\Desktop\autoexec.cfg
2015-09-16 15:45 - 2013-11-22 18:55 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-16 15:45 - 2013-11-22 18:55 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-15 19:06 - 2012-07-01 17:35 - 00000000 ____D C:\Users\metro\AppData\Local\Google
2015-09-15 17:44 - 2013-01-31 19:54 - 00003186 _____ C:\Windows\System32\Tasks\HPCeeScheduleFormetro
2015-09-15 17:44 - 2013-01-31 19:54 - 00000332 _____ C:\Windows\Tasks\HPCeeScheduleFormetro.job
2015-09-14 18:06 - 2012-01-25 00:25 - 00000000 ____D C:\Users\metro\AppData\Local\CrashDumps
2015-09-13 21:54 - 2011-07-15 22:11 - 00732534 _____ C:\Windows\DirectX.log
2015-09-12 17:14 - 2014-12-07 14:54 - 00000000 ____D C:\Users\metro\Desktop\Cloud Downloader 2.3
2015-09-10 14:41 - 2013-10-04 21:46 - 00000000 ____D C:\ProgramData\Package Cache
2015-09-09 23:14 - 2015-03-29 15:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-09-06 20:07 - 2015-07-03 18:59 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2015-09-06 20:05 - 2014-01-01 17:08 - 00000000 ____D C:\Users\metro\AppData\Local\Battle.net
2015-09-06 20:04 - 2015-07-03 18:56 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-08-26 15:43 - 2012-05-29 13:47 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2015-08-18 17:03 - 2012-03-29 19:34 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-18 17:03 - 2012-03-29 19:34 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-18 17:03 - 2011-07-15 22:03 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2013-08-08 14:56 - 2014-01-05 15:35 - 0059904 ___SH () C:\Users\metro\AppData\Roaming\Thumbs.db
2012-12-22 23:55 - 2014-02-22 13:21 - 0023121 _____ () C:\Users\metro\AppData\Roaming\UserTile.png
2013-12-19 15:59 - 2014-01-15 16:36 - 0000088 _____ () C:\Users\metro\AppData\Roaming\WB.CFG
2012-03-31 17:18 - 2014-02-18 20:46 - 0005632 _____ () C:\Users\metro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-01-23 21:46 - 2012-01-23 21:46 - 0000093 _____ () C:\Users\metro\AppData\Local\fusioncache.dat
2012-11-30 15:43 - 2013-01-26 22:03 - 0000600 _____ () C:\Users\metro\AppData\Local\PUTTY.RND
2012-01-29 00:12 - 2013-12-21 16:23 - 0007595 _____ () C:\Users\metro\AppData\Local\Resmon.ResmonCfg
2012-06-14 14:22 - 2012-04-15 14:22 - 0000032 ____R () C:\ProgramData\hash.dat
2012-11-10 19:11 - 2012-11-10 19:20 - 0001039 _____ () C:\ProgramData\VodafoneConnectorService.log

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\ProgramData\hash.dat


Einige Dateien in TEMP:
====================
C:\Users\metro\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-09-03 19:25

==================== Ende von FRST.txt ============================
--- --- ---

wie sieht es nun aus ist mein pc jetzt clean?

deeprybka 17.09.2015 15:24
Wenn der PC clean ist, dann sag ich es Dir schon. :)

Bitte Anweisungen lesen und befolgen.

Schritt 1 wiederholen und Rootkitsuche aktivieren. Alle Funde löschen/Quarantäne wählen.

Schritt 2 fehlt ganz

0rbit 17.09.2015 15:35
ICh habe alle Schritte gemacht.
aber ich weiß nicht, wo sich alle logs befinden

AdwCleaner Logfile:
Code:
# AdwCleaner v5.007 - Bericht erstellt am 17/09/2015 um 14:45:57
# Aktualisiert am 08/09/2015 von Xplode
# Datenbank : 2015-09-08.2 [Lokal]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : metro - ICH_MAG_FLUGZEU
# Gestartet von : C:\Users\metro\Desktop\AdwCleaner_5.007.exe
# Option : Löschen
# Unterstützung : Forum - ToolsLib

***** [ Dienste ] *****

[-] Dienst Gelöscht : Web Assistant Updater

***** [ Ordner ] *****

[-] Ordner Gelöscht : C:\Program Files\~Web Assistant
[-] Ordner Gelöscht : C:\ProgramData\speedypc software
[-] Ordner Gelöscht : C:\ProgramData\{4A818508-3355-4FBC-B302-D53B599DD9D5}
[-] Ordner Gelöscht : C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[-] Ordner Gelöscht : C:\ProgramData\{9BF4D58B-C6D6-467B-BC5A-FD0C1278F4AF}
[-] Ordner Gelöscht : C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
[-] Ordner Gelöscht : C:\ProgramData\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
[-] Ordner Gelöscht : C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}
[-] Ordner Gelöscht : C:\Users\metro\AppData\Local\Ad Optimizer (am) v2
[-] Ordner Gelöscht : C:\Users\metro\AppData\Local\b1e
[-] Ordner Gelöscht : C:\Users\metro\AppData\Local\PackageAware
[-] Ordner Gelöscht : C:\Users\metro\AppData\Local\SwvUpdater
[-] Ordner Gelöscht : C:\Users\metro\AppData\Local\DriverTuner
[-] Ordner Gelöscht : C:\Users\metro\AppData\LocalLow\Softonic
[-] Ordner Gelöscht : C:\Users\metro\AppData\LocalLow\Toolbar4
[-] Ordner Gelöscht : C:\Users\metro\AppData\Roaming\B1Toolbar
[-] Ordner Gelöscht : C:\Users\metro\AppData\Roaming\BrowserCompanion
[-] Ordner Gelöscht : C:\Users\metro\AppData\Roaming\qone8

***** [ Dateien ] *****

[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eaapdpmcjlaghfomgnghcphammlfnhbp_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hahpjplbmicfkmoccokbjejahjjpnena
[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ojcgaoafcmbadjkfdippkdddgkeaipbn_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\local storage\hxxp_www.superfish.com_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\local storage\hxxps_www.superfish.com_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_ciuvo.com_0.localstorage
[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_ciuvo.com_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.ciuvo.com_0.localstorage
[-] Datei Gelöscht : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.ciuvo.com_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\metro\AppData\LocalLow\SkwConfig.bin
[-] Datei Gelöscht : C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\foxydeal.sqlite
[-] Datei Gelöscht : C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\user.js

***** [ Verknüpfungen ] *****


***** [ Geplante Tasks ] *****

[-] Task Gelöscht : Freemium1ClickMaint
[-] Task Gelöscht : Software Updater

***** [ Registrierungsdatenbank ] *****

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\tdataprotocol.DLL
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\updatebho.DLL
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\I
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager.1
[-] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
[-] Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
[!] Schlüssel Nicht Gelöscht : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
[!] Schlüssel Nicht Gelöscht : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA0167C2-6295-41B8-9BDA-704B2F5E4CD9}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{462862BE-9A5C-49A5-9CBD-A649EAC63645}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{0113A098-06EA-4776-A011-D75590778F1E}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
[-] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[-] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{963B125B-8B21-49A2-A3A8-E37092276531}]
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{462862BE-9A5C-49A5-9CBD-A649EAC63645}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
[-] Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
[-] Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
[-] Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
[-] Schlüssel Gelöscht : HKU\.DEFAULT\Software\IM
[-] Schlüssel Gelöscht : HKU\.DEFAULT\Software\ImInstaller
[-] Schlüssel Gelöscht : HKCU\Software\ChatZum Toolbar
[-] Schlüssel Gelöscht : HKCU\Software\IM
[-] Schlüssel Gelöscht : HKCU\Software\ImInstaller
[-] Schlüssel Gelöscht : HKCU\Software\OCS
[-] Schlüssel Gelöscht : HKCU\Software\Softonic
[-] Schlüssel Gelöscht : HKCU\Software\speedypc software
[-] Schlüssel Gelöscht : HKCU\Software\DriverTuner_Init
[-] Schlüssel Gelöscht : HKCU\Software\DriverTuner
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\BrowserCompanion
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\ChatZum Toolbar
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\IePlugin
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Softonic
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\speedypc software
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Web Assistant
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Taronja
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\RrFilter
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ChatZum Toolbar
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\ChatZum Toolbar
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\IM
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\ImInstaller
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\OCS
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\Softonic
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\speedypc software
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\DriverTuner_Init
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\DriverTuner
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Web Assistant
[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page Before]
[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page Before]
[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Daten Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Daten Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Daten Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Daten Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
[-] Daten Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Daten Wiederhergestellt : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Daten Wiederhergestellt : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main [Start Page Before]
[-] Daten Wiederhergestellt : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main [Search Page Before]
[-] Daten Wiederhergestellt : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Daten Wiederhergestellt : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000_Classes\Software\Microsoft\Internet Explorer\Main [Start Page]
[!] Schlüssel Nicht Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[!] Schlüssel Nicht Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[!] Schlüssel Nicht Gelöscht : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[-] Schlüssel Gelöscht : HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}

***** [ Internetbrowser ] *****

[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : dts.search-results.com
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : search.babylon.com
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : search.softonic.com
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : search.sweetim.com
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : mystart.incredibar.com/
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : do-search
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : dcpfhaghaadpjpgocojgnlhjcieeooel
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : dedmngkbaffkenlfdcbganndoghblmap
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : dhkplhfnhceodhffomolpfigojocbpcb
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : logekkkdbdidmmcgkonmmonclldogceg
[-] [C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : pgmfkblbflahhponhjmkcnpjinenhlnc

*************************

:: Proxy Einstellungen zurückgesetzt
:: Winsock Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [25874 Bytes] ##########
--- --- ---

AdwCleaner Logfile:
Code:
# AdwCleaner v5.007 - Bericht erstellt am 17/09/2015 um 14:43:31
# Aktualisiert am 08/09/2015 von Xplode
# Datenbank : 2015-09-08.2 [Lokal]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : metro - ICH_MAG_FLUGZEU
# Gestartet von : C:\Users\metro\Desktop\AdwCleaner_5.007.exe
# Option : Suchlauf
# Unterstützung : Forum - ToolsLib

***** [ Dienste ] *****

Dienst Gefunden : Web Assistant Updater

***** [ Ordner ] *****

Ordner Gefunden : C:\Program Files\~Web Assistant
Ordner Gefunden : C:\ProgramData\speedypc software
Ordner Gefunden : C:\ProgramData\{4A818508-3355-4FBC-B302-D53B599DD9D5}
Ordner Gefunden : C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
Ordner Gefunden : C:\ProgramData\{9BF4D58B-C6D6-467B-BC5A-FD0C1278F4AF}
Ordner Gefunden : C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
Ordner Gefunden : C:\ProgramData\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
Ordner Gefunden : C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}
Ordner Gefunden : C:\Users\metro\AppData\Local\Ad Optimizer (am) v2
Ordner Gefunden : C:\Users\metro\AppData\Local\b1e
Ordner Gefunden : C:\Users\metro\AppData\Local\PackageAware
Ordner Gefunden : C:\Users\metro\AppData\Local\SwvUpdater
Ordner Gefunden : C:\Users\metro\AppData\Local\DriverTuner
Ordner Gefunden : C:\Users\metro\AppData\LocalLow\Softonic
Ordner Gefunden : C:\Users\metro\AppData\LocalLow\Toolbar4
Ordner Gefunden : C:\Users\metro\AppData\Roaming\B1Toolbar
Ordner Gefunden : C:\Users\metro\AppData\Roaming\BrowserCompanion
Ordner Gefunden : C:\Users\metro\AppData\Roaming\qone8

***** [ Dateien ] *****

Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eaapdpmcjlaghfomgnghcphammlfnhbp_0.localstorage-journal
Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hahpjplbmicfkmoccokbjejahjjpnena
Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ojcgaoafcmbadjkfdippkdddgkeaipbn_0.localstorage-journal
Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\local storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\local storage\hxxps_www.superfish.com_0.localstorage-journal
Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_ciuvo.com_0.localstorage
Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_ciuvo.com_0.localstorage-journal
Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.ciuvo.com_0.localstorage
Datei Gefunden : C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.ciuvo.com_0.localstorage-journal
Datei Gefunden : C:\Users\metro\AppData\LocalLow\SkwConfig.bin
Datei Gefunden : C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\foxydeal.sqlite
Datei Gefunden : C:\Users\metro\AppData\Roaming\Mozilla\Firefox\Profiles\vawwfwmu.default\user.js

***** [ Verknüpfungen ] *****


***** [ Geplante Tasks ] *****

Task Gefunden : Freemium1ClickMaint
Task Gefunden : Software Updater

***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\tdataprotocol.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\updatebho.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\I
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\SoftonicApp.appCore
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\SoftonicApp.appCore.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager.1
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CA0167C2-6295-41B8-9BDA-704B2F5E4CD9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{462862BE-9A5C-49A5-9CBD-A649EAC63645}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{0113A098-06EA-4776-A011-D75590778F1E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{963B125B-8B21-49A2-A3A8-E37092276531}]
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{462862BE-9A5C-49A5-9CBD-A649EAC63645}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gefunden : HKU\.DEFAULT\Software\IM
Schlüssel Gefunden : HKU\.DEFAULT\Software\ImInstaller
Schlüssel Gefunden : HKCU\Software\ChatZum Toolbar
Schlüssel Gefunden : HKCU\Software\IM
Schlüssel Gefunden : HKCU\Software\ImInstaller
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\speedypc software
Schlüssel Gefunden : HKCU\Software\DriverTuner_Init
Schlüssel Gefunden : HKCU\Software\DriverTuner
Schlüssel Gefunden : HKLM\SOFTWARE\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\BrowserCompanion
Schlüssel Gefunden : HKLM\SOFTWARE\ChatZum Toolbar
Schlüssel Gefunden : HKLM\SOFTWARE\IePlugin
Schlüssel Gefunden : HKLM\SOFTWARE\Softonic
Schlüssel Gefunden : HKLM\SOFTWARE\speedypc software
Schlüssel Gefunden : HKLM\SOFTWARE\Web Assistant
Schlüssel Gefunden : HKLM\SOFTWARE\Taronja
Schlüssel Gefunden : HKLM\SOFTWARE\RrFilter
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ChatZum Toolbar
Schlüssel Gefunden : [x64] HKCU\Software\ChatZum Toolbar
Schlüssel Gefunden : [x64] HKCU\Software\IM
Schlüssel Gefunden : [x64] HKCU\Software\ImInstaller
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\Softonic
Schlüssel Gefunden : [x64] HKCU\Software\speedypc software
Schlüssel Gefunden : [x64] HKCU\Software\DriverTuner_Init
Schlüssel Gefunden : [x64] HKCU\Software\DriverTuner
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Web Assistant
Daten Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page Before] - hxxp://search.b1.org/?bsrc=hmior&chid=c167991
Daten Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page Before] - hxxp://search.b1.org/?bsrc=hmior&chid=c167991
Daten Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main [Start Page Before] - hxxp://search.b1.org/?bsrc=hmior&chid=c167991
Daten Gefunden : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main [Search Page Before] - hxxp://search.b1.org/?bsrc=hmior&chid=c167991
Daten Gefunden : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxps://safesearch.avira.com/#web/result?source=art&q=
Daten Gefunden : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000_Classes\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://search.chatzum.com/
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gefunden : HKU\S-1-5-21-4066131180-3669703069-1695776857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gefunden : HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}

***** [ Internetbrowser ] *****

[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Gefunden : dts.search-results.com
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Gefunden : search.babylon.com
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Gefunden : search.softonic.com
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Gefunden : search.sweetim.com
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Gefunden : mystart.incredibar.com/
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Gefunden : do-search
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gefunden : dcpfhaghaadpjpgocojgnlhjcieeooel
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gefunden : dedmngkbaffkenlfdcbganndoghblmap
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gefunden : dhkplhfnhceodhffomolpfigojocbpcb
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gefunden : logekkkdbdidmmcgkonmmonclldogceg
[C:\Users\metro\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gefunden : pgmfkblbflahhponhjmkcnpjinenhlnc

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [25143 Bytes] ##########
--- --- ---

hier die beiden Log files von ADW

deeprybka 17.09.2015 15:52
Code:
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Schritt 1 wiederholen bitte. So wie oben beschrieben.

0rbit 17.09.2015 17:05
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 17.09.2015
Suchlaufzeit: 16:58
Protokolldatei: malware anti 2..txt
Administrator: Ja

Version: 2.1.8.1057
Malware-Datenbank: v2015.09.17.03
Rootkit-Datenbank: v2015.08.16.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: metro

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 453459
Abgelaufene Zeit: 1 Std., 2 Min., 22 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 0
(keine bösartigen Elemente erkannt)

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:26 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131