Bundestrojaner Win 7 System unsicher

Superman · 08.08.2013, 18:55

Hallo,

ich habe seit gestern den Bundestrojaner auf meinen Laptop. Ich hatte diesen Typischen Bildschirm wo ich nichts mehr machen konnte.

Was habe ich schon versucht?

1. in den Abgespeicherten Modus gewechselt und per suche habe ich *exe Dateien gesucht die vom 7.8.2013 ca 23 Uhr ,da habe ich Chashpolice Dateien gefunden und gelöscht. Ich konnte normal booten.

Doch heute den 8.8.2013 war der Bildschirm wieder da ,doch darauf habe ich diese 3 Dateien nicht mehr gefunden.

2. Ich habe den Kaspersky Datei Root Disk 10 (Windowsunloger) nach Anweisung befolgt ,hier konnte ich aber leider nicht wirklich mit Arbeiten. Die Festplatte konnte nicht richtig gelesen werden ,somit konnte das Programm nicht wirklich starten. Bildschirm war dann aber wieder weg.

Jetzt suche ich hier eure Hilfe ,weil ich Angst habe das etwas wird aufgezeichnet.

Viren Scanner wie Kaspersky Scanner arbeitet bis 56 % und findet 4 Bedrohungen ,doch leider reagiert er ab den 56 % nicht mehr.

Anti-Vir findet diesen Virus HEUR/Modified.SystemFile

Hoffe ich bekomme von euch Hilfe.

Liebe Grüße

Robert

schrauber · 08.08.2013, 19:10

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Superman · 08.08.2013, 19:35

Hallo Schrauber,

okay das habe ich gemacht. Eins verstehe ich nicht ganz was du damit meinst ,# ?

Leider kann ich auf meinen Laptop nichts mehr Kopieren ,keine neuen Ordner erstellen und auch nichts verschieben oder auf den Desktop machen. Auch keine Programm Verknüpfungen.

Desweiteren ist mir aufgefallen ,das Programme ca 45 Minuten benötigen um sich zu beenden oder zu Starten. Auch das Löschen von Dateien dauert sehr lange. Ich denke mal das diese Infos auch wichtig sind für dich

Danke schon mal das du mir helfen möchtest.

Schöne Grüße

Robert

schrauber · 09.08.2013, 10:16

HI,

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Superman · 09.08.2013, 10:36

Hallo Schrauber,

das habe ich verstanden, danke für die Erklärung.

hier die Logfiles:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-08-2013
Ran by Lotte und Hendo (administrator) on 08-08-2013 20:25:04
Running from C:\Users\Lotte und Hendo\Music\Musik Mp3
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\Digital Trends Club\askGfK-Reporting.exe
() C:\Program Files (x86)\Digital Trends Club\askGfK-Updater.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtkOSD] - C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe [995840 2009-10-13] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6489704 2013-05-24] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2013-05-24] (Synaptics Incorporated)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKCU\...\Run: [KSS] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
MountPoints2: F - F:\Autorun.exe
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-05-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [449608 2011-08-31] (Malwarebytes Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uujmgqignnskemgligg.lnk
ShortcutTarget: uujmgqignnskemgligg.lnk -> C:\Users\LOTTEU~1\AppData\Local\Temp\ggilgmeksnngiqgmjuu.bfg (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {37FC858C-B70A-493E-B535-EEBC5C11F748} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - DefaultScope {37FC858C-B70A-493E-B535-EEBC5C11F748} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {37FC858C-B70A-493E-B535-EEBC5C11F748} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
BHO: Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\x64\Gacela2.dll (askGfK)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\Gacela2.dll (askGfK)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default
FF user.js: detected! => C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\user.js
FF SelectedSearchEngine: Ask.com
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.autoconfig_url", "");
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.type", 2);
FF Keyword.URL: hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&locale=de_DE&apn_uid=e12b340e-cd18-4d22-af62-ab77eddcb7d6&apn_ptnrs=%5EABT&apn_sauid=3F8155A2-245A-424A-97AB-246DF232FABA&apn_dtid=%5EYYYYYY%5EYY%5EDE&&q=
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchdrive.xml
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Deutsches Wörterbuch - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [gacela2@nurago.com] C:\Program Files (x86)\Digital Trends Club
FF Extension: Digital Trends Club - C:\Program Files (x86)\Digital Trends Club
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 askGfK-Reporting-Service; C:\Program Files (x86)\Digital Trends Club\askGfK-Reporting.exe [3022464 2013-07-29] ()
R2 askGfK-Update-Service; C:\Program Files (x86)\Digital Trends Club\askGfK-Updater.exe [1377920 2013-07-29] ()
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [366152 2011-08-31] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 [verify-U]; C:\Program Files (x86)\[verify-U] AVS\[verify-U]-Service.exe [143360 2008-01-28] (Cybit AG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23152 2011-12-10] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23152 2011-12-10] (Malwarebytes Corporation)
S2 tandpl; C:\Windows\SysWow64\drivers\tandpl.sys [4736 2003-04-19] ()
S1 [verify-U]_System; C:\Windows\SysWow64\drivers\[verify-U]-driver.sys [16128 2007-11-07] (Cybits AG)
S3 CpqDfw; system32\drivers\CpqDfw.sys [x]
S2 tandpl; System32\drivers\tandpl.sys [x]
S1 [verify-U]_System; system32\drivers\[verify-U]-driver.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-08 20:19 - 2013-08-08 20:19 - 00000000 ____D C:\FRST
2013-08-08 20:00 - 2013-08-08 20:00 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-08 19:56 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Neuer Ordner (2)
2013-08-08 19:56 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Neuer Ordner
2013-08-08 19:56 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Desktop\Neuer Ordner
2013-08-08 16:27 - 2013-08-08 16:27 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2013-08-08 16:27 - 2013-08-08 16:26 - 00001057 _____ C:\Users\Lotte und Hendo\Desktop\Kaspersky Security Scan.lnk
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-08-08 14:57 - 2013-08-08 18:06 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-08-08 11:21 - 2013-08-08 11:21 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\CyberLink
2013-08-08 11:06 - 2013-08-08 11:06 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\WinRAR
2013-08-08 11:06 - 2013-08-07 23:18 - 00469936 _____ (Akeo Consulting (hxxp://akeo.ie)) C:\Users\Spiele\Desktop\rufus_v1.3.4.exe
2013-08-08 00:13 - 2013-08-08 00:13 - 00000000 ____D C:\Users\Spiele\Downloads\Kaspersky Rescue2Usb
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb.exe
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb(1).exe
2013-08-07 23:23 - 2013-08-07 23:30 - 621283886 _____ C:\Users\Spiele\Downloads\hirens.bootcd.15.2.zip
2013-08-07 23:19 - 2013-08-08 11:28 - 00000306 __RSH C:\ProgramData\ntuser.pol
2013-08-07 22:56 - 2013-08-07 22:56 - 00000165 _____ C:\ProgramData\uujmgqignnskemgligg.reg
2013-08-07 22:56 - 2013-08-07 22:56 - 00000070 _____ C:\ProgramData\uujmgqignnskemgligg.bat
2013-08-07 07:00 - 2013-08-07 07:02 - 00000000 ____D C:\Windows\system32\MRT
2013-07-23 22:26 - 2013-07-23 22:26 - 00000000 ___HD C:\Windows\AxInstSV

==================== One Month Modified Files and Folders =======

2013-08-08 20:23 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-08 20:23 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-08 20:19 - 2013-08-08 20:19 - 00000000 ____D C:\FRST
2013-08-08 20:19 - 2013-02-26 12:49 - 00000000 ____D C:\Program Files (x86)\Digital Trends Club
2013-08-08 20:00 - 2013-08-08 20:00 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-08 19:56 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Neuer Ordner (2)
2013-08-08 19:56 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Neuer Ordner
2013-08-08 19:56 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Desktop\Neuer Ordner
2013-08-08 19:49 - 2013-05-28 10:30 - 00010735 _____ C:\Users\Lotte und Hendo\Documents\hijackthis.log
2013-08-08 19:44 - 2013-05-29 16:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-08 18:41 - 2010-02-11 02:17 - 01650542 _____ C:\Windows\WindowsUpdate.log
2013-08-08 18:39 - 2010-01-24 00:31 - 00697098 _____ C:\Windows\system32\perfh007.dat
2013-08-08 18:39 - 2010-01-24 00:31 - 00148362 _____ C:\Windows\system32\perfc007.dat
2013-08-08 18:39 - 2009-07-14 07:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-08 18:06 - 2013-08-08 14:57 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-08-08 16:32 - 2013-02-17 20:21 - 00002547 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-08 16:32 - 2012-11-23 21:21 - 00000000 ____D C:\ProgramData\Skype
2013-08-08 16:27 - 2013-08-08 16:27 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2013-08-08 16:26 - 2013-08-08 16:27 - 00001057 _____ C:\Users\Lotte und Hendo\Desktop\Kaspersky Security Scan.lnk
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-08-08 16:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 16:13 - 2009-07-14 06:51 - 00271089 _____ C:\Windows\setupact.log
2013-08-08 11:28 - 2013-08-07 23:19 - 00000306 __RSH C:\ProgramData\ntuser.pol
2013-08-08 11:27 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-08-08 11:21 - 2013-08-08 11:21 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\CyberLink
2013-08-08 11:06 - 2013-08-08 11:06 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\WinRAR
2013-08-08 00:13 - 2013-08-08 00:13 - 00000000 ____D C:\Users\Spiele\Downloads\Kaspersky Rescue2Usb
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb.exe
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb(1).exe
2013-08-07 23:43 - 2012-04-13 12:02 - 00143328 _____ C:\Users\Spiele\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-07 23:30 - 2013-08-07 23:23 - 621283886 _____ C:\Users\Spiele\Downloads\hirens.bootcd.15.2.zip
2013-08-07 23:18 - 2013-08-08 11:06 - 00469936 _____ (Akeo Consulting (hxxp://akeo.ie)) C:\Users\Spiele\Desktop\rufus_v1.3.4.exe
2013-08-07 22:56 - 2013-08-07 22:56 - 00000165 _____ C:\ProgramData\uujmgqignnskemgligg.reg
2013-08-07 22:56 - 2013-08-07 22:56 - 00000070 _____ C:\ProgramData\uujmgqignnskemgligg.bat
2013-08-07 22:56 - 2010-05-03 12:13 - 00000000 ___RD C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-07 07:02 - 2013-08-07 07:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-06 07:18 - 2013-06-19 19:49 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\Skype
2013-08-02 09:22 - 2011-11-11 11:22 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-08-02 09:22 - 2010-05-11 19:53 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-07-29 16:58 - 2011-07-26 21:25 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Bewerbung Robert 2011
2013-07-23 22:26 - 2013-07-23 22:26 - 00000000 ___HD C:\Windows\AxInstSV
2013-07-19 13:30 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-11 13:05 - 2013-03-15 07:10 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 13:05 - 2013-03-15 07:10 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-11 12:30 - 2010-01-23 16:43 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-09 12:45 - 2013-02-09 12:37 - 00011481 _____ C:\Users\Lotte und Hendo\Desktop\Pflanzen Bestellungen Privat.odt

Files to move or delete:
====================
C:\ProgramData\uujmgqignnskemgligg.bat
C:\ProgramData\uujmgqignnskemgligg.reg

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-02 22:03

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-08-2013
Ran by Lotte und Hendo at 2013-08-08 20:23:04
Running from C:\Users\Lotte und Hendo\Music\Musik Mp3
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
[verify-U] AVS 2.1.9 (x32 Version: 2.1.9)
64 Bit HP CIO Components Installer (Version: 6.2.1)
7-Zip 9.20 (x32)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 1.5.0.7220)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe Shockwave Player (x32 Version: 11.5.1.601)
AGEIA PhysX v7.09.13 (x32 Version: 7.09.13)
AIO_CDB_ProductContext (x32 Version: 130.0.365.000)
AIO_CDB_Software (x32 Version: 130.0.365.000)
AIO_Scan (x32 Version: 130.0.421.000)
Ask Toolbar (x32 Version: 1.15.1.0)
Atheros Driver Installation Program (x32 Version: 9.2)
ATI Catalyst Install Manager (Version: 3.0.754.0)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.1.22229)
BufferChm (x32 Version: 130.0.331.000)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Full New (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Light (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Previews Common (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center InstallProxy (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Localization All (x32 Version: 2009.1124.2131.38610)
CCC Help Chinese Traditional (x32 Version: 2009.1124.2130.38610)
CCC Help English (x32 Version: 2009.1124.2130.38610)
CCC Help Finnish (x32 Version: 2009.1124.2130.38610)
CCC Help German (x32 Version: 2009.1124.2130.38610)
CCC Help Greek (x32 Version: 2009.1124.2130.38610)
CCC Help Italian (x32 Version: 2009.1124.2130.38610)
CCC Help Japanese (x32 Version: 2009.1124.2130.38610)
CCC Help Korean (x32 Version: 2009.1124.2130.38610)
CCC Help Norwegian (x32 Version: 2009.1124.2130.38610)
CCC Help Polish (x32 Version: 2009.1124.2130.38610)
CCC Help Portuguese (x32 Version: 2009.1124.2130.38610)
CCC Help Swedish (x32 Version: 2009.1124.2130.38610)
CCC Help Turkish (x32 Version: 2009.1124.2130.38610)
ccc-core-static (x32 Version: 2009.1124.2131.38610)
ccc-utility64 (Version: 2009.1124.2131.38610)
CEP (Color Enable Package) v.9.2 (beta) (x32 Version: 9.2 (beta))
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Copy (x32 Version: 130.0.428.000)
CyberLink YouCam (x32 Version: 3.0.2201)
Destinations (x32 Version: 140.0.77.000)
DeviceDiscovery (x32 Version: 130.0.465.000)
DHTML Editing Component (x32 Version: 6.02.0001)
Die Kunst des Mordens: Der Marionettenspieler (x32)
Die Sims 2 (x32)
Die Sims™ 2 H&M®-Fashion-Accessoires (x32)
Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires (x32)
Die Sims™ 2 Party-Accessoires (x32)
Digital Trends Club (x32 Version: 12.6.173)
DocProc (x32 Version: 13.0.0.0)
Dream Pinball 3D (x32 Version: 1.10)
Duden Korrektor (x32 Version: 4.00.1301.00)
ElsterFormular für Privatanwender (x32 Version: 12.1.0.6164p)
ESU for Microsoft Windows 7 (x32 Version: 1.0.0)
Eusing Free Registry Cleaner (x32)
F300 (x32 Version: 130.0.365.000)
F300_Help (x32 Version: 82.0.242.000)
F300Trb (x32 Version: 82.0.242.000)
Fax (x32 Version: 130.0.418.000)
GPBaseService2 (x32 Version: 130.0.371.000)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HP Customer Experience Enhancements (x32 Version: 6.0.1.3)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (Version: 13.0)
HP Setup (x32 Version: 1.2.3560.3170)
HP Smart Web Printing 4.51 (Version: 4.51)
HP Solution Center 13.0 (Version: 13.0)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Update (x32 Version: 5.001.000.014)
HP User Guides  (x32 Version: 1.01.0000)
HP Wireless Assistant (x32 Version: 3.50.12.1)
HPPhotoGadget (x32 Version: 130.0.282.000)
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000)
HPPhotosmartEssential (x32 Version: 2.04.0000)
HPProductAssistant (x32 Version: 130.0.371.000)
HPSSupply (x32 Version: 130.0.371.000)
Imaging Device Functions 13.0 (Version: 13.0)
Inkscape 0.48.4 (x32 Version: 0.48.4)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel® Matrix Storage Manager
Java Auto Updater (x32 Version: 2.0.5.1)
Java(TM) 6 Update 17 (64-bit) (Version: 6.0.170)
Java(TM) 7 (64-bit) (Version: 7.0.0)
Jewel Empire-Hidden Secrets (x32 Version: 1.0)
Kalo24 - der Freeware-Kaloreinexperte 1.0.0.0  (x32 Version: 1.0.0.0)
Kaspersky Security Scan (x32 Version: 12.0.1.340)
LabelPrint (x32 Version: 2.5.2215)
Malwarebytes Anti-Malware Version 1.60.0.1800 (x32 Version: 1.60.0.1800)
MarketResearch (x32 Version: 130.0.374.000)
McAfee Security Scan Plus (x32 Version: 3.0.318.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Works (x32 Version: 08.05.0822)
Microsoft Works (x32 Version: 9.7.0621)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
MyTomTom 3.1.0.530 (x32 Version: 3.1.0.530)
Network64 (Version: 130.0.572.000)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
PartyPoker (x32)
Picasa 3 (x32 Version: 3.9)
Power2Go (x32 Version: 6.0.3415)
Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.18.322.2010)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6206)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30120)
Recovery Manager (x32 Version: 5.5.2214)
RtVOsd (Version: 1.0.6)
Scan (x32 Version: 140.0.80.000)
Shop for HP Supplies (Version: 13.0)
Skype™ 6.1 (x32 Version: 6.1.129)
SmartWebPrinting (x32 Version: 130.0.457.000)
SolutionCenter (x32 Version: 130.0.373.000)
Spybot - Search & Destroy (x32 Version: 1.6.2)
Status (x32 Version: 130.0.469.000)
Stress Pilot (x32 Version: 1.20.0000)
Synaptics Pointing Device Driver (Version: 15.1.6.64)
TomTom HOME 2.8.2.2264 (x32 Version: 2.8.2.2264)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
Toolbox (x32 Version: 130.0.648.000)
TrayApp (x32 Version: 130.0.422.000)
TRUST 640U SILVERLINE HEADSET USB (x32)
TweakMe! (x32 Version: 1.2.0.4)
UnloadSupport (x32 Version: 11.0.0)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Visual Studio C++ 10.0 Runtime (x32 Version: 10.0.0)
WebReg (x32 Version: 130.0.132.017)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows Media Center Add-in for Silverlight (x32 Version: 4.7.3.0)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
WinRAR (x32)
WISO Steuer 2012 (x32 Version: 19.00.7303)

==================== Restore Points  =========================

Could not list Restore Points.


==================== Hosts content: ==========================

2009-07-14 04:34 - 2011-10-13 12:14 - 00437925 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {005EFE88-033A-4055-8A3E-1EF850BA8AA1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)
Task: {039BE8B4-502A-4220-A636-29294BB2996B} - System32\Tasks\{24768C28-AE3A-48D2-99E7-168D462E3701} => C:\Program Files (x86)\MyRealGames.com\Air Hawk 2\game.exe No File
Task: {049841AA-907F-47E7-B69B-BD8E9B8BC117} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: {16691879-CEE5-4D7F-AE5B-E1F95FB6ABC7} - System32\Tasks\{6A230290-B824-4598-ABF8-0C8768538572} => C:\Program Files (x86)\Wolfenstein - Enemy Territory\ET.exe No File
Task: {1DF5D1D5-BDAB-4215-883A-28590D5EC550} - System32\Tasks\Games\UpdateCheck_S-1-5-21-371880506-1153370254-2312567730-1003
Task: {210EB13A-05C0-4D24-8CD5-09036C4DD212} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {2FF06835-AAAF-4A19-8127-4B5452BE90CD} - System32\Tasks\{B0307458-48B8-4B88-9279-C0CBFCEBA9D9} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {4E532C6E-3C43-4B6A-8FEA-D08D9E7B7047} - System32\Tasks\{D0A9DE9E-55E2-4F72-87A0-E36794111234} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: {52090785-A956-4B0F-9CA5-F42792CD37B9} - System32\Tasks\{56D3E2A1-6477-4CA7-A5DE-24E05DAF0771} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: {54F4C8DB-8137-4E8C-B86C-F138A5C7C582} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {5A9FD798-8408-4B57-A523-95DF2095D36E} - System32\Tasks\{04118ECF-96A9-4372-9FDE-340DAA29D461} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {88C21B94-3F29-4673-9A72-C46DB4199F3D} - System32\Tasks\{8D7E4CBD-AD0D-45C4-83A9-7A465554E019} => C:\Program Files (x86)\Wolfenstein - Enemy Territory\ET.exe No File
Task: {97A51950-EFD8-45C7-A566-9A0326B8E0FD} - System32\Tasks\Games\UpdateCheck_S-1-5-21-371880506-1153370254-2312567730-1001
Task: {AC025553-B1DF-45E2-B6DE-852E8834BDC5} - System32\Tasks\{6887FA60-1CB6-4832-B5CC-28FF5B67319B} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {B9641A25-B3A2-4CF3-852E-DC9945B7FFC6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-08-04] (Microsoft Corporation)
Task: {CCE79E72-8EC6-465E-8477-BA8013E06EFB} - System32\Tasks\Microsoft\Windows Defender\MpIdleTask => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {E4C92E81-3362-4AC2-87A8-BD017F8D79D3} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {ECC03401-C7AD-4959-8BB4-3DC53A277946} - System32\Tasks\{56CBA466-F975-40E9-9594-68AFA709133A} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Faulty Device Manager Devices =============

Name: cmdide
Description: cmdide
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: cmdide
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/08/2013 08:23:05 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.


Vorgang:
   VSS-Server wird instanziiert

Error: (08/08/2013 08:23:05 PM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} und dem Namen "IVssCoordinatorEx2" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]


Vorgang:
   VSS-Server wird instanziiert

Error: (08/08/2013 08:04:50 PM) (Source: Windows Search Service) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0xc0041800, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.

Error: (08/08/2013 08:04:50 PM) (Source: Windows Search Service) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2013 08:04:50 PM) (Source: Windows Search Service) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2013 08:04:50 PM) (Source: Windows Search Service) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.


Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (08/08/2013 08:04:50 PM) (Source: ESENT) (User: )
Description: Windows (7696) Windows: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -1022 auf.

Error: (08/08/2013 08:04:50 PM) (Source: ESENT) (User: )
Description: Windows (7696) Windows: Neue Protokolldatei konnte nicht erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1022.

Error: (08/08/2013 08:04:50 PM) (Source: ESENT) (User: )
Description: Windows (7696) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log" zu erstellen, ist mit Systemfehler 80 (0x00000050): "Die Datei ist vorhanden. " fehlgeschlagen. Fehler -1022 (0xfffffc02) beim Erstellen von Dateien.

Error: (08/08/2013 07:58:52 PM) (Source: Windows Search Service) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0xc0041800, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.


System errors:
=============
Error: (08/08/2013 08:23:10 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:23:04 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:22:57 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:22:51 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:22:44 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:22:38 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:22:31 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:22:24 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:22:18 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/08/2013 08:22:11 PM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 3957.86 MB
Available physical RAM: 1960.96 MB
Total Pagefile: 7913.86 MB
Available Pagefile: 5654.81 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:284.89 GB) (Free:201.39 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:12.91 GB) (Free:2.15 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32 (Disk=0 Partition=4)

Liebe Grüße

Robert

schrauber · 09.08.2013, 11:01

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Startup: C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uujmgqignnskemgligg.lnk
ShortcutTarget: uujmgqignnskemgligg.lnk -> C:\Users\LOTTEU~1\AppData\Local\Temp\ggilgmeksnngiqgmjuu.bfg (Microsoft Corporation)
C:\ProgramData\uujmgqignnskemgligg.bat
C:\ProgramData\uujmgqignnskemgligg.reg
C:\Users\LOTTEU~1\AppData\Local\Temp\ggilgmeksnngiqgmjuu.bfg

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Bootet der Rechner jetzt ganz normal?

Superman · 09.08.2013, 11:22

leider ist das nicht möglich. Diese Meldung erscheint immer. Fixlist.txt ist einmal im Ordner von FRST und auch auf dem Desktop.

was muss ich da jetzt machen?

Diese Datei habe ich irgendwie heute schon mal gesehen. Booten tut der Laptop ganz normal ,doch irgendwie dauert alles sehr lange. Der Mozila Firefox hängt auch immer sehr oft.

schrauber · 10.08.2013, 09:08

Die fixlist muss als fixlist genau da liegen, wo auch FRST ist, also die ausführbare Datei. Und es darf nicht fixlist.txt.txt sein

Superman · 10.08.2013, 09:28

Hallo schrauber,

okay das hat diesmal geklappt. Hier das gewünschte Logfile

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-08-2013
Ran by Lotte und Hendo at 2013-08-10 10:26:15 Run:1
Running from C:\Users\Lotte und Hendo\Desktop
Boot Mode: Normal
==============================================

C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uujmgqignnskemgligg.lnk not found.
C:\Users\LOTTEU~1\AppData\Local\Temp\ggilgmeksnngiqgmjuu.bfg not found.
C:\ProgramData\uujmgqignnskemgligg.bat => Moved successfully.
C:\ProgramData\uujmgqignnskemgligg.reg => Moved successfully.
"C:\Users\LOTTEU~1\AppData\Local\Temp\ggilgmeksnngiqgmjuu.bfg" => File/Directory not found.

==== End of Fixlog ====

Wie machen wir weiter ?

Liebe Grüße

Robert

schrauber · 10.08.2013, 10:03

Kannste den Rechner jetzt ganz normal starten?

Superman · 10.08.2013, 10:55

Hallo Schrauber,

der Laptop lässt sich normal starten und zeigt auch keine Fehlermeldung an. Doch ich habe Angst das doch noch etwas drauf ist. Zwecks Online Banking und Email.

Liebe Grüße

Robert

schrauber · 10.08.2013, 20:57

Wir sind ja auch nicht fertig. Ab jetzt alle Scans im normalen Modus:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Superman · 11.08.2013, 00:06

Hallo Schrauber,

da wurde ja einiges gemacht mit den Tools. Ich lieste dir mal alle Logfile auf.

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.10.04

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Lotte und Hendo :: LOTTEUNDHENDO [Administrator]

11.08.2013 00:19:17
mbam-log-2013-08-11 (00-19-17).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 271730
Laufzeit: 5 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 11/08/2013 um 00:36:42 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium  (64 bits)
# Benutzer : Lotte und Hendo - LOTTEUNDHENDO
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Lotte und Hendo\Desktop\Virus-Scanner\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\ProgramData\Trymedia
Ordner Gelöscht : C:\Users\Lotte und Hendo\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Lotte und Hendo\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\LOTTEU~1\AppData\Local\Temp\boost_interprocess
Ordner Gelöscht : C:\Users\Spiele\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16476

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\prefs.js

C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Gelöscht : user_pref("browser.search.defaultenginename", "Ask.com");
Gelöscht : user_pref("browser.search.order.1", "Ask.com");
Gelöscht : user_pref("browser.search.selectedEngine", "Ask.com");
Gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
Gelöscht : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&loc[...]

Datei : C:\Users\Spiele\AppData\Roaming\Mozilla\Firefox\Profiles\nghm707g.default\prefs.js

Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Gelöscht : user_pref("browser.search.defaultenginename", "Ask.com");
Gelöscht : user_pref("browser.search.order.1", "Ask.com");
Gelöscht : user_pref("browser.search.selectedEngine", "Ask.com");
Gelöscht : user_pref("browser.startup.homepage", "hxxp://search.avira.com/?l=dis&o=APN10395&gct=hp&dc=EU&locale[...]
Gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
Gelöscht : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&loc[...]

Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\e5drwpzu.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [5222 octets] - [11/08/2013 00:36:42]

########## EOF - C:\AdwCleaner[S1].txt - [5282 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.4.1 (08.10.2013:1)
OS: Windows 7 Home Premium x64
Ran by Lotte und Hendo on 11.08.2013 at  0:47:29,77
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9



~~~ Files

Successfully deleted: [File] "C:\Windows\wininit.ini"



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\eusing free registry cleaner"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\free registry cleaner"
Successfully deleted: [Folder] "C:\Users\Lotte und Hendo\AppData\Roaming\microsoft\windows\start menu\programs\free registry cleaner"



~~~ FireFox

Emptied folder: C:\Users\Lotte und Hendo\AppData\Roaming\mozilla\firefox\profiles\uk2yrogk.default\minidumps [407 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.08.2013 at  0:54:56,63
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-08-2013
Ran by Lotte und Hendo (administrator) on 11-08-2013 00:58:27
Running from C:\Users\Lotte und Hendo\Desktop\Virus-Scanner
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\Digital Trends Club\askGfK-Reporting.exe
() C:\Program Files (x86)\Digital Trends Club\askGfK-Updater.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtkOSD] - C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe [995840 2009-10-13] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6489704 2013-05-24] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2013-05-24] (Synaptics Incorporated)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKCU\...\Run: [KSS] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
MountPoints2: F - F:\Autorun.exe
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-05-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
HKU\Gast\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\Gast\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [x]
HKU\Gast\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [565976 2007-06-22] (Expert System S.p.A.)
HKU\Gast\...\Run: [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [x]
HKU\Gast\...\Policies\system: [DisableLockWorkstation] 0
HKU\Gast\...\Policies\system: [DisableChangePassword] 0
HKU\Spiele\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [x]
HKU\Spiele\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\Spiele\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [x]
HKU\Spiele\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [565976 2007-06-22] (Expert System S.p.A.)
HKU\Spiele\...\Run: [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [x]
HKU\Spiele\...\Policies\system: [DisableLockWorkstation] 0
HKU\Spiele\...\Policies\system: [DisableChangePassword] 0

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\x64\Gacela2.dll (askGfK)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\Gacela2.dll (askGfK)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.autoconfig_url", "");
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.type", 2);
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchdrive.xml
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Deutsches Wörterbuch - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [gacela2@nurago.com] C:\Program Files (x86)\Digital Trends Club
FF Extension: Digital Trends Club - C:\Program Files (x86)\Digital Trends Club
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 askGfK-Reporting-Service; C:\Program Files (x86)\Digital Trends Club\askGfK-Reporting.exe [3022464 2013-07-29] ()
R2 askGfK-Update-Service; C:\Program Files (x86)\Digital Trends Club\askGfK-Updater.exe [1377920 2013-07-29] ()
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 [verify-U]; C:\Program Files (x86)\[verify-U] AVS\[verify-U]-Service.exe [143360 2008-01-28] (Cybit AG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S2 tandpl; C:\Windows\SysWow64\drivers\tandpl.sys [4736 2003-04-19] ()
S1 [verify-U]_System; C:\Windows\SysWow64\drivers\[verify-U]-driver.sys [16128 2007-11-07] (Cybits AG)
S3 CpqDfw; system32\drivers\CpqDfw.sys [x]
S2 tandpl; System32\drivers\tandpl.sys [x]
S1 [verify-U]_System; system32\drivers\[verify-U]-driver.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-11 00:47 - 2013-08-11 00:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-11 00:36 - 2013-08-11 00:37 - 00005343 _____ C:\AdwCleaner[S1].txt
2013-08-11 00:17 - 2013-08-11 00:17 - 00001087 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Malwarebytes
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-11 00:17 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-11 00:09 - 2013-08-11 00:58 - 00000000 ____D C:\Users\Lotte und Hendo\Desktop\Virus-Scanner
2013-08-09 11:25 - 2013-08-09 11:25 - 00003416 ____N C:\bootsqm.dat
2013-08-08 20:19 - 2013-08-10 10:16 - 00000000 ____D C:\FRST
2013-08-08 20:00 - 2013-08-08 20:00 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-08 19:56 - 2013-08-09 19:47 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Neuer Ordner (2)
2013-08-08 19:56 - 2013-08-08 20:31 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Virus
2013-08-08 19:56 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Desktop\Neuer Ordner
2013-08-08 16:27 - 2013-08-08 16:27 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-08-08 14:57 - 2013-08-08 18:06 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-08-08 11:21 - 2013-08-08 11:21 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\CyberLink
2013-08-08 11:06 - 2013-08-08 11:06 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\WinRAR
2013-08-08 11:06 - 2013-08-07 23:18 - 00469936 _____ (Akeo Consulting (hxxp://akeo.ie)) C:\Users\Spiele\Desktop\rufus_v1.3.4.exe
2013-08-08 00:13 - 2013-08-08 00:13 - 00000000 ____D C:\Users\Spiele\Downloads\Kaspersky Rescue2Usb
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb.exe
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb(1).exe
2013-08-07 23:23 - 2013-08-07 23:30 - 00000000 _____ C:\Users\Spiele\Downloads\hirens.bootcd.15.2.zip
2013-08-07 23:19 - 2013-08-08 11:28 - 00000306 __RSH C:\ProgramData\ntuser.pol
2013-08-07 07:00 - 2013-08-07 07:02 - 00000000 ____D C:\Windows\system32\MRT
2013-07-23 22:26 - 2013-07-23 22:26 - 00000000 ___HD C:\Windows\AxInstSV

==================== One Month Modified Files and Folders =======

2013-08-11 00:58 - 2013-08-11 00:09 - 00000000 ____D C:\Users\Lotte und Hendo\Desktop\Virus-Scanner
2013-08-11 00:48 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-11 00:48 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-11 00:47 - 2013-08-11 00:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-11 00:44 - 2013-05-29 16:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-11 00:40 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-11 00:40 - 2009-07-14 06:51 - 00271537 _____ C:\Windows\setupact.log
2013-08-11 00:39 - 2010-02-11 02:17 - 01773194 _____ C:\Windows\WindowsUpdate.log
2013-08-11 00:37 - 2013-08-11 00:36 - 00005343 _____ C:\AdwCleaner[S1].txt
2013-08-11 00:17 - 2013-08-11 00:17 - 00001087 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Malwarebytes
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-11 00:12 - 2010-05-03 10:56 - 00557272 _____ C:\Windows\PFRO.log
2013-08-10 23:40 - 2013-02-26 12:49 - 00000000 ____D C:\Program Files (x86)\Digital Trends Club
2013-08-10 10:26 - 2013-05-28 20:28 - 00000000 ____D C:\Stresspilot
2013-08-10 10:25 - 2012-11-23 21:22 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Skype
2013-08-10 10:25 - 2012-11-23 21:21 - 00000000 ____D C:\ProgramData\Skype
2013-08-10 10:25 - 2010-05-04 11:52 - 00008338 _____ C:\ProgramData\hpzinstall.log
2013-08-10 10:25 - 2010-01-23 18:38 - 00000000 ____D C:\Program Files (x86)\Hp
2013-08-10 10:16 - 2013-08-08 20:19 - 00000000 ____D C:\FRST
2013-08-10 10:11 - 2011-12-10 05:42 - 00000000 ____D C:\Windows\pss
2013-08-10 10:11 - 2010-05-03 12:13 - 00000000 ___RD C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-09 19:47 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Neuer Ordner (2)
2013-08-09 12:05 - 2011-11-11 11:22 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-08-09 12:05 - 2010-05-11 19:53 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-08-09 11:52 - 2011-08-24 20:54 - 00000000 ____D C:\Program Files (x86)\rondomedia
2013-08-09 11:40 - 2013-02-16 21:06 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\inkscape
2013-08-09 11:39 - 2010-07-19 12:28 - 00000000 ____D C:\Program Files (x86)\EA GAMES
2013-08-09 11:25 - 2013-08-09 11:25 - 00003416 ____N C:\bootsqm.dat
2013-08-08 21:34 - 2010-07-04 00:01 - 00000000 ____D C:\ProgramData\Recovery
2013-08-08 20:31 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Virus
2013-08-08 20:00 - 2013-08-08 20:00 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-08 19:56 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Desktop\Neuer Ordner
2013-08-08 19:49 - 2013-05-28 10:30 - 00010735 _____ C:\Users\Lotte und Hendo\Documents\hijackthis.log
2013-08-08 18:39 - 2010-01-24 00:31 - 00697098 _____ C:\Windows\system32\perfh007.dat
2013-08-08 18:39 - 2010-01-24 00:31 - 00148362 _____ C:\Windows\system32\perfc007.dat
2013-08-08 18:39 - 2009-07-14 07:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-08 18:06 - 2013-08-08 14:57 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-08-08 16:27 - 2013-08-08 16:27 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-08-08 11:28 - 2013-08-07 23:19 - 00000306 __RSH C:\ProgramData\ntuser.pol
2013-08-08 11:27 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-08-08 11:21 - 2013-08-08 11:21 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\CyberLink
2013-08-08 11:06 - 2013-08-08 11:06 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\WinRAR
2013-08-08 00:13 - 2013-08-08 00:13 - 00000000 ____D C:\Users\Spiele\Downloads\Kaspersky Rescue2Usb
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb.exe
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb(1).exe
2013-08-07 23:43 - 2012-04-13 12:02 - 00143328 _____ C:\Users\Spiele\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-07 23:30 - 2013-08-07 23:23 - 00000000 _____ C:\Users\Spiele\Downloads\hirens.bootcd.15.2.zip
2013-08-07 23:18 - 2013-08-08 11:06 - 00469936 _____ (Akeo Consulting (hxxp://akeo.ie)) C:\Users\Spiele\Desktop\rufus_v1.3.4.exe
2013-08-07 07:02 - 2013-08-07 07:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-06 07:18 - 2013-06-19 19:49 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\Skype
2013-07-29 16:58 - 2011-07-26 21:25 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Bewerbung Robert 2011
2013-07-23 22:26 - 2013-07-23 22:26 - 00000000 ___HD C:\Windows\AxInstSV
2013-07-19 13:30 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-02 22:03

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-08-2013
Ran by Lotte und Hendo at 2013-08-11 00:59:58
Running from C:\Users\Lotte und Hendo\Desktop\Virus-Scanner
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
[verify-U] AVS 2.1.9 (x32 Version: 2.1.9)
64 Bit HP CIO Components Installer (Version: 6.2.1)
7-Zip 9.20 (x32)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 1.5.0.7220)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe Shockwave Player (x32 Version: 11.5.1.601)
AGEIA PhysX v7.09.13 (x32 Version: 7.09.13)
AIO_CDB_ProductContext (x32 Version: 130.0.365.000)
AIO_CDB_Software (x32 Version: 130.0.365.000)
AIO_Scan (x32 Version: 130.0.421.000)
Atheros Driver Installation Program (x32 Version: 9.2)
ATI Catalyst Install Manager (Version: 3.0.754.0)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
BufferChm (x32 Version: 130.0.331.000)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Full New (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Light (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Previews Common (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center InstallProxy (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Localization All (x32 Version: 2009.1124.2131.38610)
CCC Help Chinese Traditional (x32 Version: 2009.1124.2130.38610)
CCC Help English (x32 Version: 2009.1124.2130.38610)
CCC Help Finnish (x32 Version: 2009.1124.2130.38610)
CCC Help German (x32 Version: 2009.1124.2130.38610)
CCC Help Greek (x32 Version: 2009.1124.2130.38610)
CCC Help Italian (x32 Version: 2009.1124.2130.38610)
CCC Help Japanese (x32 Version: 2009.1124.2130.38610)
CCC Help Korean (x32 Version: 2009.1124.2130.38610)
CCC Help Norwegian (x32 Version: 2009.1124.2130.38610)
CCC Help Polish (x32 Version: 2009.1124.2130.38610)
CCC Help Portuguese (x32 Version: 2009.1124.2130.38610)
CCC Help Swedish (x32 Version: 2009.1124.2130.38610)
CCC Help Turkish (x32 Version: 2009.1124.2130.38610)
ccc-core-static (x32 Version: 2009.1124.2131.38610)
ccc-utility64 (Version: 2009.1124.2131.38610)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Copy (x32 Version: 130.0.428.000)
CyberLink YouCam (x32 Version: 3.0.2201)
Destinations (x32 Version: 140.0.77.000)
DeviceDiscovery (x32 Version: 130.0.465.000)
DHTML Editing Component (x32 Version: 6.02.0001)
Die Sims 2 (x32)
Die Sims™ 2 H&M®-Fashion-Accessoires (x32)
Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires (x32)
Die Sims™ 2 Party-Accessoires (x32)
Digital Trends Club (x32 Version: 12.6.173)
DocProc (x32 Version: 13.0.0.0)
Dream Pinball 3D (x32 Version: 1.10)
Duden Korrektor (x32 Version: 4.00.1301.00)
ElsterFormular für Privatanwender (x32 Version: 12.1.0.6164p)
ESU for Microsoft Windows 7 (x32 Version: 1.0.0)
Eusing Free Registry Cleaner (x32)
F300 (x32 Version: 130.0.365.000)
F300_Help (x32 Version: 82.0.242.000)
F300Trb (x32 Version: 82.0.242.000)
Fax (x32 Version: 130.0.418.000)
GPBaseService2 (x32 Version: 130.0.371.000)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HP Customer Experience Enhancements (x32 Version: 6.0.1.3)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (Version: 13.0)
HP Setup (x32 Version: 1.2.3560.3170)
HP Smart Web Printing 4.51 (Version: 4.51)
HP Solution Center 13.0 (Version: 13.0)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Update (x32 Version: 5.001.000.014)
HP User Guides  (x32 Version: 1.01.0000)
HP Wireless Assistant (x32 Version: 3.50.12.1)
HPPhotoGadget (x32 Version: 130.0.282.000)
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000)
HPPhotosmartEssential (x32 Version: 2.04.0000)
HPProductAssistant (x32 Version: 130.0.371.000)
Imaging Device Functions 13.0 (Version: 13.0)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel® Matrix Storage Manager
Java Auto Updater (x32 Version: 2.0.5.1)
Java(TM) 6 Update 17 (64-bit) (Version: 6.0.170)
Java(TM) 7 (64-bit) (Version: 7.0.0)
Kaspersky Security Scan (x32 Version: 12.0.1.340)
LabelPrint (x32 Version: 2.5.2215)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
MarketResearch (x32 Version: 130.0.374.000)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Works (x32 Version: 08.05.0822)
Microsoft Works (x32 Version: 9.7.0621)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSVCRT (x32 Version: 14.0.1468.721)
MyTomTom 3.1.0.530 (x32 Version: 3.1.0.530)
Network64 (Version: 130.0.572.000)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
PartyPoker (x32)
Picasa 3 (x32 Version: 3.9)
Power2Go (x32 Version: 6.0.3415)
Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.18.322.2010)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6206)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30120)
Recovery Manager (x32 Version: 5.5.2214)
RtVOsd (Version: 1.0.6)
Scan (x32 Version: 140.0.80.000)
SmartWebPrinting (x32 Version: 130.0.457.000)
SolutionCenter (x32 Version: 130.0.373.000)
Spybot - Search & Destroy (x32 Version: 1.6.2)
Status (x32 Version: 130.0.469.000)
Synaptics Pointing Device Driver (Version: 15.1.6.64)
TomTom HOME 2.8.2.2264 (x32 Version: 2.8.2.2264)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
Toolbox (x32 Version: 130.0.648.000)
TrayApp (x32 Version: 130.0.422.000)
TRUST 640U SILVERLINE HEADSET USB (x32)
TweakMe! (x32 Version: 1.2.0.4)
UnloadSupport (x32 Version: 11.0.0)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Visual Studio C++ 10.0 Runtime (x32 Version: 10.0.0)
WebReg (x32 Version: 130.0.132.017)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows Media Center Add-in for Silverlight (x32 Version: 4.7.3.0)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
WinRAR (x32)
WISO Steuer 2012 (x32 Version: 19.00.7303)

==================== Restore Points  =========================

Could not list Restore Points.


==================== Hosts content: ==========================

2009-07-14 04:34 - 2011-10-13 12:14 - 00437925 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {005EFE88-033A-4055-8A3E-1EF850BA8AA1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)
Task: {039BE8B4-502A-4220-A636-29294BB2996B} - System32\Tasks\{24768C28-AE3A-48D2-99E7-168D462E3701} => C:\Program Files (x86)\MyRealGames.com\Air Hawk 2\game.exe No File
Task: {049841AA-907F-47E7-B69B-BD8E9B8BC117} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: {16691879-CEE5-4D7F-AE5B-E1F95FB6ABC7} - System32\Tasks\{6A230290-B824-4598-ABF8-0C8768538572} => C:\Program Files (x86)\Wolfenstein - Enemy Territory\ET.exe No File
Task: {1DF5D1D5-BDAB-4215-883A-28590D5EC550} - System32\Tasks\Games\UpdateCheck_S-1-5-21-371880506-1153370254-2312567730-1003
Task: {210EB13A-05C0-4D24-8CD5-09036C4DD212} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {2FF06835-AAAF-4A19-8127-4B5452BE90CD} - System32\Tasks\{B0307458-48B8-4B88-9279-C0CBFCEBA9D9} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {4E532C6E-3C43-4B6A-8FEA-D08D9E7B7047} - System32\Tasks\{D0A9DE9E-55E2-4F72-87A0-E36794111234} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: {52090785-A956-4B0F-9CA5-F42792CD37B9} - System32\Tasks\{56D3E2A1-6477-4CA7-A5DE-24E05DAF0771} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: {54F4C8DB-8137-4E8C-B86C-F138A5C7C582} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {5A9FD798-8408-4B57-A523-95DF2095D36E} - System32\Tasks\{04118ECF-96A9-4372-9FDE-340DAA29D461} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {88C21B94-3F29-4673-9A72-C46DB4199F3D} - System32\Tasks\{8D7E4CBD-AD0D-45C4-83A9-7A465554E019} => C:\Program Files (x86)\Wolfenstein - Enemy Territory\ET.exe No File
Task: {97A51950-EFD8-45C7-A566-9A0326B8E0FD} - System32\Tasks\Games\UpdateCheck_S-1-5-21-371880506-1153370254-2312567730-1001
Task: {AC025553-B1DF-45E2-B6DE-852E8834BDC5} - System32\Tasks\{6887FA60-1CB6-4832-B5CC-28FF5B67319B} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {B63136B7-2AF2-437D-8B38-CAB57ABD9D39} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-07-29] (Hewlett-Packard)
Task: {B9641A25-B3A2-4CF3-852E-DC9945B7FFC6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-08-04] (Microsoft Corporation)
Task: {CCE79E72-8EC6-465E-8477-BA8013E06EFB} - System32\Tasks\Microsoft\Windows Defender\MpIdleTask => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {E4C92E81-3362-4AC2-87A8-BD017F8D79D3} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {ECC03401-C7AD-4959-8BB4-3DC53A277946} - System32\Tasks\{56CBA466-F975-40E9-9594-68AFA709133A} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/11/2013 00:59:59 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.


Vorgang:
   VSS-Server wird instanziiert

Error: (08/11/2013 00:59:59 AM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} und dem Namen "IVssCoordinatorEx2" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]


Vorgang:
   VSS-Server wird instanziiert


System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 36%
Total physical RAM: 3957.86 MB
Available physical RAM: 2523.55 MB
Total Pagefile: 7913.86 MB
Available Pagefile: 6051.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:284.89 GB) (Free:206.96 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:12.91 GB) (Free:2.15 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32 (Disk=0 Partition=4)
Drive f: (KRD10) (CDROM) (Total:0.28 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: CB0F1A13)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=13 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

==================== End Of Log ============================

Liebe Grüße

Robert

schrauber · 11.08.2013, 08:25

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Superman · 11.08.2013, 19:06

Hallo Schrauber,

der Scan hat über 3 Stunden gedauert, dachte es geht nie zu ende. Hier die Logs:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.71  
 Windows 7  x64 (UAC is enabled)  
 Out of date service pack!! 
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 MVPS Hosts File  
 Spybot - Search & Destroy 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Eusing Free Registry Cleaner  
 Java version out of Date! 
 Adobe Flash Player 11.7.700.224  
 Adobe Reader XI  
 Mozilla Firefox (22.0) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avguard.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 Kaspersky Lab Kaspersky Security Scan 2.0 kss.exe  
 Digital Trends Club askGfK-Reporting.exe   
 Digital Trends Club askGfK-Updater.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=84fe455fe51dfc45aa83cfc021efbd7f
# engine=14737
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-11 05:46:00
# local_time=2013-08-11 07:46:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=1799 16775165 100 96 134213 241662850 126973 0
# compatibility_mode=5893 16776574 100 94 42859959 127873010 0 0
# scanned=256101
# found=2
# cleaned=0
# scan_time=11452
sh=693688C7AAD80058AD84E9401613019641C4F235 ft=1 fh=616d7de0b8a2fd95 vn="a variant of Win32/Kryptik.BHOI trojan" ac=I fn="C:\Users\Lotte und Hendo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\734d1d50-5fae783a"
sh=41DD5EED00A7468844257A4701DF73353CB3E0D5 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.PEB trojan" ac=I fn="C:\Users\Lotte und Hendo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\189af287-6bb37fab"

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-08-2013
Ran by Lotte und Hendo (administrator) on 11-08-2013 20:01:45
Running from C:\Users\Lotte und Hendo\Desktop\Virus-Scanner
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\Digital Trends Club\askGfK-Reporting.exe
() C:\Program Files (x86)\Digital Trends Club\askGfK-Updater.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtkOSD] - C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe [995840 2009-10-13] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6489704 2013-05-24] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2013-05-24] (Synaptics Incorporated)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKCU\...\Run: [KSS] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
MountPoints2: F - F:\Autorun.exe
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-05-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
HKU\Gast\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\Gast\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [x]
HKU\Gast\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [565976 2007-06-22] (Expert System S.p.A.)
HKU\Gast\...\Run: [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [x]
HKU\Gast\...\Policies\system: [DisableLockWorkstation] 0
HKU\Gast\...\Policies\system: [DisableChangePassword] 0
HKU\Spiele\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [x]
HKU\Spiele\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\Spiele\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [x]
HKU\Spiele\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [565976 2007-06-22] (Expert System S.p.A.)
HKU\Spiele\...\Run: [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [x]
HKU\Spiele\...\Policies\system: [DisableLockWorkstation] 0
HKU\Spiele\...\Policies\system: [DisableChangePassword] 0

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {37FC858C-B70A-493E-B535-EEBC5C11F748} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
BHO: Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\x64\Gacela2.dll (askGfK)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\Gacela2.dll (askGfK)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.autoconfig_url", "");
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.type", 2);
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchdrive.xml
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Deutsches Wörterbuch - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Users\Lotte und Hendo\AppData\Roaming\Mozilla\Firefox\Profiles\uk2yrogk.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [gacela2@nurago.com] C:\Program Files (x86)\Digital Trends Club
FF Extension: Digital Trends Club - C:\Program Files (x86)\Digital Trends Club
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 askGfK-Reporting-Service; C:\Program Files (x86)\Digital Trends Club\askGfK-Reporting.exe [3022464 2013-07-29] ()
R2 askGfK-Update-Service; C:\Program Files (x86)\Digital Trends Club\askGfK-Updater.exe [1377920 2013-07-29] ()
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 [verify-U]; C:\Program Files (x86)\[verify-U] AVS\[verify-U]-Service.exe [143360 2008-01-28] (Cybit AG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
S2 tandpl; C:\Windows\SysWow64\drivers\tandpl.sys [4736 2003-04-19] ()
S1 [verify-U]_System; C:\Windows\SysWow64\drivers\[verify-U]-driver.sys [16128 2007-11-07] (Cybits AG)
S3 CpqDfw; system32\drivers\CpqDfw.sys [x]
S2 tandpl; System32\drivers\tandpl.sys [x]
S1 [verify-U]_System; system32\drivers\[verify-U]-driver.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-11 19:53 - 2013-08-11 19:53 - 00891098 _____ C:\Users\Lotte und Hendo\Desktop\SecurityCheck.exe
2013-08-11 10:40 - 2013-08-11 10:40 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-11 01:36 - 2013-08-11 01:36 - 00000000 ____D C:\Windows\Sun
2013-08-11 00:47 - 2013-08-11 00:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-11 00:36 - 2013-08-11 00:37 - 00005343 _____ C:\AdwCleaner[S1].txt
2013-08-11 00:17 - 2013-08-11 00:17 - 00001087 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Malwarebytes
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-11 00:17 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-11 00:09 - 2013-08-11 01:00 - 00000000 ____D C:\Users\Lotte und Hendo\Desktop\Virus-Scanner
2013-08-09 11:25 - 2013-08-09 11:25 - 00003416 ____N C:\bootsqm.dat
2013-08-08 20:19 - 2013-08-10 10:16 - 00000000 ____D C:\FRST
2013-08-08 20:00 - 2013-08-08 20:00 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-08 19:56 - 2013-08-09 19:47 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Neuer Ordner (2)
2013-08-08 19:56 - 2013-08-08 20:31 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Virus
2013-08-08 16:27 - 2013-08-08 16:27 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-08-08 14:57 - 2013-08-08 18:06 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-08-08 11:21 - 2013-08-08 11:21 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\CyberLink
2013-08-08 11:06 - 2013-08-08 11:06 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\WinRAR
2013-08-08 11:06 - 2013-08-07 23:18 - 00469936 _____ (Akeo Consulting (hxxp://akeo.ie)) C:\Users\Spiele\Desktop\rufus_v1.3.4.exe
2013-08-08 00:13 - 2013-08-08 00:13 - 00000000 ____D C:\Users\Spiele\Downloads\Kaspersky Rescue2Usb
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb.exe
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb(1).exe
2013-08-07 23:23 - 2013-08-07 23:30 - 00000000 _____ C:\Users\Spiele\Downloads\hirens.bootcd.15.2.zip
2013-08-07 23:19 - 2013-08-08 11:28 - 00000306 __RSH C:\ProgramData\ntuser.pol
2013-08-07 07:00 - 2013-08-07 07:02 - 00000000 ____D C:\Windows\system32\MRT
2013-07-23 22:26 - 2013-07-23 22:26 - 00000000 ___HD C:\Windows\AxInstSV

==================== One Month Modified Files and Folders =======

2013-08-11 19:53 - 2013-08-11 19:53 - 00891098 _____ C:\Users\Lotte und Hendo\Desktop\SecurityCheck.exe
2013-08-11 19:44 - 2013-05-29 16:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-11 16:39 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-11 16:39 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-11 16:38 - 2010-01-24 00:31 - 00697098 _____ C:\Windows\system32\perfh007.dat
2013-08-11 16:38 - 2010-01-24 00:31 - 00148362 _____ C:\Windows\system32\perfc007.dat
2013-08-11 16:38 - 2009-07-14 07:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-11 16:35 - 2010-02-11 02:17 - 01811122 _____ C:\Windows\WindowsUpdate.log
2013-08-11 16:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-11 16:31 - 2009-07-14 06:51 - 00271649 _____ C:\Windows\setupact.log
2013-08-11 10:40 - 2013-08-11 10:40 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-11 10:25 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-11 01:36 - 2013-08-11 01:36 - 00000000 ____D C:\Windows\Sun
2013-08-11 01:00 - 2013-08-11 00:09 - 00000000 ____D C:\Users\Lotte und Hendo\Desktop\Virus-Scanner
2013-08-11 00:47 - 2013-08-11 00:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-11 00:37 - 2013-08-11 00:36 - 00005343 _____ C:\AdwCleaner[S1].txt
2013-08-11 00:17 - 2013-08-11 00:17 - 00001087 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Malwarebytes
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-11 00:17 - 2013-08-11 00:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-11 00:12 - 2010-05-03 10:56 - 00557272 _____ C:\Windows\PFRO.log
2013-08-10 10:26 - 2013-05-28 20:28 - 00000000 ____D C:\Stresspilot
2013-08-10 10:25 - 2012-11-23 21:22 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Skype
2013-08-10 10:25 - 2012-11-23 21:21 - 00000000 ____D C:\ProgramData\Skype
2013-08-10 10:25 - 2010-05-04 11:52 - 00008338 _____ C:\ProgramData\hpzinstall.log
2013-08-10 10:25 - 2010-01-23 18:38 - 00000000 ____D C:\Program Files (x86)\Hp
2013-08-10 10:16 - 2013-08-08 20:19 - 00000000 ____D C:\FRST
2013-08-10 10:11 - 2011-12-10 05:42 - 00000000 ____D C:\Windows\pss
2013-08-10 10:11 - 2010-05-03 12:13 - 00000000 ___RD C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-09 19:47 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Neuer Ordner (2)
2013-08-09 12:05 - 2011-11-11 11:22 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-08-09 12:05 - 2010-05-11 19:53 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-08-09 11:52 - 2011-08-24 20:54 - 00000000 ____D C:\Program Files (x86)\rondomedia
2013-08-09 11:48 - 2013-03-22 09:03 - 00000000 ____D C:\Windows\uninstall
2013-08-09 11:40 - 2013-02-16 21:06 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\inkscape
2013-08-09 11:39 - 2010-07-19 12:28 - 00000000 ____D C:\Program Files (x86)\EA GAMES
2013-08-09 11:25 - 2013-08-09 11:25 - 00003416 ____N C:\bootsqm.dat
2013-08-08 21:34 - 2010-07-04 00:01 - 00000000 ____D C:\ProgramData\Recovery
2013-08-08 20:31 - 2013-08-08 19:56 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Virus
2013-08-08 20:00 - 2013-08-08 20:00 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-08 19:49 - 2013-05-28 10:30 - 00010735 _____ C:\Users\Lotte und Hendo\Documents\hijackthis.log
2013-08-08 18:06 - 2013-08-08 14:57 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-08-08 16:27 - 2013-08-08 16:27 - 00000000 ____D C:\Users\Lotte und Hendo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-08 16:26 - 2013-08-08 16:26 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-08-08 11:28 - 2013-08-07 23:19 - 00000306 __RSH C:\ProgramData\ntuser.pol
2013-08-08 11:27 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-08-08 11:21 - 2013-08-08 11:21 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\CyberLink
2013-08-08 11:06 - 2013-08-08 11:06 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\WinRAR
2013-08-08 00:13 - 2013-08-08 00:13 - 00000000 ____D C:\Users\Spiele\Downloads\Kaspersky Rescue2Usb
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb.exe
2013-08-08 00:10 - 2013-08-08 00:10 - 00387584 _____ C:\Users\Spiele\Downloads\rescue2usb(1).exe
2013-08-07 23:43 - 2012-04-13 12:02 - 00143328 _____ C:\Users\Spiele\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-07 23:30 - 2013-08-07 23:23 - 00000000 _____ C:\Users\Spiele\Downloads\hirens.bootcd.15.2.zip
2013-08-07 23:18 - 2013-08-08 11:06 - 00469936 _____ (Akeo Consulting (hxxp://akeo.ie)) C:\Users\Spiele\Desktop\rufus_v1.3.4.exe
2013-08-07 07:02 - 2013-08-07 07:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-06 07:18 - 2013-06-19 19:49 - 00000000 ____D C:\Users\Spiele\AppData\Roaming\Skype
2013-07-29 16:58 - 2011-07-26 21:25 - 00000000 ____D C:\Users\Lotte und Hendo\Documents\Bewerbung Robert 2011
2013-07-23 22:26 - 2013-07-23 22:26 - 00000000 ___HD C:\Windows\AxInstSV
2013-07-19 13:30 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-02 22:03

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-08-2013
Ran by Lotte und Hendo at 2013-08-11 20:02:34
Running from C:\Users\Lotte und Hendo\Desktop\Virus-Scanner
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
[verify-U] AVS 2.1.9 (x32 Version: 2.1.9)
64 Bit HP CIO Components Installer (Version: 6.2.1)
7-Zip 9.20 (x32)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 1.5.0.7220)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe Shockwave Player (x32 Version: 11.5.1.601)
AGEIA PhysX v7.09.13 (x32 Version: 7.09.13)
AIO_CDB_ProductContext (x32 Version: 130.0.365.000)
AIO_CDB_Software (x32 Version: 130.0.365.000)
AIO_Scan (x32 Version: 130.0.421.000)
Atheros Driver Installation Program (x32 Version: 9.2)
ATI Catalyst Install Manager (Version: 3.0.754.0)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
BufferChm (x32 Version: 130.0.331.000)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Full New (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Light (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Previews Common (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center InstallProxy (x32 Version: 2009.1124.2131.38610)
Catalyst Control Center Localization All (x32 Version: 2009.1124.2131.38610)
CCC Help Chinese Traditional (x32 Version: 2009.1124.2130.38610)
CCC Help English (x32 Version: 2009.1124.2130.38610)
CCC Help Finnish (x32 Version: 2009.1124.2130.38610)
CCC Help German (x32 Version: 2009.1124.2130.38610)
CCC Help Greek (x32 Version: 2009.1124.2130.38610)
CCC Help Italian (x32 Version: 2009.1124.2130.38610)
CCC Help Japanese (x32 Version: 2009.1124.2130.38610)
CCC Help Korean (x32 Version: 2009.1124.2130.38610)
CCC Help Norwegian (x32 Version: 2009.1124.2130.38610)
CCC Help Polish (x32 Version: 2009.1124.2130.38610)
CCC Help Portuguese (x32 Version: 2009.1124.2130.38610)
CCC Help Swedish (x32 Version: 2009.1124.2130.38610)
CCC Help Turkish (x32 Version: 2009.1124.2130.38610)
ccc-core-static (x32 Version: 2009.1124.2131.38610)
ccc-utility64 (Version: 2009.1124.2131.38610)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Copy (x32 Version: 130.0.428.000)
CyberLink YouCam (x32 Version: 3.0.2201)
Destinations (x32 Version: 140.0.77.000)
DeviceDiscovery (x32 Version: 130.0.465.000)
DHTML Editing Component (x32 Version: 6.02.0001)
Die Sims 2 (x32)
Die Sims™ 2 H&M®-Fashion-Accessoires (x32)
Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires (x32)
Die Sims™ 2 Party-Accessoires (x32)
Digital Trends Club (x32 Version: 12.6.173)
DocProc (x32 Version: 13.0.0.0)
Dream Pinball 3D (x32 Version: 1.10)
Duden Korrektor (x32 Version: 4.00.1301.00)
ElsterFormular für Privatanwender (x32 Version: 12.1.0.6164p)
ESU for Microsoft Windows 7 (x32 Version: 1.0.0)
Eusing Free Registry Cleaner (x32)
F300 (x32 Version: 130.0.365.000)
F300_Help (x32 Version: 82.0.242.000)
F300Trb (x32 Version: 82.0.242.000)
Fax (x32 Version: 130.0.418.000)
GPBaseService2 (x32 Version: 130.0.371.000)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HP Customer Experience Enhancements (x32 Version: 6.0.1.3)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (Version: 13.0)
HP Setup (x32 Version: 1.2.3560.3170)
HP Smart Web Printing 4.51 (Version: 4.51)
HP Solution Center 13.0 (Version: 13.0)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Update (x32 Version: 5.001.000.014)
HP User Guides  (x32 Version: 1.01.0000)
HP Wireless Assistant (x32 Version: 3.50.12.1)
HPPhotoGadget (x32 Version: 130.0.282.000)
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000)
HPPhotosmartEssential (x32 Version: 2.04.0000)
HPProductAssistant (x32 Version: 130.0.371.000)
Imaging Device Functions 13.0 (Version: 13.0)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel® Matrix Storage Manager
Java Auto Updater (x32 Version: 2.0.5.1)
Java(TM) 6 Update 17 (64-bit) (Version: 6.0.170)
Java(TM) 7 (64-bit) (Version: 7.0.0)
Kaspersky Security Scan (x32 Version: 12.0.1.340)
LabelPrint (x32 Version: 2.5.2215)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
MarketResearch (x32 Version: 130.0.374.000)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Works (x32 Version: 08.05.0822)
Microsoft Works (x32 Version: 9.7.0621)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSVCRT (x32 Version: 14.0.1468.721)
MyTomTom 3.1.0.530 (x32 Version: 3.1.0.530)
Network64 (Version: 130.0.572.000)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
PartyPoker (x32)
Picasa 3 (x32 Version: 3.9)
Power2Go (x32 Version: 6.0.3415)
Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.18.322.2010)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6206)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30120)
Recovery Manager (x32 Version: 5.5.2214)
RtVOsd (Version: 1.0.6)
Scan (x32 Version: 140.0.80.000)
SmartWebPrinting (x32 Version: 130.0.457.000)
SolutionCenter (x32 Version: 130.0.373.000)
Spybot - Search & Destroy (x32 Version: 1.6.2)
Status (x32 Version: 130.0.469.000)
Synaptics Pointing Device Driver (Version: 15.1.6.64)
TomTom HOME 2.8.2.2264 (x32 Version: 2.8.2.2264)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
Toolbox (x32 Version: 130.0.648.000)
TrayApp (x32 Version: 130.0.422.000)
TRUST 640U SILVERLINE HEADSET USB (x32)
TweakMe! (x32 Version: 1.2.0.4)
UnloadSupport (x32 Version: 11.0.0)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Visual Studio C++ 10.0 Runtime (x32 Version: 10.0.0)
WebReg (x32 Version: 130.0.132.017)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows Media Center Add-in for Silverlight (x32 Version: 4.7.3.0)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
WinRAR (x32)
WISO Steuer 2012 (x32 Version: 19.00.7303)

==================== Restore Points  =========================

Could not list Restore Points.


==================== Hosts content: ==========================

2009-07-14 04:34 - 2011-10-13 12:14 - 00437925 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {005EFE88-033A-4055-8A3E-1EF850BA8AA1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)
Task: {039BE8B4-502A-4220-A636-29294BB2996B} - System32\Tasks\{24768C28-AE3A-48D2-99E7-168D462E3701} => C:\Program Files (x86)\MyRealGames.com\Air Hawk 2\game.exe No File
Task: {049841AA-907F-47E7-B69B-BD8E9B8BC117} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: {16691879-CEE5-4D7F-AE5B-E1F95FB6ABC7} - System32\Tasks\{6A230290-B824-4598-ABF8-0C8768538572} => C:\Program Files (x86)\Wolfenstein - Enemy Territory\ET.exe No File
Task: {1DF5D1D5-BDAB-4215-883A-28590D5EC550} - System32\Tasks\Games\UpdateCheck_S-1-5-21-371880506-1153370254-2312567730-1003
Task: {210EB13A-05C0-4D24-8CD5-09036C4DD212} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {2FF06835-AAAF-4A19-8127-4B5452BE90CD} - System32\Tasks\{B0307458-48B8-4B88-9279-C0CBFCEBA9D9} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {4E532C6E-3C43-4B6A-8FEA-D08D9E7B7047} - System32\Tasks\{D0A9DE9E-55E2-4F72-87A0-E36794111234} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: {52090785-A956-4B0F-9CA5-F42792CD37B9} - System32\Tasks\{56D3E2A1-6477-4CA7-A5DE-24E05DAF0771} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: {54F4C8DB-8137-4E8C-B86C-F138A5C7C582} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {5A9FD798-8408-4B57-A523-95DF2095D36E} - System32\Tasks\{04118ECF-96A9-4372-9FDE-340DAA29D461} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {88C21B94-3F29-4673-9A72-C46DB4199F3D} - System32\Tasks\{8D7E4CBD-AD0D-45C4-83A9-7A465554E019} => C:\Program Files (x86)\Wolfenstein - Enemy Territory\ET.exe No File
Task: {97A51950-EFD8-45C7-A566-9A0326B8E0FD} - System32\Tasks\Games\UpdateCheck_S-1-5-21-371880506-1153370254-2312567730-1001
Task: {AC025553-B1DF-45E2-B6DE-852E8834BDC5} - System32\Tasks\{6887FA60-1CB6-4832-B5CC-28FF5B67319B} => C:\Program Files (x86)\EA GAMES\Die Sims 2 IKEA® Home-Accessoires\TSBin\Sims2Launcher.exe No File
Task: {B63136B7-2AF2-437D-8B38-CAB57ABD9D39} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-07-29] (Hewlett-Packard)
Task: {B9641A25-B3A2-4CF3-852E-DC9945B7FFC6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-08-04] (Microsoft Corporation)
Task: {CCE79E72-8EC6-465E-8477-BA8013E06EFB} - System32\Tasks\Microsoft\Windows Defender\MpIdleTask => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {E4C92E81-3362-4AC2-87A8-BD017F8D79D3} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {ECC03401-C7AD-4959-8BB4-3DC53A277946} - System32\Tasks\{56CBA466-F975-40E9-9594-68AFA709133A} => C:\Users\Lotte und Hendo\Downloads\OfficialCnCTiberianSun\OfficialCnCTiberianSun\EA Games\Command &amp; Conquer The First Decade\Command &amp; Conquer(tm) Tiberian Sun(tm)\SUN\SUN.EXE No File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/11/2013 08:02:36 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.


Vorgang:
   VSS-Server wird instanziiert

Error: (08/11/2013 08:02:36 PM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} und dem Namen "IVssCoordinatorEx2" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]


Vorgang:
   VSS-Server wird instanziiert

Error: (08/11/2013 07:51:00 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (08/11/2013 04:34:10 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (08/11/2013 04:34:06 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (08/11/2013 10:40:05 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (08/11/2013 10:39:37 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (08/11/2013 00:59:59 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.


Vorgang:
   VSS-Server wird instanziiert

Error: (08/11/2013 00:59:59 AM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} und dem Namen "IVssCoordinatorEx2" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]


Vorgang:
   VSS-Server wird instanziiert


System errors:
=============
Error: (08/11/2013 07:51:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (08/11/2013 07:51:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (08/11/2013 07:51:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (08/11/2013 07:51:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (08/11/2013 07:51:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (08/11/2013 07:51:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (08/11/2013 07:51:17 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (08/11/2013 07:51:16 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (08/11/2013 07:51:16 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (08/11/2013 07:45:05 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 3957.86 MB
Available physical RAM: 2053.34 MB
Total Pagefile: 7913.86 MB
Available Pagefile: 5750.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:284.89 GB) (Free:207.08 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:12.91 GB) (Free:2.15 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32 (Disk=0 Partition=4)
Drive f: (KRD10) (CDROM) (Total:0.28 GB) (Free:0 GB) CDFS
Drive h: (KODAK) (Removable) (Total:1.84 GB) (Free:0.47 GB) FAT (Disk=1 Partition=1)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: CB0F1A13)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=13 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 00000000)
Partition 1: (Active) - (Size=2 GB) - (Type=06)

==================== End Of Log ============================

Liebe Grüße

Robert

10.08.2013, 09:08	#8
schrauber /// the machine /// TB-Ausbilder	Bundestrojaner Win 7 System unsicher Die fixlist muss als fixlist genau da liegen, wo auch FRST ist, also die ausführbare Datei. Und es darf nicht fixlist.txt.txt sein __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

10.08.2013, 10:03	#10
schrauber /// the machine /// TB-Ausbilder	Bundestrojaner Win 7 System unsicher Kannste den Rechner jetzt ganz normal starten? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Bundestrojaner Win 7 System unsicher

Plagegeister aller Art und deren Bekämpfung: Bundestrojaner Win 7 System unsicher