Google-Suchergebnisse führen auf andere Seiten

Molsterpöbel · 03.09.2013, 21:24

Guten Abend!

Ich habe mich jetzt extra hier angemeldet (also bitte habt Nachsehen für Anfängerfehler), weil auf dem Laptop meiner Gutsten seit längerem ein für mich nicht lösbares Browser-Problem kursiert. Ich habe hier zwar schon mindestens einen in analoger Art lautenden Thread gefunden, aber die dort gegebenen Lösungsvorschläge konnte ich nur fragmentartig versuchen nachzuempfinden. Letztlich hat nichts geholfen und deshalb denke ich, wir sollten nochmal ganz von vorn anfangen.

Wo liegt das Problem?
Beim Anklicken von Google-Suchergebnissen wird man hin und wieder (schätzungsweise bei durchschnittlich jedem zweiten bis dritten Anlauf) auf falsche Seiten geleitet. Diese öffnen sich allerdings meistens nicht, man sieht nur die URL oben, z. B. "shootermovies", "ihavenet". Oftmals muss man den Browser auch neustarten, um überhaupt wieder die gewünschte Seite zu erreichen. Passieren tut dies sowohl bei Opera als auch mit Firefox.

Danke für Hilfe!

Gruß,
Molsterpöbel

Hier die Log-Texte:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:12 on 03/09/2013 (Admi)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 03
Ran by Admi (administrator) on NINJA on 03-09-2013 21:15:37
Running from C:\Users\Admi\Downloads\für TrBo
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Validity Sensors, Inc.) C:\Windows\system32\vcsFPService.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Atheros Communications) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
(Dropbox, Inc.) C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files\Mozilla\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla\plugin-container.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-16] (Synaptics Incorporated)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [3666800 2011-01-22] (Dell Inc.)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [627360 2011-05-20] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [379552 2011-05-20] (Atheros Commnucations)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [Adobe Reader Synchronizer] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1272912 2013-05-10] (Adobe Systems Incorporated)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
MountPoints2: {95313474-e502-11e0-8079-806e6f6e6963} - D:\autorun.exe
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [RoxWatchTray] - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] - c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-04-29] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-10-04] ()
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/8
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll (Trend Micro Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll (Trend Micro Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll (Trend Micro Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admi\AppData\Roaming\Mozilla\Firefox\Profiles\6g172uca.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla\firefox.exe

==================== Services (Whitelisted) =================

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-05-20] (Atheros)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-10-04] ()
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-03 21:12 - 2013-09-03 21:12 - 00000000 _____ C:\Users\Admi\defogger_reenable
2013-09-03 21:10 - 2013-09-03 21:10 - 00069513 _____ C:\Users\Admi\Desktop\Anleitung.htm
2013-09-03 21:10 - 2013-09-03 21:10 - 00000000 ____D C:\Users\Admi\Desktop\Anleitung-Dateien
2013-09-03 21:01 - 2013-09-03 21:12 - 00000000 ____D C:\Users\Admi\Downloads\für TrBo
2013-09-03 20:28 - 2013-09-03 20:28 - 00002770 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-09-03 20:28 - 2013-09-03 20:28 - 00000000 ____D C:\Program Files\CCleaner
2013-09-03 20:27 - 2013-09-03 20:27 - 04454952 _____ (Piriform Ltd) C:\Users\Admi\Downloads\ccsetup405.exe
2013-09-03 20:06 - 2013-09-03 20:06 - 00000000 ___RD C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-03 18:18 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-03 18:17 - 2013-09-03 18:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admi\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-03 18:04 - 2013-09-03 20:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Users\Admi\Neuer Ordner
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files\Mozilla
2013-09-03 17:59 - 2013-09-03 17:59 - 22240760 _____ (Mozilla) C:\Users\Admi\Downloads\Firefox Setup 23.0.1.exe
2013-09-03 17:46 - 2013-09-03 17:49 - 00000989 _____ C:\freefallprotection.log
2013-09-03 17:29 - 2013-09-03 17:39 - 00000000 ____D C:\AdwCleaner
2013-09-03 17:26 - 2013-09-03 17:26 - 00000000 ____D C:\windows\system32\IO
2013-09-03 17:12 - 2013-09-03 18:13 - 00000125 _____ C:\Users\Admi\Desktop\laktosefreier Kuchen.html.txt
2013-08-15 12:11 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-08-15 12:11 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-08-15 12:11 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-08-15 12:11 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-08-15 12:11 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-08-15 12:11 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-08-15 12:11 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-08-15 12:11 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-08-15 12:11 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-08-15 12:11 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-08-15 12:11 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-08-15 12:11 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 18:47 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-08-14 18:47 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-08-14 18:47 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-08-14 18:47 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-08-14 18:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-08-14 18:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-08-14 18:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-08-14 18:47 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-08-14 18:47 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-08-14 18:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-08-14 18:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-08-14 18:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-08-14 18:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-08-14 18:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-08-14 18:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-08-14 18:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-08-14 18:47 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-08-14 18:47 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-03 21:14 - 2013-09-03 21:14 - 00000000 ____D C:\FRST
2013-09-03 21:12 - 2013-09-03 21:12 - 00000000 _____ C:\Users\Admi\defogger_reenable
2013-09-03 21:12 - 2013-09-03 21:01 - 00000000 ____D C:\Users\Admi\Downloads\für TrBo
2013-09-03 21:12 - 2011-10-11 16:02 - 00000000 ____D C:\Users\Admi
2013-09-03 21:10 - 2013-09-03 21:10 - 00069513 _____ C:\Users\Admi\Desktop\Anleitung.htm
2013-09-03 21:10 - 2013-09-03 21:10 - 00000000 ____D C:\Users\Admi\Desktop\Anleitung-Dateien
2013-09-03 21:08 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 21:08 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 20:43 - 2012-03-30 17:48 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 20:36 - 2012-02-02 23:25 - 00000000 ____D C:\windows\Minidump
2013-09-03 20:36 - 2011-11-19 21:41 - 00000000 ____D C:\Users\Admi\Tracing
2013-09-03 20:36 - 2011-10-12 16:00 - 00000000 ____D C:\Users\Admi\AppData\Local\CrashDumps
2013-09-03 20:36 - 2011-02-23 15:08 - 00000000 ____D C:\windows\Panther
2013-09-03 20:28 - 2013-09-03 20:28 - 00002770 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-09-03 20:28 - 2013-09-03 20:28 - 00000000 ____D C:\Program Files\CCleaner
2013-09-03 20:27 - 2013-09-03 20:27 - 04454952 _____ (Piriform Ltd) C:\Users\Admi\Downloads\ccsetup405.exe
2013-09-03 20:13 - 2011-09-22 14:57 - 00719614 _____ C:\windows\system32\perfh007.dat
2013-09-03 20:13 - 2011-09-22 14:57 - 00157298 _____ C:\windows\system32\perfc007.dat
2013-09-03 20:13 - 2009-07-14 07:13 - 01675454 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-03 20:09 - 2011-09-22 12:08 - 01151057 ____N C:\windows\WindowsUpdate.log
2013-09-03 20:07 - 2011-11-15 21:27 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Dropbox
2013-09-03 20:06 - 2013-09-03 20:06 - 00000000 ___RD C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-09-03 20:06 - 2011-11-15 21:32 - 00000000 ___RD C:\Users\Admi\Dropbox
2013-09-03 20:05 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-03 20:05 - 2013-03-21 15:28 - 00000302 _____ C:\windows\Tasks\oijjby.job
2013-09-03 20:05 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-03 18:17 - 2013-09-03 18:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admi\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-03 18:13 - 2013-09-03 17:12 - 00000125 _____ C:\Users\Admi\Desktop\laktosefreier Kuchen.html.txt
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Users\Admi\Neuer Ordner
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files\Mozilla
2013-09-03 18:04 - 2011-10-11 16:19 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Mozilla
2013-09-03 17:59 - 2013-09-03 17:59 - 22240760 _____ (Mozilla) C:\Users\Admi\Downloads\Firefox Setup 23.0.1.exe
2013-09-03 17:58 - 2013-04-23 11:16 - 00000000 ____D C:\Program Files (x86)\Opera
2013-09-03 17:49 - 2013-09-03 17:46 - 00000989 _____ C:\freefallprotection.log
2013-09-03 17:47 - 2011-09-22 12:12 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-03 17:39 - 2013-09-03 17:29 - 00000000 ____D C:\AdwCleaner
2013-09-03 17:26 - 2013-09-03 17:26 - 00000000 ____D C:\windows\system32\IO
2013-09-03 17:21 - 2013-02-20 12:26 - 00000000 ____D C:\Program Files\Canon
2013-09-03 16:08 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-09-03 15:01 - 2013-04-23 11:18 - 00000000 ____D C:\Users\Admi\Desktop\Sonstiges
2013-09-03 14:59 - 2011-09-22 12:50 - 00000000 ____D C:\ProgramData\Sonic
2013-09-02 23:14 - 2011-10-11 16:06 - 00000000 ____D C:\Users\Admi\Documents\Bluetooth Folder
2013-09-02 14:34 - 2013-05-13 08:56 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-02 14:34 - 2013-03-29 11:29 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-02 14:34 - 2013-03-29 11:29 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-02 08:27 - 2012-06-26 21:53 - 00000000 ____D C:\Users\Admi\Documents\DLC
2013-09-02 08:26 - 2013-05-30 18:38 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-08-24 21:09 - 2012-10-04 22:26 - 00000000 ____D C:\Users\Admi\AppData\Roaming\ICQ
2013-08-20 21:43 - 2012-03-30 17:48 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-20 21:43 - 2012-03-30 17:48 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-08-20 21:43 - 2011-10-18 20:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-15 12:06 - 2011-10-15 12:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 12:05 - 2011-10-19 18:10 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-08-07 11:32 - 2013-05-22 15:06 - 00003440 _____ C:\windows\System32\Tasks\PCDEventLauncherTask
2013-08-05 20:22 - 2013-03-14 21:21 - 00000240 _____ C:\Users\Admi\Spiele.ini

Files to move or delete:
====================
C:\Users\Admi\Hangdat.exe
C:\Users\Admi\Hangman.dat
C:\Users\Admi\Hangman.exe
C:\Users\Admi\Kaese.exe
C:\Users\Admi\Knack.exe
C:\Users\Admi\Kniffel.exe
C:\Users\Admi\Mad.exe
C:\Users\Admi\Master.exe
C:\Users\Admi\Memory.exe
C:\Users\Admi\PCQuiz.dat
C:\Users\Admi\PCQuiz.exe
C:\Users\Admi\PCRoul.exe
C:\Users\Admi\Puzzle.exe
C:\Users\Admi\Schiffe.exe
C:\Users\Admi\Spiele.exe
C:\Users\Admi\Uninstal.exe
C:\Users\Admi\AppData\Local\Temp\Quarantine.exe
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\mcbrwsr2.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerRes.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerRes_LD.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerStartup.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McUICnt.exe
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\SecurityScanner.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-03 16:01

==================== End Of Log ============================

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-03 21:53:40
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AK1 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Admi\AppData\Local\Temp\uxldqpow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544                                                                                     fffff800031be000 65 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 610                                                                                     fffff800031be042 4 bytes [00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[1288] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                            0000000077c11465 2 bytes [C1, 77]
.text     C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[1288] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                           0000000077c114bb 2 bytes [C1, 77]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1352] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          0000000077c11465 2 bytes [C1, 77]
.text     C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1352] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         0000000077c114bb 2 bytes [C1, 77]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[2080] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                        0000000077c11465 2 bytes [C1, 77]
.text     C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[2080] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                       0000000077c114bb 2 bytes [C1, 77]
.text     ...                                                                                                                                                    * 2
?         C:\windows\system32\mssprxy.dll [2608] entry point in ".rdata" section                                                                                 00000000749f71e6
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3084] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000077c11465 2 bytes [C1, 77]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3084] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000077c114bb 2 bytes [C1, 77]
.text     ...                                                                                                                                                    * 2
.text     C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe[4620] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 69                                    0000000077c11465 2 bytes [C1, 77]
.text     C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe[4620] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 155                                   0000000077c114bb 2 bytes [C1, 77]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[4652] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                            0000000077c11465 2 bytes [C1, 77]
.text     C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[4652] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                           0000000077c114bb 2 bytes [C1, 77]
.text     ...                                                                                                                                                    * 2

---- Threads - GMER 2.1 ----

Thread    C:\windows\SysWOW64\rundll32.exe [1628:1744]                                                                                                           0000000000206390
Thread    C:\windows\SysWOW64\rundll32.exe [1628:1748]                                                                                                           0000000000183a80
Thread    C:\windows\SysWOW64\rundll32.exe [1628:1888]                                                                                                           0000000000183a10
Thread    C:\windows\SysWOW64\rundll32.exe [1628:4980]                                                                                                           000000000037832b
Thread    C:\windows\SysWOW64\rundll32.exe [1628:4948]                                                                                                           0000000000375514
Thread    C:\windows\SysWOW64\rundll32.exe [1628:4944]                                                                                                           0000000000375a5e

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015007f6c3b                                                                            
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\9439e5209566                                                                            
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\9439e5209566@0023d7535fda                                                               0xE2 0xBA 0x48 0x0E ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc7737048afc                                                                            
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015007f6c3b (not active ControlSet)                                                        
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\9439e5209566 (not active ControlSet)                                                        
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\9439e5209566@0023d7535fda                                                                   0xE2 0xBA 0x48 0x0E ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc7737048afc (not active ControlSet)                                                        

---- EOF - GMER 2.1 ----

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2013 03
Ran by Admi at 2013-09-03 21:16:50
Running from C:\Users\Admi\Downloads\für TrBo
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
64 Bit HP CIO Components Installer (Version: 8.2.2)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)
Advanced Audio FX Engine (x32 Version: 1.12.05)
Age of Empires III (x32 Version: 1.00.0000)
Anno 1602 (x32)
Avira Antivirus Premium (x32 Version: 13.0.0.4052)
Bluetooth Win7 Suite (64) (Version: 7.2.0.83)
Canon IJ Scan Utility (x32)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (x32 Version: 4.0.0)
Canon Kurzwahlprogramm (x32 Version: 1.3.0)
Canon MX390 series Benutzerregistrierung (x32)
Canon MX390 series MP Drivers (Version: 1.00)
Canon MX390 series On-screen Manual (x32 Version: 7.6.0)
Canon My Image Garden (x32 Version: 1.1.0)
Canon My Image Garden Design Files (x32 Version: 1.0.1)
Canon My Printer (x32 Version: 3.1.0)
Carcassonne (x32)
CyberLink PowerDVD 9.5 (x32 Version: 9.5.1.3225)
D3DX10 (x32 Version: 15.4.2368.0902)
Dell Backup and Recovery Manager (Version: 1.3)
Dell Edoc Viewer (Version: 1.0.0)
Dell Touchpad (Version: 15.2.5.2)
Dell Webcam Central (x32 Version: 2.00.44)
Dell WLAN and Bluetooth Client Installation (x32 Version: 9.0)
Die Sims (x32)
DigitalPersona Fingerprint Software 5.20 (Version: 5.20.230)
DirectX 9 Runtime (x32 Version: 1.00.0000)
Dropbox (HKCU Version: 2.0.22)
eaner (Version: 4.05)
Guard.ICQ (x32)
ICQ 7.8 Build #6800 Banner Remover 1.0 (x32)
ICQ7M (x32 Version: 7.8)
IDT Audio (x32 Version: 1.0.6324.0)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2361)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.0.1008)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Logitech Unifying-Software 2.00 (Version: 2.00.43)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 1.1 (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Age of Empires (x32)
Microsoft Age of Empires Expansion (x32)
Microsoft Age of Empires II (x32)
Microsoft Age of Empires II: The Conquerors Expansion (x32)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
My Dell (Version: 3.3.6280.92)
p.i.c.s. Spielesammlung (x32)
Pando Media Booster (x32 Version: 2.6.0.6)
PhotoShowExpress (x32 Version: 2.0.063)
Quickset64 (Version: 10.09.20)
Railroad Tycoon II - Platinum (x32)
RBVirtualFolder64Inst (Version: 1.00.0000)
Realtek Ethernet Controller Driver (x32 Version: 7.31.1025.2010)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30126)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0)
Rossmann Fotowelt Software 4.12.1 (x32 Version: 4.12.1)
Roxio Activation Module (x32 Version: 1.0)
Roxio BackOnTrack (x32 Version: 1.3.3)
Roxio Burn (x32 Version: 1.8)
Roxio Creator Starter (x32 Version: 1.0.439)
Roxio Creator Starter (x32 Version: 12.1.77.0)
Roxio Creator Starter (x32 Version: 5.0.0)
Roxio Express Labeler 3 (x32 Version: 3.2.2)
Roxio File Backup (Version: 1.3.2)
Skat24sv (x32)
Skype™ 6.6 (x32 Version: 6.6.106)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Validity Sensors DDK (Version: 4.3.108.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => start w32time task_started
Task: {2FFC4E11-98E4-4E50-B6DA-9AD683627C08} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-20] (Adobe Systems Incorporated)
Task: {385760C7-35FB-4CF7-96A9-CC6F0284C710} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-05-07] (PC-Doctor, Inc.)
Task: {44CE376F-6845-4012-BC18-B8A6124B2097} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {72ACF2B8-593C-443A-A08B-DCEB43FD1CF5} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {835B38ED-DB15-4EFF-A21B-13281850FEF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)
Task: {97FCADF6-D002-4AA6-A1C0-6D7576F031DA} - System32\Tasks\oijjby => C:\windows\SysWOW64\kbdnecx.dll [2013-03-21] ()
Task: {AC1EB3CD-167B-47AD-AD87-449BE0DF30B0} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-07-18] (PC-Doctor, Inc.)
Task: {C72A4A25-FAC5-4308-9985-C40EB9FC08CD} - System32\Tasks\SystemToolsDailyTest => C:\Windows\System32\uaclauncher.exe No File
Task: {C9FDD39C-0C0D-493C-A9EC-79AB5B701A18} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => start osppsvc
Task: {F08B39AE-BD84-470B-8ABF-DDD1DFF94538} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-21] (Microsoft Corporation)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\oijjby.job => C:\windows\SysWOW64\kbdnecx.dll

==================== Loaded Modules (whitelisted) =============

2009-07-14 02:18 - 2009-07-14 03:38 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\imaadp32.acm
2009-07-14 02:18 - 2009-07-14 03:38 - 00014848 _____ (Microsoft Corporation) C:\windows\system32\msg711.acm
2009-07-14 02:18 - 2009-07-14 03:38 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\msgsm32.acm
2009-07-14 02:18 - 2009-07-14 03:38 - 00024064 _____ (Microsoft Corporation) C:\windows\system32\msadp32.acm
2009-07-14 02:22 - 2009-07-14 03:38 - 00081408 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00061088 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthCopyHook.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00315552 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\FolderViewImpl.dll
2010-11-11 05:53 - 2010-11-11 05:53 - 00817136 _____ () c:\Program Files\Roxio\Roxio Burn\RBVirtualFolder64.dll
2011-09-22 14:33 - 2011-04-10 21:13 - 00335872 _____ (Intel Corporation) C:\Windows\system32\igfxpph.dll
2011-09-22 14:33 - 2011-04-10 21:13 - 00286720 _____ (Intel Corporation) C:\windows\system32\igfxrDEU.lrc
2010-11-21 05:24 - 2010-11-21 05:24 - 00145920 _____ (Microsoft Corporation) C:\windows\system32\SPPC.DLL
2011-09-22 14:33 - 2011-04-10 20:40 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-09-22 12:23 - 2011-01-25 11:57 - 04637184 _____ (IDT, Inc.) C:\Program Files\IDT\WDM\STLang64.dll
2011-09-22 12:23 - 2011-01-25 11:57 - 00651776 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2011-09-22 14:35 - 2010-12-16 05:53 - 00404776 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2011-09-22 14:35 - 2010-12-16 05:53 - 00216360 _____ (Synaptics Incorporated) C:\windows\system32\SynTPAPI.dll
2011-05-20 18:16 - 2011-05-20 18:16 - 00066720 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Sync.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00073888 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\GOEP_SINGLE.DLL
2011-05-20 18:15 - 2011-05-20 18:15 - 02234016 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\OutLookLib.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00119456 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\L2capLib.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00043680 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BTBIP.DLL
2011-05-20 18:16 - 2011-05-20 18:16 - 00081056 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\RfcommLib.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00044704 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BPP.DLL
2011-05-20 18:15 - 2011-05-20 18:15 - 00079520 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\GOEP_bpp.DLL
2011-05-20 18:15 - 2011-05-20 18:15 - 00079008 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Handsfree.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00207520 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtObexFt.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00029856 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtFileStore.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00208544 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BTOBEXOP.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00030368 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtFileStoreOpp.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00072864 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\goep.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00305824 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\filetransfer.dll
2011-05-20 18:16 - 2011-05-20 18:16 - 00140448 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\skypeagent.dll
2011-05-20 18:15 - 2011-05-20 18:15 - 00118944 _____ (Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\ObjPush.dll
2011-09-22 12:13 - 2009-09-08 17:01 - 00237056 ____N (Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\CTLoadRs.dll
2009-07-14 01:26 - 2009-07-14 03:41 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\Nlsdl.dll
2011-09-22 12:13 - 2010-07-22 20:01 - 00065536 ____N (Creative Technology Ltd.) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\CtPinMgr.dll
2013-08-20 21:45 - 2013-08-20 21:45 - 00475648 _____ (Intel Corporation) C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\2b87cb064e64ff40778ca12322abb710\IAStorUtil.ni.dll
2011-09-22 12:15 - 2010-11-06 06:50 - 00032768 _____ (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\de-DE\IAStorIcon.resources.dll
2011-09-22 12:15 - 2010-11-06 06:50 - 01109504 _____ (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IntelVisualDesign.dll
2011-09-22 12:15 - 2010-11-06 06:50 - 00004608 _____ (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\de-DE\IntelVisualDesign.resources.dll
2013-07-12 13:58 - 2013-07-12 13:58 - 00014336 _____ (Intel Corp.) C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\14dd60b57c8e7542cc9711866ef63e8a\IAStorCommon.ni.dll
2011-09-22 12:15 - 2010-11-06 06:50 - 00164864 _____ (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorUIHelper.dll
2010-11-17 19:52 - 2010-11-17 19:52 - 00096904 _____ (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.dll
2010-11-09 18:59 - 2010-11-09 18:59 - 04479472 _____ (Sonic Solutions) C:\Program Files (x86)\Roxio\OEM\Roxio Burn\AS_Storage_w32.dll
2012-11-28 16:49 - 2012-10-16 09:39 - 00561664 _____ (Microsoft Corporation) C:\windows\AppPatch\AcLayers.DLL
2010-11-25 05:34 - 2010-11-25 05:34 - 00632304 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\homepermitsconfig13.dll
2010-11-22 20:27 - 2010-11-22 20:27 - 00190960 _____ (Roxio, Inc.) c:\program files (x86)\common files\roxio shared\dllshared\rsl.dll
2010-11-25 05:44 - 2010-11-25 05:44 - 00375280 _____ () c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll
2010-11-22 20:27 - 2010-11-22 20:27 - 00186864 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\rcsl.dll
2010-11-25 05:35 - 2010-11-25 05:35 - 00961008 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\SonicHTTPClient13.dll
2010-11-25 05:35 - 2010-11-25 05:35 - 00712688 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\SonicLicenseManager13.dll
2009-07-14 02:09 - 2009-07-14 03:41 - 00018944 _____ (Microsoft Corporation) C:\windows\system32\netbios.dll
2010-05-10 08:01 - 2010-05-10 08:01 - 00100848 _____ (Sonic Solutions) C:\Program Files (x86)\Common Files\PX Storage Engine\vxblock.dll
2010-11-25 09:36 - 2010-11-25 09:36 - 00100848 _____ (Sonic Solutions) c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\DLLShared\cdral.DLL
2009-07-14 01:50 - 2009-07-14 03:32 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\security.dll
2012-11-14 01:32 - 2012-11-14 01:32 - 03558400 _____ (wxWidgets development team) C:\Users\Admi\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\Admi\AppData\Roaming\Dropbox\bin\libcef.dll
2013-03-13 22:48 - 2013-03-13 22:48 - 09956864 _____ (The ICU Project) C:\Users\Admi\AppData\Roaming\Dropbox\bin\icudt.dll
2013-09-03 18:04 - 2013-08-14 19:55 - 03551640 _____ () C:\Program Files\Mozilla\mozjs.dll
2013-08-20 21:43 - 2013-08-20 21:43 - 16166280 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/03/2013 08:06:52 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 05:41:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 05:28:55 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (09/03/2013 04:04:42 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (09/03/2013 02:58:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 11:01:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 07:50:00 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 02:27:59 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 08:23:03 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/01/2013 09:03:55 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/19/2013 00:16:41 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (08/17/2013 09:36:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/17/2013 09:36:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/17/2013 09:36:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/17/2013 09:36:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/17/2013 09:36:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/17/2013 09:36:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/17/2013 09:36:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/17/2013 09:36:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/17/2013 09:36:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mozilla Maintenance Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 44%
Total physical RAM: 4003.18 MB
Available physical RAM: 2233.77 MB
Total Pagefile: 8004.54 MB
Available Pagefile: 5754.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:451.01 GB) (Free:397.88 GB) NTFS
Drive d: (AOE) (CDROM) (Total:5.1 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 675BA925)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 03.09.2013, 21:30

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit MBAR machen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Molsterpöbel · 04.09.2013, 21:52

Danke für die schnelle Reaktion. Also es gibt sonst keine Logs, die ich anbieten könnte. Dieses Malware Rootkit Dingens, was ich ausführen sollte, hat keinerlei Malware gefunden und dementsprechend konnte auch nichts gefixt werden. Ein Log ließ sich auch nicht erstellen, keine Ahnung, ob es nur geht, wenn Fehler gefunden wurden...

Was nun?

Grüße, Molsterpöbel

cosinus · 05.09.2013, 09:21

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Molsterpöbel · 06.09.2013, 11:18

Mahlzeit,

hier die gewünschten Logs:

Code:

ATTFilter

# AdwCleaner v3.002 - Bericht erstellt am 06/09/2013 um 11:51:52
# Updated 01/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Admi - NINJA
# Gestartet von : C:\Users\Admi\Downloads\für TrBo\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Mozilla Firefox v23.0.1 (de)

[ Datei : C:\Users\Admi\AppData\Roaming\Mozilla\Firefox\Profiles\6g172uca.default\prefs.js ]


*************************

AdwCleaner[R1].txt - [805 octets] - [06/09/2013 11:50:34]
AdwCleaner[S1].txt - [727 octets] - [06/09/2013 11:51:52]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [786 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.8 (09.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Admi on 06.09.2013 at 11:59:49,52
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{008E588E-90AC-4903-917B-30FC066AF871}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{00A5369B-55A7-4615-AA7C-8FE095761E21}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{00B67C83-FFA0-480E-A0E7-532DFA23481D}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{02629A87-46E8-4E99-B4CF-9A44B981EF53}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{04ACC155-5213-43A3-8BBB-B1CBDC261652}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{05D4D1BC-08DD-43D8-ADC1-20E317E1B715}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{07694111-B304-48E9-A26E-86F89B49D6EA}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{0A5A95FE-27A0-4B9D-A27F-B6041258279A}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{0C10FF58-84D4-4648-AF66-2F99A6997589}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{0D817292-CC6E-42E2-9DCE-3E3176BD5490}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{0E6435CB-9F89-48C7-A34F-E0B7DE2E61C5}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{0EAF4A03-0369-4DE3-B02D-E55768F80641}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{1021CC83-D579-461C-AD22-976850FC1757}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{109FD10B-0FD0-44C9-8F72-CF8EF9B0CBB5}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{12408EB0-0534-4FB7-8D6A-F5CE9612473C}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{15DA5B93-5E4B-4CCA-B2C9-02070569B4DD}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{18538E8F-59C7-4A4E-AF2A-E08B7E1D8733}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{188D090D-DB1A-41FB-A44C-383FD6391A3C}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{18F7B2D0-821F-4A64-BC0A-CB31BDA16EFE}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{1BA9983C-D894-4391-B093-B8AA7C27FE51}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{1C88C820-AE93-4202-9829-443EB4C1217B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{1D819C07-1EB9-431C-AD9C-819BE620A843}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{1D887706-38EF-4066-AD75-CB8156DB1912}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{1EE86831-367A-474A-B28F-3B8C3C8AE4D3}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{1F3BBCD4-B635-44D0-86FE-40781A694C7E}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{21A59B90-4363-450D-A3CF-EDB4F2692330}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2220E47B-DB2D-458C-8C3F-C0398C649941}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2351D71B-4B5C-4C4C-8FC1-397298E4E553}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{25D4D80F-68A3-4546-B9B8-C5691DBBC34B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{25D51212-8F56-4674-9409-707E324DB119}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{26B13B57-5E7D-4C86-BD3A-42E0D4E80EB4}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{276EFE68-8649-440D-A1C7-916A47FD0386}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2796BA59-36D9-43B1-B78B-91CEE5938C80}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2861C522-9888-44A2-8EFE-CD9532CF1BB9}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{289E49E4-6C51-4C64-BC25-FE0C97C644BB}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{28E10A9D-59A2-424F-9619-511AB62EEE28}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{29B16758-8B30-4068-85F2-72EEA59A6A33}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2A23BD20-7661-4219-81D1-09D82F940A93}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2A5EA10C-91F0-4EAE-864A-B1284E5E8AF4}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2AB751BF-ED8F-4E23-BFDB-6E13841323D1}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2E3E1B71-AC32-4D1C-8CE9-27A09B843B70}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{2FD429BF-8857-4B32-B28E-9541FCDA5757}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{310BC766-7229-44EB-9483-2751EF49A4BE}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{31C10D99-7E89-464D-A4DC-8C185E812E53}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{31F15D86-736A-4FFC-A767-696FF74B9BD7}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{36F7E9D2-4B74-46B9-AB0B-40295EB57C7E}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{392817C1-C5E7-4FED-82B6-0FC52D8A4334}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{39302693-B704-4112-9125-840EE9455999}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{3D689893-DEEA-4616-BEAF-621EAC4C51B1}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{3D82BD04-E36B-43FA-B2B9-47383A47450F}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{3E1D8432-BF58-4B6A-B14C-BAEEF98B1E52}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{3E71A67F-1A34-4B86-A8C3-7C097E0B2EA6}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{3E9C6D7F-1130-4C50-94CF-796FD1676432}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{3F741751-0FEF-4D80-B4D1-BA42965E5DC5}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{403D9C7A-550E-4EF1-B4D6-F9E4EF3418FD}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{40ADEB1B-6964-4AC1-9020-7A7D343A9277}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{40F8D0BF-460C-43DD-B100-A498D268C174}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{4191422B-6E12-41E6-BD3A-ED57B46001C8}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{429DA881-D4FC-4333-B45D-8BD5974178AA}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{42E26A49-94E0-43B5-BE0E-21D3A04F9287}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{42F44714-0FBB-46C6-A667-249FC5AB8D75}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{43218C4E-5038-4912-B35C-9C47B2ADEE2F}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{44B795B7-DF97-4465-AF59-A4BF4C16D4D2}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{45F51694-5B5C-4DF9-8D46-8542E39C7D49}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{48BD650A-CDA8-42E3-98F4-F019AB1B018D}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{4BAC299A-CD40-41FB-9910-4990AF24CC0C}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{4C1FDB95-FC81-46BB-B91C-B62D3566AAC2}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{4C903E9D-E3D7-46C9-B79F-B29ECC4BE96F}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{4C9470B1-2EA4-4C3E-97EB-D71D7CED99AE}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{4E11CDFF-620A-4670-9051-0B1B9F539F12}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{4ECF6978-8C45-4E8B-ACE2-EEA75AE2421E}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{4F106537-31AE-4247-8832-8BFFFB8CFAE1}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{509E086E-BA13-4AFA-B1DE-091FC8C0B89B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{51D53C22-94ED-4AE6-94C3-6258E4680169}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{51F737A1-5F1E-406D-B95A-7B4C263284E4}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{5405135B-F8E4-4566-8E2D-F2BA8453B882}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{5511077B-A192-4971-873A-1581192259B1}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{57037E17-C57D-4A6E-8864-1EE648C33A87}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{57CA448A-918E-4E1A-BE87-48FEB3C545B1}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{58D2B5EB-208A-45F5-AF5C-751EEB46FEDF}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{59FAFFC8-6434-43E9-BA0C-830770E8DA98}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{5AEB478A-1EE9-46B9-848B-7EB76C240AE4}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{5E8658E1-10F5-4D25-844E-D40BDB5A2ADC}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{5E90272B-D208-4C83-9702-CA08BF040D60}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{5EC1D814-AEAA-4AAC-9244-B9B4A0B0A2C9}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{5FD9A061-81CA-4DD3-8062-62610F2028E4}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{5FF63C50-F643-40BC-8EA2-6B1D8F7C3EF1}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{60E31AF3-3708-42ED-9B49-D2CB06172880}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{617AC70C-C152-42DC-B3E6-948784908C65}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{62B78A70-8F1A-4744-8C05-3E3D49388CF0}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{62F83A90-A1E9-480A-83AC-6BAE8543DFE0}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{64DFE381-D6FC-4F37-8C4A-735D7F5B5750}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{6730855C-E751-487E-8938-821F8F318F66}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{67AEE49D-E126-4D34-8B5D-8643E027F6BA}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{6C323D28-2FE8-4FFC-B32F-437068A8AD2F}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{6D34DC0D-5209-4806-9949-20C1B7ACAF00}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{6D4A94C1-2EF6-47E9-972F-22BD18CCF9AE}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{6E7C583B-64B5-454C-A0D4-424E25E58B35}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{6F396830-9991-4D9F-91C1-641A1BCAEB84}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{71227316-D226-474A-98B5-54380B76C023}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{71C626C7-96E1-4EA3-B825-F453BD733961}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{72FEFACD-D12E-4EE4-BECD-1A2F938B75B4}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{75241BDA-CE23-451C-8584-97661F1C3DCF}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{77B631BE-E370-424F-80F3-5812FA2D08BC}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{7A3C9C1E-3575-4213-9346-66D970C82839}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{7AA7414F-60DD-453D-A4D6-CA17F8048739}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{7B0EACEA-E9AB-405B-BC10-A843939ED42D}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{7B37654C-98C9-4A27-8610-F1036920912F}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{7C3A2D70-E327-475C-B481-C3200E0BD12B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{7E749EE7-B92D-47C2-864D-B0BCD7236D01}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{7F296554-0134-4398-8032-DD61A9E71A13}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{802A2F26-A0CD-4BA5-BA88-1173B67FB042}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{80AE2D3B-AB8F-4BDF-89E7-83523B4CC306}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{82754DB5-CBE9-4301-9632-5200C5603AC1}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{84460166-240D-4D57-989D-3C1941B50E63}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8474C642-AFC3-430C-9C47-550EA44D4566}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8482CD29-D27C-4DE4-AF72-6DA94F922EB6}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8484E0C9-D684-44D8-BFE9-509D1196F7A7}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8851B478-1746-4B54-8C0B-4907AA126C10}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8AF5F07E-5A3E-4D5C-B81E-66A1171DA52B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8B646790-A343-4B1F-BB5D-429E09597E49}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8B98B135-872C-49E8-B9C5-BCA492285283}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8BD811DE-4528-4E76-9482-10046A8659DE}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8BEE7CBF-5CE8-4BE2-9DC0-99F8D223E059}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8C59909D-2B5E-4556-83C9-2CB4FD37717A}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8D1E70AA-03D1-4A0D-9CDB-5D1A3ECF3BED}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{8DF165C0-D6C2-4862-9B5C-29BB3F2907CC}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{9075D887-901F-4A3E-90B1-13FA39CA7662}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{907F2F02-E694-4D0D-B5EB-D08563FF56E7}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{95983636-1BD0-44D5-ABF4-C9868535CDB8}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{9645E404-F532-41F6-9F12-2914B72673A8}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{96A10ED6-26D3-4EC0-8ED1-07F63065FFD3}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{98EFB221-3A20-4578-A70D-82FDCDB08F1C}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{9A85E09C-B585-4E40-977B-9EBC5C169B32}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{9B2A6457-B284-428E-BE05-37FB7879E3F0}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{9D08B36D-F294-4C57-AE2E-A281814E224C}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{9E8600C8-44F2-4CA2-9372-611A95738AA7}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{9E877A58-0CF8-49FA-81D6-098388145D4A}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{9EB1B2E0-3B2D-4DFC-B647-B370C142331B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{A157B1C6-2F69-497A-AEA6-A273B7E73A27}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{A2114A06-6BC8-4F62-BFD5-5297E425E161}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{A4784819-525B-495D-8816-5046A9A7F3FE}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{A5B92C11-FC2D-4A8A-9666-E5272116AE5E}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{A5D1D21B-3AFF-4F37-BC34-7523D93A9B97}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{A69A338E-C1B6-4155-8FBE-A2053182B145}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{A6A4B5D3-D209-4B80-9F5D-57672BAF7DDF}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{A91EB5A4-083C-43E8-9822-A29A93CB2D4B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{AA3C656D-AA50-4ACF-A36E-7D175B52DC3F}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{AD01FDBC-D4BC-42A3-8858-83207FFE50CD}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{AD3A6666-04A1-4888-BCF1-C43B2A7020A9}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{AD9A3C95-A859-4268-A011-58E7831CC1F8}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{AE11EC19-E943-4F81-A5AD-9A32AEC9F245}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{AF0ED02E-BB1B-4D7E-A0C0-97BBE2D10401}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{AF33EB49-1CD8-49E3-B8FA-4AD0449BFBC9}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{B03B0597-E676-4A9D-93F7-097A31817A79}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{B19842EA-AD80-4D82-BD5A-5DFE3685A49E}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{B23532AF-9E16-4A66-85CA-4EDD2F07849A}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{B41A7D9E-311B-4C93-9267-E395D006E2D6}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{B4DAD5BC-72A5-4361-BFF5-CC001FC19C38}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{B9FA1749-9918-44A3-8707-E7F5663AC896}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{BDB70F92-EB95-4519-8C87-8AD855C971C7}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{C0396922-701C-43D4-8923-29C6531C089D}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{C0E3C290-B6C4-4233-B0AA-3B6D8F9F9C19}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{C1D53A77-5841-4E38-B114-081691F6F0DF}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{C2F34DD0-A1F0-4A71-AD63-DB516F57B0F2}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{C55C1FFB-FCDD-476B-95AF-C7C475259A75}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{C83E35D7-4E95-4B10-8B90-E92D7AA4BE4A}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{C8FDCC2A-0797-48B9-AA8F-6C6EAEC7A7DC}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{CD0C70C7-E261-4B97-B70D-BB87F04C775B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{CDF51611-82B4-485F-892D-512F1CD173ED}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{CFBABF6D-9E7B-48D3-BAE4-22C40C668F89}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D04F6C95-157B-4207-A3EC-F9BE1C980A8C}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D16C0529-5A66-4CD6-BFEC-910DC8A74BB5}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D239430A-AB50-472F-959A-1CF141FDC583}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D304DE26-3879-4563-99B8-5532FA8E9556}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D31EC85B-EF04-4021-BF54-560C0C493F8E}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D533809C-3CDC-427D-994D-C25DCC0D8AA1}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D6256F32-F488-4CE9-BDD8-0ABA32648755}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D686A581-1533-4E48-ABD4-9A023806B2DF}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D715485C-C0F1-4BE4-BC71-828A562424CB}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D7892429-C487-4074-96D5-D43120AB810B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D83453D0-CE2E-47C7-8B7F-5DC1AD7F12A8}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D85F404C-4D82-409C-B258-548EE1757F25}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{D998ED0B-FB34-4EBA-AFA9-F7D5EE366100}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{DB51CA96-546D-4226-92E7-824E8E78FEE5}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{DB96AC3D-085D-42A0-8E5F-0F9CBFF3A4A8}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{DCACAF29-148F-4FC4-AFEE-E3E60A71D334}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{E16FDB37-D785-4316-BDAB-8E2ED67E5F50}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{E22C41C1-C834-4AD3-8762-0227A11DC5F6}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{E4F3C17D-B735-426F-AEA8-B42678B97513}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{E5A88832-A3E1-4E35-B0B0-E9541448E1CC}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{E631CBC2-5B98-4C27-A9B7-2D2A863360C0}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{E6F3E0A5-6500-4820-B237-31D0C0FA03EC}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{E75065FF-57FC-4744-AEB6-5331344BA6D7}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{EAD9786C-EAA2-46E6-9537-E05EA8397F59}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{EB484844-D44C-443C-B652-374954F20CAA}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{EC29E4C2-682E-4DDC-9685-18B3EF592E4E}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{EE4CDCC0-338F-4CC4-B2BC-ED7B84DF0E40}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{EF9582A5-5551-4662-95C8-CF51285D75A8}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{F39986A3-4F21-4203-BF19-32FC1D5D28B4}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{F4657895-4FB7-47BB-940C-5D09820FE923}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{F5401D91-EFB3-42DB-AE2F-750ABA2F48FF}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{F5A1C5EA-9AA3-42AE-9A87-33C7CE9A567F}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{F632046A-795A-4D1F-AF43-9A32F1641A76}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{F942C2B7-59CE-4BAE-8B08-F5C608AC8A1B}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{FC31B881-6700-4077-B8B4-D72171563E32}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{FD16D5B1-5DD6-4700-A195-0EE6836F3304}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{FD4249DC-B2E8-47E5-87E6-599B6175A842}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{FDFA49C7-E00F-4935-8318-193C17C8EE50}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{FEB64A95-6991-4D74-AF92-6891DBE447EE}
Successfully deleted: [Empty Folder] C:\Users\Admi\appdata\local\{FF06F267-99AC-42CC-9D19-5AC56FB00E0E}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.09.2013 at 12:05:49,14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 03
Ran by Admi (administrator) on NINJA on 06-09-2013 12:09:25
Running from C:\Users\Admi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Validity Sensors, Inc.) C:\Windows\system32\vcsFPService.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Atheros Communications) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe
(Dropbox, Inc.) C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-16] (Synaptics Incorporated)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [3666800 2011-01-22] (Dell Inc.)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [627360 2011-05-20] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [379552 2011-05-20] (Atheros Commnucations)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [Adobe Reader Synchronizer] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1272912 2013-05-10] (Adobe Systems Incorporated)
MountPoints2: {95313474-e502-11e0-8079-806e6f6e6963} - D:\autorun.exe
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [RoxWatchTray] - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] - c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-04-29] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-10-04] ()
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/8
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll (Trend Micro Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll (Trend Micro Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll (Trend Micro Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admi\AppData\Roaming\Mozilla\Firefox\Profiles\6g172uca.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla\firefox.exe

==================== Services (Whitelisted) =================

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-05-20] (Atheros)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-10-04] ()
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-06 11:59 - 2013-09-06 11:59 - 00000000 ____D C:\windows\ERUNT
2013-09-06 11:56 - 2013-09-06 11:56 - 01028823 _____ (Thisisu) C:\Users\Admi\Downloads\JRT.exe
2013-09-06 11:50 - 2013-09-06 11:51 - 00000000 ____D C:\AdwCleaner
2013-09-04 22:19 - 2013-09-04 22:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Mbar
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Malwarebytes
2013-09-03 22:01 - 2013-09-06 11:52 - 00000504 _____ C:\windows\setupact.log
2013-09-03 22:01 - 2013-09-03 22:01 - 00000808 _____ C:\windows\PFRO.log
2013-09-03 22:01 - 2013-09-03 22:01 - 00000000 _____ C:\windows\setuperr.log
2013-09-03 21:14 - 2013-09-03 21:14 - 00000000 ____D C:\FRST
2013-09-03 21:12 - 2013-09-03 21:12 - 00000000 _____ C:\Users\Admi\defogger_reenable
2013-09-03 21:10 - 2013-09-03 21:10 - 00069513 _____ C:\Users\Admi\Desktop\Anleitung.htm
2013-09-03 21:10 - 2013-09-03 21:10 - 00000000 ____D C:\Users\Admi\Desktop\Anleitung-Dateien
2013-09-03 21:03 - 2013-09-03 21:03 - 01950416 _____ (Farbar) C:\Users\Admi\Desktop\FRST64.exe
2013-09-03 21:01 - 2013-09-06 12:08 - 00000000 ____D C:\Users\Admi\Downloads\für TrBo
2013-09-03 20:28 - 2013-09-03 20:28 - 00002770 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-09-03 20:28 - 2013-09-03 20:28 - 00000000 ____D C:\Program Files\CCleaner
2013-09-03 20:27 - 2013-09-03 20:27 - 04454952 _____ (Piriform Ltd) C:\Users\Admi\Downloads\ccsetup405.exe
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-03 18:18 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-03 18:17 - 2013-09-03 18:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admi\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-03 18:04 - 2013-09-03 20:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Users\Admi\Neuer Ordner
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files\Mozilla
2013-09-03 17:59 - 2013-09-03 17:59 - 22240760 _____ (Mozilla) C:\Users\Admi\Downloads\Firefox Setup 23.0.1.exe
2013-09-03 17:46 - 2013-09-03 17:49 - 00000989 _____ C:\freefallprotection.log
2013-09-03 17:26 - 2013-09-03 17:26 - 00000000 ____D C:\windows\system32\IO
2013-09-03 17:12 - 2013-09-06 11:44 - 00001769 _____ C:\Users\Admi\Desktop\lala.html.txt
2013-08-15 12:11 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-08-15 12:11 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-08-15 12:11 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-08-15 12:11 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-08-15 12:11 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-08-15 12:11 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-08-15 12:11 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-08-15 12:11 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-08-15 12:11 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-08-15 12:11 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-08-15 12:11 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-08-15 12:11 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 18:47 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-08-14 18:47 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-08-14 18:47 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-08-14 18:47 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-08-14 18:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-08-14 18:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-08-14 18:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-08-14 18:47 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-08-14 18:47 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-08-14 18:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-08-14 18:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-08-14 18:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-08-14 18:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-08-14 18:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-08-14 18:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-08-14 18:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-08-14 18:47 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-08-14 18:47 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-06 12:08 - 2013-09-03 21:01 - 00000000 ____D C:\Users\Admi\Downloads\für TrBo
2013-09-06 12:05 - 2013-09-06 12:05 - 00022781 _____ C:\Users\Admi\Desktop\JRT.txt
2013-09-06 12:01 - 2013-03-21 15:28 - 00000302 _____ C:\windows\Tasks\oijjby.job
2013-09-06 12:01 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-06 12:01 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-06 11:59 - 2013-09-06 11:59 - 00000000 ____D C:\windows\ERUNT
2013-09-06 11:57 - 2011-10-11 16:06 - 00000000 ____D C:\Users\Admi\Documents\Bluetooth Folder
2013-09-06 11:56 - 2013-09-06 11:56 - 01028823 _____ (Thisisu) C:\Users\Admi\Downloads\JRT.exe
2013-09-06 11:53 - 2011-11-15 21:32 - 00000000 ___RD C:\Users\Admi\Dropbox
2013-09-06 11:53 - 2011-11-15 21:27 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Dropbox
2013-09-06 11:52 - 2013-09-03 22:01 - 00000504 _____ C:\windows\setupact.log
2013-09-06 11:52 - 2011-09-22 12:08 - 01226035 _____ C:\windows\WindowsUpdate.log
2013-09-06 11:52 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-06 11:51 - 2013-09-06 11:50 - 00000000 ____D C:\AdwCleaner
2013-09-06 11:44 - 2013-09-03 17:12 - 00001769 _____ C:\Users\Admi\Desktop\lala.html.txt
2013-09-06 11:43 - 2012-03-30 17:48 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-06 11:41 - 2011-09-22 14:57 - 00719614 _____ C:\windows\system32\perfh007.dat
2013-09-06 11:41 - 2011-09-22 14:57 - 00157298 _____ C:\windows\system32\perfc007.dat
2013-09-06 11:41 - 2009-07-14 07:13 - 01675454 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-04 22:48 - 2013-09-04 22:19 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Mbar
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Malwarebytes
2013-09-04 16:00 - 2011-09-22 12:50 - 00000000 ____D C:\ProgramData\Sonic
2013-09-04 15:46 - 2013-04-23 11:18 - 00000000 ____D C:\Users\Admi\Desktop\Sonstiges
2013-09-03 22:01 - 2013-09-03 22:01 - 00000808 _____ C:\windows\PFRO.log
2013-09-03 22:01 - 2013-09-03 22:01 - 00000000 _____ C:\windows\setuperr.log
2013-09-03 21:14 - 2013-09-03 21:14 - 00000000 ____D C:\FRST
2013-09-03 21:12 - 2013-09-03 21:12 - 00000000 _____ C:\Users\Admi\defogger_reenable
2013-09-03 21:12 - 2011-10-11 16:02 - 00000000 ____D C:\Users\Admi
2013-09-03 21:10 - 2013-09-03 21:10 - 00069513 _____ C:\Users\Admi\Desktop\Anleitung.htm
2013-09-03 21:10 - 2013-09-03 21:10 - 00000000 ____D C:\Users\Admi\Desktop\Anleitung-Dateien
2013-09-03 21:03 - 2013-09-03 21:03 - 01950416 _____ (Farbar) C:\Users\Admi\Desktop\FRST64.exe
2013-09-03 20:36 - 2012-02-02 23:25 - 00000000 ____D C:\windows\Minidump
2013-09-03 20:36 - 2011-11-19 21:41 - 00000000 ____D C:\Users\Admi\Tracing
2013-09-03 20:36 - 2011-10-12 16:00 - 00000000 ____D C:\Users\Admi\AppData\Local\CrashDumps
2013-09-03 20:36 - 2011-02-23 15:08 - 00000000 ____D C:\windows\Panther
2013-09-03 20:28 - 2013-09-03 20:28 - 00002770 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-09-03 20:28 - 2013-09-03 20:28 - 00000000 ____D C:\Program Files\CCleaner
2013-09-03 20:27 - 2013-09-03 20:27 - 04454952 _____ (Piriform Ltd) C:\Users\Admi\Downloads\ccsetup405.exe
2013-09-03 20:05 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-03 18:17 - 2013-09-03 18:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admi\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Users\Admi\Neuer Ordner
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files\Mozilla
2013-09-03 18:04 - 2011-10-11 16:19 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Mozilla
2013-09-03 17:59 - 2013-09-03 17:59 - 22240760 _____ (Mozilla) C:\Users\Admi\Downloads\Firefox Setup 23.0.1.exe
2013-09-03 17:58 - 2013-04-23 11:16 - 00000000 ____D C:\Program Files (x86)\Opera
2013-09-03 17:49 - 2013-09-03 17:46 - 00000989 _____ C:\freefallprotection.log
2013-09-03 17:47 - 2011-09-22 12:12 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-03 17:26 - 2013-09-03 17:26 - 00000000 ____D C:\windows\system32\IO
2013-09-03 17:21 - 2013-02-20 12:26 - 00000000 ____D C:\Program Files\Canon
2013-09-03 16:08 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-09-02 14:34 - 2013-05-13 08:56 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-02 14:34 - 2013-03-29 11:29 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-02 14:34 - 2013-03-29 11:29 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-02 08:27 - 2012-06-26 21:53 - 00000000 ____D C:\Users\Admi\Documents\DLC
2013-09-02 08:26 - 2013-05-30 18:38 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-08-24 21:09 - 2012-10-04 22:26 - 00000000 ____D C:\Users\Admi\AppData\Roaming\ICQ
2013-08-20 21:43 - 2012-03-30 17:48 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-20 21:43 - 2012-03-30 17:48 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-08-20 21:43 - 2011-10-18 20:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-15 12:06 - 2011-10-15 12:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 12:05 - 2011-10-19 18:10 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-08-07 11:32 - 2013-05-22 15:06 - 00003440 _____ C:\windows\System32\Tasks\PCDEventLauncherTask

Files to move or delete:
====================
C:\Users\Admi\Hangdat.exe
C:\Users\Admi\Hangman.dat
C:\Users\Admi\Hangman.exe
C:\Users\Admi\Kaese.exe
C:\Users\Admi\Knack.exe
C:\Users\Admi\Kniffel.exe
C:\Users\Admi\Mad.exe
C:\Users\Admi\Master.exe
C:\Users\Admi\Memory.exe
C:\Users\Admi\PCQuiz.dat
C:\Users\Admi\PCQuiz.exe
C:\Users\Admi\PCRoul.exe
C:\Users\Admi\Puzzle.exe
C:\Users\Admi\Schiffe.exe
C:\Users\Admi\Spiele.exe
C:\Users\Admi\Uninstal.exe
C:\Users\Admi\AppData\Local\Temp\Quarantine.exe
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\mcbrwsr2.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerRes.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerRes_LD.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerStartup.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McUICnt.exe
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\SecurityScanner.dll
C:\Users\Admi\AppData\Local\Temp\jrt\erunt\ERUNT.EXE

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-03 16:01

==================== End Of Log ============================

--- --- ---

--- --- ---

cosinus · 06.09.2013, 12:06

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\windows\Tasks\oijjby.job
C:\windows\SysWOW64\kbdnecx.dll
C:\Users\Admi\Hangdat.exe
C:\Users\Admi\Hangman.dat
C:\Users\Admi\Hangman.exe
C:\Users\Admi\Kaese.exe
C:\Users\Admi\Knack.exe
C:\Users\Admi\Kniffel.exe
C:\Users\Admi\Mad.exe
C:\Users\Admi\Master.exe
C:\Users\Admi\Memory.exe
C:\Users\Admi\PCQuiz.dat
C:\Users\Admi\PCQuiz.exe
C:\Users\Admi\PCRoul.exe
C:\Users\Admi\Puzzle.exe
C:\Users\Admi\Schiffe.exe
C:\Users\Admi\Spiele.exe
C:\Users\Admi\Uninstal.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Molsterpöbel · 06.09.2013, 14:04

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-09-2013
Ran by Admi at 2013-09-06 14:58:58 Run:1
Running from C:\Users\Admi\Downloads\für TrBo
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\windows\Tasks\oijjby.job
C:\windows\SysWOW64\kbdnecx.dll
C:\Users\Admi\Hangdat.exe
C:\Users\Admi\Hangman.dat
C:\Users\Admi\Hangman.exe
C:\Users\Admi\Kaese.exe
C:\Users\Admi\Knack.exe
C:\Users\Admi\Kniffel.exe
C:\Users\Admi\Mad.exe
C:\Users\Admi\Master.exe
C:\Users\Admi\Memory.exe
C:\Users\Admi\PCQuiz.dat
C:\Users\Admi\PCQuiz.exe
C:\Users\Admi\PCRoul.exe
C:\Users\Admi\Puzzle.exe
C:\Users\Admi\Schiffe.exe
C:\Users\Admi\Spiele.exe
C:\Users\Admi\Uninstal.exe
         
*****************

C:\windows\Tasks\oijjby.job => Moved successfully.
Could not move "C:\windows\SysWOW64\kbdnecx.dll" => Scheduled to move on reboot.
"C:\Users\Admi\Hangdat.exe" => File/Directory not found.
"C:\Users\Admi\Hangman.dat" => File/Directory not found.
"C:\Users\Admi\Hangman.exe" => File/Directory not found.
"C:\Users\Admi\Kaese.exe" => File/Directory not found.
"C:\Users\Admi\Knack.exe" => File/Directory not found.
"C:\Users\Admi\Kniffel.exe" => File/Directory not found.
"C:\Users\Admi\Mad.exe" => File/Directory not found.
"C:\Users\Admi\Master.exe" => File/Directory not found.
"C:\Users\Admi\Memory.exe" => File/Directory not found.
"C:\Users\Admi\PCQuiz.dat" => File/Directory not found.
"C:\Users\Admi\PCQuiz.exe" => File/Directory not found.
"C:\Users\Admi\PCRoul.exe" => File/Directory not found.
"C:\Users\Admi\Puzzle.exe" => File/Directory not found.
"C:\Users\Admi\Schiffe.exe" => File/Directory not found.
"C:\Users\Admi\Spiele.exe" => File/Directory not found.
"C:\Users\Admi\Uninstal.exe" => File/Directory not found.

=========== Result of Scheduled Files to move ===========

C:\windows\SysWOW64\kbdnecx.dll => Moved successfully.

==== End of Fixlog ====

cosinus · 06.09.2013, 14:27

Ok, ein frisches FRST Log bitte

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Molsterpöbel · 06.09.2013, 17:28

Biddeschön...

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-09-2013
Ran by Admi (administrator) on NINJA on 06-09-2013 18:23:07
Running from C:\Users\Admi\Downloads\für TrBo
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Validity Sensors, Inc.) C:\Windows\system32\vcsFPService.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Atheros Communications) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe
(Dropbox, Inc.) C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) \\?\C:\windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-16] (Synaptics Incorporated)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [3666800 2011-01-22] (Dell Inc.)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [627360 2011-05-20] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [379552 2011-05-20] (Atheros Commnucations)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [Adobe Reader Synchronizer] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1272912 2013-05-10] (Adobe Systems Incorporated)
MountPoints2: {95313474-e502-11e0-8079-806e6f6e6963} - D:\autorun.exe
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [RoxWatchTray] - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] - c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-04-29] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-10-04] ()
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/8
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll (Trend Micro Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll (Trend Micro Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll (Trend Micro Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admi\AppData\Roaming\Mozilla\Firefox\Profiles\6g172uca.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla\firefox.exe

==================== Services (Whitelisted) =================

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-05-20] (Atheros)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-10-04] ()
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-06 15:00 - 2013-09-06 15:00 - 00000000 ___RD C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-09-06 11:59 - 2013-09-06 11:59 - 00000000 ____D C:\windows\ERUNT
2013-09-06 11:56 - 2013-09-06 11:56 - 01028823 _____ (Thisisu) C:\Users\Admi\Downloads\JRT.exe
2013-09-06 11:50 - 2013-09-06 11:51 - 00000000 ____D C:\AdwCleaner
2013-09-04 22:19 - 2013-09-04 22:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Mbar
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Malwarebytes
2013-09-03 22:01 - 2013-09-06 14:59 - 00001122 _____ C:\windows\PFRO.log
2013-09-03 22:01 - 2013-09-06 14:59 - 00000560 _____ C:\windows\setupact.log
2013-09-03 22:01 - 2013-09-03 22:01 - 00000000 _____ C:\windows\setuperr.log
2013-09-03 21:14 - 2013-09-06 15:01 - 00000000 ____D C:\FRST
2013-09-03 21:12 - 2013-09-03 21:12 - 00000000 _____ C:\Users\Admi\defogger_reenable
2013-09-03 21:01 - 2013-09-06 18:23 - 00000000 ____D C:\Users\Admi\Downloads\für TrBo
2013-09-03 20:28 - 2013-09-03 20:28 - 00002770 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-09-03 20:28 - 2013-09-03 20:28 - 00000000 ____D C:\Program Files\CCleaner
2013-09-03 20:27 - 2013-09-03 20:27 - 04454952 _____ (Piriform Ltd) C:\Users\Admi\Downloads\ccsetup405.exe
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-03 18:18 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-03 18:17 - 2013-09-03 18:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admi\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-03 18:04 - 2013-09-03 20:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Users\Admi\Neuer Ordner
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files\Mozilla
2013-09-03 17:59 - 2013-09-03 17:59 - 22240760 _____ (Mozilla) C:\Users\Admi\Downloads\Firefox Setup 23.0.1.exe
2013-09-03 17:46 - 2013-09-03 17:49 - 00000989 _____ C:\freefallprotection.log
2013-09-03 17:26 - 2013-09-03 17:26 - 00000000 ____D C:\windows\system32\IO
2013-09-03 17:12 - 2013-09-06 11:44 - 00001769 _____ C:\Users\Admi\Desktop\lala.html.txt
2013-08-15 12:11 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-08-15 12:11 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-08-15 12:11 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-08-15 12:11 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-08-15 12:11 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-08-15 12:11 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-08-15 12:11 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-08-15 12:11 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-08-15 12:11 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-08-15 12:11 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-08-15 12:11 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-08-15 12:11 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 18:47 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-08-14 18:47 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-08-14 18:47 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-08-14 18:47 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-08-14 18:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-08-14 18:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-08-14 18:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-08-14 18:47 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-08-14 18:47 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-08-14 18:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-08-14 18:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-08-14 18:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-08-14 18:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-08-14 18:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-08-14 18:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-08-14 18:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-08-14 18:47 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-08-14 18:47 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-06 18:22 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-06 18:22 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-06 18:20 - 2012-03-30 17:48 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-06 15:04 - 2011-09-22 12:08 - 01234891 _____ C:\windows\WindowsUpdate.log
2013-09-06 15:01 - 2013-09-03 21:14 - 00000000 ____D C:\FRST
2013-09-06 15:00 - 2013-09-06 15:00 - 00000000 ___RD C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-09-06 15:00 - 2011-11-15 21:32 - 00000000 ___RD C:\Users\Admi\Dropbox
2013-09-06 15:00 - 2011-11-15 21:27 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Dropbox
2013-09-06 14:59 - 2013-09-03 22:01 - 00001122 _____ C:\windows\PFRO.log
2013-09-06 14:59 - 2013-09-03 22:01 - 00000560 _____ C:\windows\setupact.log
2013-09-06 14:59 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-06 14:51 - 2011-09-22 14:57 - 00719614 _____ C:\windows\system32\perfh007.dat
2013-09-06 14:51 - 2011-09-22 14:57 - 00157298 _____ C:\windows\system32\perfc007.dat
2013-09-06 14:51 - 2009-07-14 07:13 - 01675454 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-06 12:13 - 2011-10-11 16:06 - 00000000 ____D C:\Users\Admi\Documents\Bluetooth Folder
2013-09-06 11:59 - 2013-09-06 11:59 - 00000000 ____D C:\windows\ERUNT
2013-09-06 11:56 - 2013-09-06 11:56 - 01028823 _____ (Thisisu) C:\Users\Admi\Downloads\JRT.exe
2013-09-06 11:51 - 2013-09-06 11:50 - 00000000 ____D C:\AdwCleaner
2013-09-06 11:44 - 2013-09-03 17:12 - 00001769 _____ C:\Users\Admi\Desktop\lala.html.txt
2013-09-04 22:48 - 2013-09-04 22:19 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Mbar
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Malwarebytes
2013-09-04 16:00 - 2011-09-22 12:50 - 00000000 ____D C:\ProgramData\Sonic
2013-09-04 15:46 - 2013-04-23 11:18 - 00000000 ____D C:\Users\Admi\Desktop\Sonstiges
2013-09-03 22:01 - 2013-09-03 22:01 - 00000000 _____ C:\windows\setuperr.log
2013-09-03 21:12 - 2013-09-03 21:12 - 00000000 _____ C:\Users\Admi\defogger_reenable
2013-09-03 21:12 - 2011-10-11 16:02 - 00000000 ____D C:\Users\Admi
2013-09-03 20:36 - 2012-02-02 23:25 - 00000000 ____D C:\windows\Minidump
2013-09-03 20:36 - 2011-11-19 21:41 - 00000000 ____D C:\Users\Admi\Tracing
2013-09-03 20:36 - 2011-10-12 16:00 - 00000000 ____D C:\Users\Admi\AppData\Local\CrashDumps
2013-09-03 20:36 - 2011-02-23 15:08 - 00000000 ____D C:\windows\Panther
2013-09-03 20:28 - 2013-09-03 20:28 - 00002770 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-09-03 20:28 - 2013-09-03 20:28 - 00000000 ____D C:\Program Files\CCleaner
2013-09-03 20:27 - 2013-09-03 20:27 - 04454952 _____ (Piriform Ltd) C:\Users\Admi\Downloads\ccsetup405.exe
2013-09-03 20:05 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-03 18:17 - 2013-09-03 18:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admi\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Users\Admi\Neuer Ordner
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files\Mozilla
2013-09-03 18:04 - 2011-10-11 16:19 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Mozilla
2013-09-03 17:59 - 2013-09-03 17:59 - 22240760 _____ (Mozilla) C:\Users\Admi\Downloads\Firefox Setup 23.0.1.exe
2013-09-03 17:58 - 2013-04-23 11:16 - 00000000 ____D C:\Program Files (x86)\Opera
2013-09-03 17:49 - 2013-09-03 17:46 - 00000989 _____ C:\freefallprotection.log
2013-09-03 17:47 - 2011-09-22 12:12 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-03 17:26 - 2013-09-03 17:26 - 00000000 ____D C:\windows\system32\IO
2013-09-03 17:21 - 2013-02-20 12:26 - 00000000 ____D C:\Program Files\Canon
2013-09-03 16:08 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-09-02 14:34 - 2013-05-13 08:56 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-02 14:34 - 2013-03-29 11:29 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-02 14:34 - 2013-03-29 11:29 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-02 08:27 - 2012-06-26 21:53 - 00000000 ____D C:\Users\Admi\Documents\DLC
2013-09-02 08:26 - 2013-05-30 18:38 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-08-24 21:09 - 2012-10-04 22:26 - 00000000 ____D C:\Users\Admi\AppData\Roaming\ICQ
2013-08-20 21:43 - 2012-03-30 17:48 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-20 21:43 - 2012-03-30 17:48 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-08-20 21:43 - 2011-10-18 20:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-15 12:06 - 2011-10-15 12:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 12:05 - 2011-10-19 18:10 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-08-07 11:32 - 2013-05-22 15:06 - 00003440 _____ C:\windows\System32\Tasks\PCDEventLauncherTask

Files to move or delete:
====================
C:\Users\Admi\Hangdat.exe
C:\Users\Admi\Hangman.dat
C:\Users\Admi\Hangman.exe
C:\Users\Admi\Kaese.exe
C:\Users\Admi\Knack.exe
C:\Users\Admi\Kniffel.exe
C:\Users\Admi\Mad.exe
C:\Users\Admi\Master.exe
C:\Users\Admi\Memory.exe
C:\Users\Admi\PCQuiz.dat
C:\Users\Admi\PCQuiz.exe
C:\Users\Admi\PCRoul.exe
C:\Users\Admi\Puzzle.exe
C:\Users\Admi\Schiffe.exe
C:\Users\Admi\Spiele.exe
C:\Users\Admi\Uninstal.exe
C:\Users\Admi\AppData\Local\Temp\Quarantine.exe
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\mcbrwsr2.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerRes.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerRes_LD.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McInstallerStartup.dll
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\McUICnt.exe
C:\Users\Admi\AppData\Local\Temp\MSS\3.0.318.3\SecurityScanner.dll
C:\Users\Admi\AppData \Local\Temp\jrt\erunt\ERUNT.EXE

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-03 16:01

==================== End Of Log ============================

--- --- ---

cosinus · 08.09.2013, 00:34

Da stört mich noch einiges. Dann bitte jetzt Combofix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Molsterpöbel · 08.09.2013, 10:41

Hallo mal wieder,

also Antivir hat trotz Deaktivieren dazwischengefunkt und Combofix dementsprechend gemeckert und gewarnt.

Das Log:

Code:

ATTFilter

ComboFix 13-09-06.01 - Admi 08.09.2013  10:50:56.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4003.2437 [GMT 2:00]
ausgeführt von:: c:\users\Admi\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Admi\Hangdat.exe
c:\users\Admi\Hangman.exe
c:\users\Admi\Kaese.exe
c:\users\Admi\Knack.exe
c:\users\Admi\Kniffel.exe
c:\users\Admi\Mad.exe
c:\users\Admi\Master.exe
c:\users\Admi\Memory.exe
c:\users\Admi\PCQuiz.exe
c:\users\Admi\PCRoul.exe
c:\users\Admi\Puzzle.exe
c:\users\Admi\Rxctl.dpl
c:\users\Admi\Rxtools.dpl
c:\users\Admi\Schiffe.exe
c:\users\Admi\Spiele.exe
c:\users\Admi\Uninstal.exe
c:\users\Admi\vcl30.DE
c:\users\Admi\vclsmp30.DE
c:\users\Admi\vclx30.DE
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-08-08 bis 2013-09-08  ))))))))))))))))))))))))))))))
.
.
2013-09-08 08:57 . 2013-09-08 08:57	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-09-06 09:59 . 2013-09-06 09:59	--------	d-----w-	c:\windows\ERUNT
2013-09-06 09:50 . 2013-09-06 09:51	--------	d-----w-	C:\AdwCleaner
2013-09-04 20:19 . 2013-09-04 20:48	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-09-04 20:17 . 2013-09-04 20:17	--------	d-----w-	c:\program files\Malwarebytes
2013-09-03 19:14 . 2013-09-06 13:01	--------	d-----w-	C:\FRST
2013-09-03 18:28 . 2013-09-03 18:28	--------	d-----w-	c:\program files\CCleaner
2013-09-03 16:18 . 2013-09-03 16:18	--------	d-----w-	c:\users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 16:18 . 2013-09-03 16:18	--------	d-----w-	c:\programdata\Malwarebytes
2013-09-03 16:18 . 2013-09-03 16:18	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2013-09-03 16:18 . 2013-04-04 12:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-09-03 16:18 . 2013-09-03 16:18	--------	d-----w-	c:\users\Admi\AppData\Local\Programs
2013-09-03 16:04 . 2013-09-03 18:05	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2013-09-03 16:04 . 2013-09-03 16:04	--------	d-----w-	c:\program files\Mozilla
2013-09-03 16:04 . 2013-09-03 16:04	--------	d-----w-	c:\users\Admi\Neuer Ordner
2013-09-03 15:26 . 2013-09-03 15:26	--------	d-----w-	c:\windows\system32\IO
2013-08-14 16:47 . 2013-07-09 05:52	224256	----a-w-	c:\windows\system32\wintrust.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-02 12:34 . 2013-05-13 06:56	81112	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-09-02 12:34 . 2013-03-29 09:29	132088	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-09-02 12:34 . 2013-03-29 09:29	105344	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-08-20 19:43 . 2012-03-30 15:48	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-20 19:43 . 2011-10-18 18:21	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-15 10:05 . 2011-10-19 16:10	78161360	----a-w-	c:\windows\system32\MRT.exe
2013-07-09 04:45 . 2013-08-14 16:47	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2013-06-30 21:31 . 2013-06-30 21:31	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-30 21:30 . 2012-09-04 07:35	867240	----a-w-	c:\windows\SysWow64\npdeployJava1.dll
2013-06-30 21:30 . 2011-09-22 10:16	789416	----a-w-	c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Synchronizer"="c:\program files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe" [2013-05-10 1272912]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]
"PDVD9LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD9\Language\Language.exe" [2010-04-29 50472]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-05-10 37960]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Guard.Mail.ru.gui"="c:\program files (x86)\Guard-ICQ\GuardICQ.exe" [2012-10-04 1564368]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-02 347192]
.
c:\users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	DPPassFilter scecli
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 19:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-20 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-20 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-20 416024]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-25 525312]
"AtherosBtStack"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [2011-05-20 627360]
"AthBtTray"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [2011-05-20 379552]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1580368]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admi\AppData\Roaming\Mozilla\Firefox\Profiles\6g172uca.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-ANNO1602 - c:\windows\system32\1602Unst.exe
AddRemove-Die Sims - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{1CA1377B-DC1D-4A52-9585-6E06050FAC53}"=hex:51,66,7a,6c,4c,1d,38,12,15,34,b2,
   18,2f,92,3c,0f,ea,93,2d,46,00,51,e8,47
"{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}"=hex:51,66,7a,6c,4c,1d,38,12,aa,f5,03,
   89,33,40,ba,0e,f9,17,52,ec,1a,81,c5,32
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,
   aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
   fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
   b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:3c,b4,01,55,17,8f,cc,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bf,3f,8e,30,5a,a8,22,49,9d,4a,28,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bf,3f,8e,30,5a,a8,22,49,9d,4a,28,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-08  11:00:19
ComboFix-quarantined-files.txt  2013-09-08 09:00
.
Vor Suchlauf: 13 Verzeichnis(se), 426.321.174.528 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 426.181.959.680 Bytes frei
.
- - End Of File - - 375C1D8CC202B8545937B1A4435FD8B1

Vielen Dank für die Bemühungen nochmal.

Grüße,
Molsterpöbel

cosinus · 08.09.2013, 15:49

Bitte frische Logs mit FRST machen. FRST neu runterladen und stelle bitte sicher, dass ein Haken bei additions gesetzt ist.

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Molsterpöbel · 08.09.2013, 17:52

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-09-2013
Ran by Admi at 2013-09-08 18:47:26
Running from C:\Users\Admi\Downloads\für TrBo
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
64 Bit HP CIO Components Installer (Version: 8.2.2)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)
Advanced Audio FX Engine (x32 Version: 1.12.05)
Age of Empires III (x32 Version: 1.00.0000)
Anno 1602 (x32)
Avira Antivirus Premium (x32 Version: 13.0.0.4052)
Bluetooth Win7 Suite (64) (Version: 7.2.0.83)
Canon IJ Scan Utility (x32)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (x32 Version: 4.0.0)
Canon Kurzwahlprogramm (x32 Version: 1.3.0)
Canon MX390 series Benutzerregistrierung (x32)
Canon MX390 series MP Drivers (Version: 1.00)
Canon MX390 series On-screen Manual (x32 Version: 7.6.0)
Canon My Image Garden (x32 Version: 1.1.0)
Canon My Image Garden Design Files (x32 Version: 1.0.1)
Canon My Printer (x32 Version: 3.1.0)
Carcassonne (x32)
CyberLink PowerDVD 9.5 (x32 Version: 9.5.1.3225)
D3DX10 (x32 Version: 15.4.2368.0902)
Dell Backup and Recovery Manager (Version: 1.3)
Dell Edoc Viewer (Version: 1.0.0)
Dell Touchpad (Version: 15.2.5.2)
Dell Webcam Central (x32 Version: 2.00.44)
Dell WLAN and Bluetooth Client Installation (x32 Version: 9.0)
Die Sims (x32)
DigitalPersona Fingerprint Software 5.20 (Version: 5.20.230)
DirectX 9 Runtime (x32 Version: 1.00.0000)
Dropbox (HKCU Version: 2.0.22)
eaner (Version: 4.05)
Guard.ICQ (x32)
ICQ 7.8 Build #6800 Banner Remover 1.0 (x32)
ICQ7M (x32 Version: 7.8)
IDT Audio (x32 Version: 1.0.6324.0)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2361)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.0.1008)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Logitech Unifying-Software 2.00 (Version: 2.00.43)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 1.1 (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Age of Empires (x32)
Microsoft Age of Empires Expansion (x32)
Microsoft Age of Empires II (x32)
Microsoft Age of Empires II: The Conquerors Expansion (x32)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
My Dell (Version: 3.3.6280.92)
p.i.c.s. Spielesammlung (x32)
Pando Media Booster (x32 Version: 2.6.0.6)
PhotoShowExpress (x32 Version: 2.0.063)
Quickset64 (Version: 10.09.20)
Railroad Tycoon II - Platinum (x32)
RBVirtualFolder64Inst (Version: 1.00.0000)
Realtek Ethernet Controller Driver (x32 Version: 7.31.1025.2010)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30126)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0)
Rossmann Fotowelt Software 4.12.1 (x32 Version: 4.12.1)
Roxio Activation Module (x32 Version: 1.0)
Roxio BackOnTrack (x32 Version: 1.3.3)
Roxio Burn (x32 Version: 1.8)
Roxio Creator Starter (x32 Version: 1.0.439)
Roxio Creator Starter (x32 Version: 12.1.77.0)
Roxio Creator Starter (x32 Version: 5.0.0)
Roxio Express Labeler 3 (x32 Version: 3.2.2)
Roxio File Backup (Version: 1.3.2)
Skat24sv (x32)
Skype™ 6.6 (x32 Version: 6.6.106)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Validity Sensors DDK (Version: 4.3.108.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-09-08 10:57 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {2FFC4E11-98E4-4E50-B6DA-9AD683627C08} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-20] (Adobe Systems Incorporated)
Task: {385760C7-35FB-4CF7-96A9-CC6F0284C710} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-05-07] (PC-Doctor, Inc.)
Task: {44CE376F-6845-4012-BC18-B8A6124B2097} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {72ACF2B8-593C-443A-A08B-DCEB43FD1CF5} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {835B38ED-DB15-4EFF-A21B-13281850FEF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)
Task: {97FCADF6-D002-4AA6-A1C0-6D7576F031DA} - System32\Tasks\oijjby => Rundll32.exe "C:\windows\SysWOW64\kbdnecx.dll",rckzhe
Task: {AC1EB3CD-167B-47AD-AD87-449BE0DF30B0} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-07-18] (PC-Doctor, Inc.)
Task: {C72A4A25-FAC5-4308-9985-C40EB9FC08CD} - System32\Tasks\SystemToolsDailyTest => C:\Windows\System32\uaclauncher.exe
Task: {C9FDD39C-0C0D-493C-A9EC-79AB5B701A18} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {F08B39AE-BD84-470B-8ABF-DDD1DFF94538} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-21] (Microsoft Corporation)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\Admi\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2009-07-14 02:22 - 2009-07-14 03:38 - 00081408 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2010-11-11 05:53 - 2010-11-11 05:53 - 00817136 _____ () c:\Program Files\Roxio\Roxio Burn\RBVirtualFolder64.dll
2010-11-11 05:54 - 2010-11-11 05:54 - 00177136 _____ (TODO: <Company name>) c:\Program Files\Roxio\Roxio Burn\RB_ContextMenu64.dll
2011-09-22 14:33 - 2011-04-10 21:13 - 00286720 _____ (Intel Corporation) C:\windows\system32\igfxrDEU.lrc
2011-09-22 14:33 - 2011-04-10 20:40 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-09-22 12:23 - 2011-01-25 11:57 - 04637184 _____ (IDT, Inc.) C:\Program Files\IDT\WDM\STLang64.dll
2011-09-22 12:23 - 2011-01-25 11:57 - 00651776 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2011-09-22 14:35 - 2010-12-16 05:53 - 00404776 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2011-09-22 14:35 - 2010-12-16 05:53 - 00216360 _____ (Synaptics Incorporated) C:\windows\system32\SynTPAPI.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00055352 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cfglib.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00218168 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpipc.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00109112 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpgen.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00128056 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpschd.dll
2012-11-08 15:50 - 2012-11-08 15:44 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00039480 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpgrd.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00057400 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpgui.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00042552 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gplegacy.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00050744 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpgenrep.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00025656 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\onlcfg.dll
2013-06-27 14:38 - 2013-09-02 14:34 - 00110648 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gavidb.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00497720 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avlode.dll
2012-11-08 15:50 - 2013-06-27 14:38 - 00154112 _____ (Avira GmbH) C:\Program Files (x86)\Avira\AntiVir Desktop\apcfile.dll
2012-11-08 15:50 - 2012-11-08 15:45 - 00263992 _____ (The cURL library, hxxp://curl.haxx.se/) C:\Program Files (x86)\Avira\AntiVir Desktop\libcurl.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00312888 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpavgio.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00134200 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avesvc.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00014392 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avesvcr.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00135224 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\webcat.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00250424 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avreg.dll
2012-11-14 01:32 - 2012-11-14 01:32 - 03558400 _____ (wxWidgets development team) C:\Users\Admi\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\Admi\AppData\Roaming\Dropbox\bin\libcef.dll
2013-03-13 22:48 - 2013-03-13 22:48 - 09956864 _____ (The ICU Project) C:\Users\Admi\AppData\Roaming\Dropbox\bin\icudt.dll
2011-09-22 12:13 - 2009-09-08 17:01 - 00237056 ____N (Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\CTLoadRs.dll
2011-09-22 12:13 - 2010-07-22 20:01 - 00065536 ____N (Creative Technology Ltd.) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\CtPinMgr.dll
2013-08-20 21:45 - 2013-08-20 21:45 - 00475648 _____ (Intel Corporation) C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\2b87cb064e64ff40778ca12322abb710\IAStorUtil.ni.dll
2013-07-12 13:58 - 2013-07-12 13:58 - 00014336 _____ (Intel Corp.) C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\14dd60b57c8e7542cc9711866ef63e8a\IAStorCommon.ni.dll
2010-11-17 19:52 - 2010-11-17 19:52 - 00096904 _____ (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.dll
2010-11-09 18:59 - 2010-11-09 18:59 - 04479472 _____ (Sonic Solutions) C:\Program Files (x86)\Roxio\OEM\Roxio Burn\AS_Storage_w32.dll
2010-11-25 05:34 - 2010-11-25 05:34 - 00632304 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\homepermitsconfig13.dll
2010-11-22 20:27 - 2010-11-22 20:27 - 00190960 _____ (Roxio, Inc.) c:\program files (x86)\common files\roxio shared\dllshared\rsl.dll
2010-11-25 05:44 - 2010-11-25 05:44 - 00375280 _____ () c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll
2010-11-22 20:27 - 2010-11-22 20:27 - 00186864 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\rcsl.dll
2010-11-25 05:35 - 2010-11-25 05:35 - 00961008 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\SonicHTTPClient13.dll
2010-11-25 05:35 - 2010-11-25 05:35 - 00712688 _____ (Sonic Solutions) c:\program files (x86)\common files\roxio shared\dllshared\SonicLicenseManager13.dll
2010-05-10 08:01 - 2010-05-10 08:01 - 00100848 _____ (Sonic Solutions) C:\Program Files (x86)\Common Files\PX Storage Engine\vxblock.dll
2010-11-25 09:36 - 2010-11-25 09:36 - 00100848 _____ (Sonic Solutions) c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\DLLShared\cdral.DLL
2012-11-08 15:50 - 2013-09-02 14:33 - 00349752 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccguard.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00029240 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgrdrc.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00229432 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgrdw.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00407608 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmguard.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00032824 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmgrdrc.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00419384 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrd.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00027192 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrdrc.dll
2012-11-08 15:50 - 2013-09-02 14:34 - 00127544 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrdw.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00807992 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgen.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00049720 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgenrc.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00220216 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccupdate.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00028728 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccupdrc.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00083000 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cclic.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00009784 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cclicrc.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00237624 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmsg.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00010296 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmsgrc.dll
2012-11-08 15:50 - 2013-09-02 14:33 - 00014392 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmainrc.dll
2013-08-20 21:45 - 2013-08-20 21:45 - 00019968 _____ (Intel Corporation) C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorDataMgrSvc\981fcde2aa529ce4d48e587a459e344c\IAStorDataMgrSvc.ni.exe
2013-08-20 21:45 - 2013-08-20 21:45 - 00219136 _____ (Intel Corporation) C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorDataMgr\f30204d362ea071c32cd84dc992dc174\IAStorDataMgr.ni.dll
2013-09-01 21:54 - 2013-09-01 21:54 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\eb4812681f6ab4406053f3a1803e6da0\IsdiInterop.ni.dll
2011-09-22 12:15 - 2010-11-06 06:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/08/2013 06:42:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/08/2013 02:34:43 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/08/2013 10:43:29 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/08/2013 10:28:07 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/07/2013 11:04:49 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/06/2013 03:00:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (09/08/2013 11:03:40 AM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (09/08/2013 10:57:38 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (09/08/2013 10:57:00 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (09/08/2013 10:54:48 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (09/08/2013 10:29:00 AM) (Source: DCOM) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (09/08/2013 10:29:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/08/2013 10:29:00 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (09/06/2013 02:48:04 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-09-08 10:57:00.769
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-08 10:57:00.706
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 4003.18 MB
Available physical RAM: 2067.68 MB
Total Pagefile: 8004.54 MB
Available Pagefile: 5821.88 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:451.01 GB) (Free:396.99 GB) NTFS
Drive d: (AOE) (CDROM) (Total:5.1 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 675BA925)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)

==================== End Of Log ============================

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-09-2013
Ran by Admi (administrator) on NINJA on 08-09-2013 18:46:06
Running from C:\Users\Admi\Downloads\für TrBo
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Validity Sensors, Inc.) C:\Windows\system32\vcsFPService.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Atheros Communications) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe
(Dropbox, Inc.) C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-16] (Synaptics Incorporated)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [627360 2011-05-20] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [379552 2011-05-20] (Atheros Commnucations)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKCU\...\Run: [Adobe Reader Synchronizer] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1272912 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [RoxWatchTray] - c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] - c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-04-29] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-10-04] ()
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Admi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/8
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll (Trend Micro Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll (Trend Micro Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll (Trend Micro Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admi\AppData\Roaming\Mozilla\Firefox\Profiles\6g172uca.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla\firefox.exe

==================== Services (Whitelisted) =================

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-05-20] (Atheros)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-10-04] ()
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-29] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-08 18:42 - 2013-09-08 18:42 - 96566691 _____ C:\windows\SysWOW64\⠕Œ
2013-09-08 18:42 - 2013-09-08 18:42 - 00000000 ___RD C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-09-08 11:00 - 2013-09-08 11:00 - 00023354 _____ C:\ComboFix.txt
2013-09-08 10:49 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-08 10:49 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-08 10:49 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-08 10:49 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-08 10:49 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-08 10:49 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-08 10:49 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-08 10:49 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-08 10:47 - 2013-09-08 11:00 - 00000000 ____D C:\Qoobox
2013-09-08 10:47 - 2013-09-08 10:58 - 00000000 ____D C:\windows\erdnt
2013-09-06 11:59 - 2013-09-06 11:59 - 00000000 ____D C:\windows\ERUNT
2013-09-06 11:56 - 2013-09-06 11:56 - 01028823 _____ (Thisisu) C:\Users\Admi\Downloads\JRT.exe
2013-09-06 11:50 - 2013-09-06 11:51 - 00000000 ____D C:\AdwCleaner
2013-09-04 22:19 - 2013-09-04 22:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Malwarebytes
2013-09-03 22:01 - 2013-09-08 18:40 - 00000840 _____ C:\windows\setupact.log
2013-09-03 22:01 - 2013-09-08 14:32 - 00001668 _____ C:\windows\PFRO.log
2013-09-03 22:01 - 2013-09-03 22:01 - 00000000 _____ C:\windows\setuperr.log
2013-09-03 21:14 - 2013-09-06 15:01 - 00000000 ____D C:\FRST
2013-09-03 21:12 - 2013-09-03 21:12 - 00000000 _____ C:\Users\Admi\defogger_reenable
2013-09-03 21:01 - 2013-09-08 18:46 - 00000000 ____D C:\Users\Admi\Downloads\für TrBo
2013-09-03 20:28 - 2013-09-03 20:28 - 00002770 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-09-03 20:28 - 2013-09-03 20:28 - 00000000 ____D C:\Program Files\CCleaner
2013-09-03 20:27 - 2013-09-03 20:27 - 04454952 _____ (Piriform Ltd) C:\Users\Admi\Downloads\ccsetup405.exe
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-03 18:18 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-03 18:17 - 2013-09-03 18:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admi\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-03 18:04 - 2013-09-03 20:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Users\Admi\Neuer Ordner
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files\Mozilla
2013-09-03 17:59 - 2013-09-03 17:59 - 22240760 _____ (Mozilla) C:\Users\Admi\Downloads\Firefox Setup 23.0.1.exe
2013-09-03 17:46 - 2013-09-03 17:49 - 00000989 _____ C:\freefallprotection.log
2013-09-03 17:26 - 2013-09-03 17:26 - 00000000 ____D C:\windows\system32\IO
2013-09-03 17:12 - 2013-09-06 11:44 - 00001769 _____ C:\Users\Admi\Desktop\lala.html.txt
2013-08-15 12:11 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-08-15 12:11 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-08-15 12:11 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-08-15 12:11 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-08-15 12:11 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-08-15 12:11 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-08-15 12:11 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-08-15 12:11 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-08-15 12:11 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-08-15 12:11 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-08-15 12:11 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-08-15 12:11 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-08-15 12:11 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-08-15 12:11 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 18:47 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-08-14 18:47 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-08-14 18:47 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-08-14 18:47 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-08-14 18:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-08-14 18:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-08-14 18:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-08-14 18:47 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-08-14 18:47 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-08-14 18:47 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-08-14 18:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-08-14 18:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-08-14 18:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-08-14 18:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-08-14 18:47 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-08-14 18:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-08-14 18:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-08-14 18:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-08-14 18:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-08-14 18:47 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-08-14 18:47 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-08 18:46 - 2013-09-03 21:01 - 00000000 ____D C:\Users\Admi\Downloads\für TrBo
2013-09-08 18:45 - 2011-09-22 12:08 - 01280249 _____ C:\windows\WindowsUpdate.log
2013-09-08 18:43 - 2012-03-30 17:48 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-08 18:43 - 2011-11-15 21:27 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Dropbox
2013-09-08 18:42 - 2013-09-08 18:42 - 96566691 _____ C:\windows\SysWOW64\⠕Œ
2013-09-08 18:42 - 2013-09-08 18:42 - 00000000 ___RD C:\Users\Admi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-09-08 18:42 - 2011-11-15 21:32 - 00000000 ___RD C:\Users\Admi\Dropbox
2013-09-08 18:40 - 2013-09-03 22:01 - 00000840 _____ C:\windows\setupact.log
2013-09-08 18:40 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-08 14:40 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-08 14:40 - 2009-07-14 06:45 - 00020928 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-08 14:32 - 2013-09-03 22:01 - 00001668 _____ C:\windows\PFRO.log
2013-09-08 11:40 - 2011-09-22 14:57 - 00719614 _____ C:\windows\system32\perfh007.dat
2013-09-08 11:40 - 2011-09-22 14:57 - 00157298 _____ C:\windows\system32\perfc007.dat
2013-09-08 11:40 - 2009-07-14 07:13 - 01675454 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-08 11:03 - 2011-10-11 16:06 - 00000000 ____D C:\Users\Admi\Documents\Bluetooth Folder
2013-09-08 11:00 - 2013-09-08 11:00 - 00023354 _____ C:\ComboFix.txt
2013-09-08 11:00 - 2013-09-08 10:47 - 00000000 ____D C:\Qoobox
2013-09-08 10:58 - 2013-09-08 10:47 - 00000000 ____D C:\windows\erdnt
2013-09-08 10:57 - 2011-10-11 16:02 - 00000000 ____D C:\Users\Admi
2013-09-08 10:57 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-09-06 15:01 - 2013-09-03 21:14 - 00000000 ____D C:\FRST
2013-09-06 11:59 - 2013-09-06 11:59 - 00000000 ____D C:\windows\ERUNT
2013-09-06 11:56 - 2013-09-06 11:56 - 01028823 _____ (Thisisu) C:\Users\Admi\Downloads\JRT.exe
2013-09-06 11:51 - 2013-09-06 11:50 - 00000000 ____D C:\AdwCleaner
2013-09-06 11:44 - 2013-09-03 17:12 - 00001769 _____ C:\Users\Admi\Desktop\lala.html.txt
2013-09-04 22:48 - 2013-09-04 22:19 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-04 22:17 - 2013-09-04 22:17 - 00000000 ____D C:\Program Files\Malwarebytes
2013-09-04 16:00 - 2011-09-22 12:50 - 00000000 ____D C:\ProgramData\Sonic
2013-09-04 15:46 - 2013-04-23 11:18 - 00000000 ____D C:\Users\Admi\Desktop\Sonstiges
2013-09-03 22:01 - 2013-09-03 22:01 - 00000000 _____ C:\windows\setuperr.log
2013-09-03 21:12 - 2013-09-03 21:12 - 00000000 _____ C:\Users\Admi\defogger_reenable
2013-09-03 20:36 - 2012-02-02 23:25 - 00000000 ____D C:\windows\Minidump
2013-09-03 20:36 - 2011-11-19 21:41 - 00000000 ____D C:\Users\Admi\Tracing
2013-09-03 20:36 - 2011-10-12 16:00 - 00000000 ____D C:\Users\Admi\AppData\Local\CrashDumps
2013-09-03 20:36 - 2011-02-23 15:08 - 00000000 ____D C:\windows\Panther
2013-09-03 20:28 - 2013-09-03 20:28 - 00002770 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-09-03 20:28 - 2013-09-03 20:28 - 00000000 ____D C:\Program Files\CCleaner
2013-09-03 20:27 - 2013-09-03 20:27 - 04454952 _____ (Piriform Ltd) C:\Users\Admi\Downloads\ccsetup405.exe
2013-09-03 20:05 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 18:18 - 2013-09-03 18:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-03 18:17 - 2013-09-03 18:17 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admi\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Users\Admi\Neuer Ordner
2013-09-03 18:04 - 2013-09-03 18:04 - 00000000 ____D C:\Program Files\Mozilla
2013-09-03 18:04 - 2011-10-11 16:19 - 00000000 ____D C:\Users\Admi\AppData\Roaming\Mozilla
2013-09-03 17:59 - 2013-09-03 17:59 - 22240760 _____ (Mozilla) C:\Users\Admi\Downloads\Firefox Setup 23.0.1.exe
2013-09-03 17:58 - 2013-04-23 11:16 - 00000000 ____D C:\Program Files (x86)\Opera
2013-09-03 17:49 - 2013-09-03 17:46 - 00000989 _____ C:\freefallprotection.log
2013-09-03 17:47 - 2011-09-22 12:12 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-03 17:26 - 2013-09-03 17:26 - 00000000 ____D C:\windows\system32\IO
2013-09-03 17:21 - 2013-02-20 12:26 - 00000000 ____D C:\Program Files\Canon
2013-09-03 16:08 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-09-02 14:34 - 2013-05-13 08:56 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-02 14:34 - 2013-03-29 11:29 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-02 14:34 - 2013-03-29 11:29 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-02 08:27 - 2012-06-26 21:53 - 00000000 ____D C:\Users\Admi\Documents\DLC
2013-09-02 08:26 - 2013-05-30 18:38 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-08-24 21:09 - 2012-10-04 22:26 - 00000000 ____D C:\Users\Admi\AppData\Roaming\ICQ
2013-08-20 21:43 - 2012-03-30 17:48 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-20 21:43 - 2012-03-30 17:48 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-08-20 21:43 - 2011-10-18 20:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-15 12:06 - 2011-10-15 12:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 12:05 - 2011-10-19 18:10 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

Files to move or delete:
====================
C:\Users\Admi\Hangman.dat
C:\Users\Admi\PCQuiz.dat

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-03 16:01

==================== End Of Log ============================

--- --- ---

cosinus · 08.09.2013, 18:30

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Molsterpöbel · 08.09.2013, 22:42

Supi, es scheint tatsächlich geklappt zu haben. Zumindest tritt das Problem nicht mehr auf und Malwarebytes hat nichts mehr gefunden. ESET lässt sich leider im Moment irgendwie nicht herunterladen, auch nicht, wenn ich es direkt bei denen von der Seite versuche... Vielleicht versuche ich es später nochmal.

Was mich aber noch interessiert:
Was war das für ein Übeltäter und wo könnte er hergekommen sein? Warum erkennt das AntiVir nicht? Wie kann man sowas in Zukunft vermeiden?

Ansonsten vielen Dank und gute Nacht für heute!
Molsterpöbel