Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 18.10.2013, 15:51   #1
Bassmann1968
 
Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Hallo zusammen,

ich habe oben genanntes Problem.
Ich nutze den Rechner beruflisch und Privat und bin viel auf Reisen.
Wahrscheinlich enstanden nach der Nutzung eines Memory-Sticks diese Probleme. Zumindestens ist es mir danach aufgefallen, weil der Virenscanner angeschlagen hatte und ich danach die Firewall-Einstellungen nicht mehr ändern konnte.
Zusätzlich ist mir aufgefallen, dass ich fast jedesmal bei einem Wechsel des WLAN Netzwerks die Problembehandlung ausführen muss, um eine Verbindung zum Internet zu bekommen.

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:05 on 18/10/2013 (armin.basten)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-
         
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by armin.basten (administrator) on KIS-FIELD-PG on 18-10-2013 16:10:29
Running from C:\Users\armin.basten\Downloads
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Hewlett-Packard Company) C:\Program Files\HP\HPBDSService\HPBDSService.exe
(Siemens AG) C:\PROGRAM FILES\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrDba.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrHis.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrPas.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrSaz.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe
(Siemens AG) C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
(OPC Foundation) C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\pniopcac.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAuf.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\NetKit.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Users\armin.basten\Downloads\Defogger.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - D:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [LoadMdm] - C:\Program Files\Wetelecom\LoadMdm.exe [397312 2010-09-13] (TODO: <Company name>)
HKLM\...\Runonce: [Del5750820] - cmd.exe /Q /D /c del "C:\Users\ARMIN~1.BAS\AppData\Local\Temp\0.del"
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Runonce: [Del5750820] - cmd.exe /Q /D /c del "C:\Users\ARMIN~1.BAS\AppData\Local\Temp\0.del"
Startup: C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Updater.lnk
ShortcutTarget: RT-Updater.lnk -> D:\Program Files\VCDS\VCDS.EXE (Ross-Tech, LLC)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.siemens.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9A70EA11C858CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?affID=119816&babsrc=HP_ss_din2g&mntrId=FECE001060D1BBAB
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119816&babsrc=SP_ss_din2g&mntrId=FECE001060D1BBAB
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119816&babsrc=SP_ss_din2g&mntrId=FECE001060D1BBAB
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - D:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\..\Interfaces\{555765F5-ECDF-4795-B550-30881F8EAB47}: [NameServer]77.243.240.230 77.243.240.231
Tcpip\..\Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

Chrome: 
=======
CHR HomePage: hxxp://www.delta-search.com/?affID=119816&babsrc=HP_ss&mntrId=FECE001060D1BBAB
CHR Extension: (YouTube) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak\1.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp\5.0.94.1_0
CHR Extension: (Gmail) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [1138312 2011-12-11] (SIEMENS AG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CCAgent; C:\Program Files\Common Files\Siemens\ACE\bin\CCAgent.exe [344064 2009-07-16] (SIEMENS AG)
S3 CCEClient; C:\Program Files\Common Files\Siemens\ace\bin\CCEClient.exe [262144 2009-07-16] (SIEMENS AG)
S2 CCEServer; C:\Program Files\Common Files\Siemens\ace\bin\CCEServer.exe [237568 2009-07-16] (SIEMENS AG)
R2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2010-10-27] (Hewlett-Packard Company)
R2 LcSvrAdm; D:\ElsaWin\bin\LcSvrAdm.exe [240640 2011-12-06] (Volkswagen AG)
R3 LcSvrAuf; D:\ElsaWin\bin\LcSvrAuf.exe [1321472 2011-12-06] (Volkswagen AG)
R2 LcSvrDba; D:\ElsaWin\bin\LcSvrDba.exe [392704 2011-12-06] (Volkswagen AG)
R2 LcSvrHis; D:\ElsaWin\bin\LcSvrHis.exe [335360 2011-12-06] (Volkswagen AG)
R2 LcSvrPAS; D:\ElsaWin\bin\LcSvrPas.exe [477696 2011-12-06] (Volkswagen AG)
R2 LcSvrSaz; D:\ElsaWin\bin\LcSvrSaz.exe [373248 2011-12-06] (Volkswagen AG)
R2 MSSQL$WINCCFLEXEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUS; C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUSMIG; C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [227600 2010-07-19] ()
S3 OpcEnum; C:\Windows\system32\Opcenum.exe [139488 2009-02-05] (OPC Foundation)
S3 RedundancyControl; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyControl.exe [430080 2009-07-16] (SIEMENS AG)
S3 RedundancyState; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyState.exe [180224 2009-07-16] (SIEMENS AG)
R2 s7hspsvx; C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2010-06-02] (SIEMENS AG)
R2 s7oiehsx; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [412808 2011-11-04] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [556168 2011-11-04] (SIEMENS AG)
R2 SCSMonitor; C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe [167936 2009-07-16] (SIEMENS AG)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 smartserver; C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe [558416 2011-12-06] (Siemens AG)
R2 UA Local Discovery Server; C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [28160 2010-05-05] (OPC Foundation)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dpmconv; C:\Windows\System32\DRIVERS\dpmconv32.sys [288256 2010-04-28] (SIEMENS AG)
S3 dpmcslv; C:\Windows\System32\Drivers\dpmcslv.sys [68280 2005-07-04] (Siemens AG)
R1 DPMTRCDD; C:\Windows\System32\DRIVERS\DPMTRCDD32.sys [72248 2010-03-22] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-23] (DT Soft Ltd)
R3 e1qexpress; C:\Windows\System32\DRIVERS\e1q6232.sys [215208 2009-11-05] (Intel Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R3 fwkbdrtm; C:\Windows\system32\drivers\fwkbdrtm.sys [21464 2011-12-06] (Windows (R) Win 7 DDK provider)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 HPFXBULKLEDM; C:\Windows\System32\drivers\hppcbulkio.sys [20504 2011-05-10] (Hewlett Packard)
S3 IAMT03; C:\Windows\system32\DRIVERS\IAMT03.sys [40848 2007-04-11] (Intel Corporation)
S3 IAMTV; C:\Windows\system32\DRIVERS\IAMTV.sys [38288 2007-04-11] (Intel Corporation)
S3 IAMTXP; C:\Windows\system32\DRIVERS\IAMTXP.sys [47496 2007-04-11] (Intel Corporation)
R3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-19] (Intel Corporation)
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42648 2011-04-30] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [12184 2011-04-30] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-04-30] (Logitech, Inc.)
S3 NAL; C:\Windows\system32\Drivers\iqvw32.sys [30880 2010-03-24] (Intel Corporation )
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [6814720 2010-07-14] (Intel Corporation)
R2 NSHE; C:\Windows\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008)
R2 PROFIbrd; C:\Windows\System32\Drivers\PROFIbrd.sys [165432 2010-03-10] (Softing AG)
S3 PROFIpnp; C:\Windows\System32\Drivers\PROFIpnp.sys [19256 2010-03-10] (Softing AG)
R2 PROFIprt; C:\Windows\System32\Drivers\PROFIprt.sys [39480 2010-03-10] (Softing AG)
R2 PROFIstack; C:\Windows\System32\Drivers\PROFIstack.sys [130104 2010-03-10] (Softing AG)
S3 PROFIusb; C:\Windows\System32\Drivers\PROFIusb.sys [39352 2010-03-10] (Softing AG)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [59464 2010-06-16] (Ross-Tech LLC)
R3 S7odpx2x32; C:\Windows\System32\Drivers\S7odpx2x32.sys [87552 2011-05-06] (SIEMENS AG)
R3 s7opciax32; C:\Windows\System32\DRIVERS\s7opciax32.sys [227840 2011-06-22] (SIEMENS AG)
R2 S7opcsrtx; C:\Windows\System32\DRIVERS\s7opcsrtx.sys [31744 2011-02-22] (SIEMENS AG)
R3 s7otmcd32x; C:\Windows\System32\Drivers\s7otmcd32x.sys [256512 2011-05-06] (SIEMENS AG)
R3 S7otranx32; C:\Windows\System32\Drivers\S7otranx32.sys [521216 2011-05-06] (SIEMENS AG)
R3 s7otsadx32; C:\Windows\System32\Drivers\s7otsadx32.sys [182784 2011-09-29] (SIEMENS AG)
R2 s7ousbu32x; C:\Windows\System32\DRIVERS\s7ousbu32x.sys [641280 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [63104 2011-06-16] (SIEMENS AG)
R2 s7snsrtx; C:\Windows\System32\DRIVERS\s7snsrtx.sys [73088 2009-02-24] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [343888 2011-10-11] (SIEMENS AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2010-06-09] (Samsung Electronics)
S3 usbbulk; C:\Windows\System32\Drivers\USBBulk.sys [18776 2008-07-04] (SEGGER MICROCONTROLLER GmbH & Co. KG)
R1 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada32.sys [98944 2010-03-22] (SIEMENS AG)
R3 wmdusbser; C:\Windows\System32\DRIVERS\wmdusbser.sys [107136 2010-06-11] (WeTelecom Incorporated)
S3 ZTEusbMB; C:\Windows\System32\DRIVERS\ZTEusbnmeaext2.sys [107520 2011-07-04] (ZTE Incorporated)
S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [195072 2011-12-01] (ZTE Incorporated)
S3 ALSysIO; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 massfilter; system32\DRIVERS\massfilter.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]
U3 mbr; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\mbr.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:08 - 2013-10-18 16:09 - 01087213 _____ (Farbar) C:\Users\armin.basten\Downloads\FRST.exe
2013-10-18 16:05 - 2013-10-18 16:06 - 00000556 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:42 - 2013-10-18 15:42 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DigitalSite
2013-10-18 15:36 - 2013-10-18 15:41 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 15:25 - 2013-10-18 15:25 - 00015001 _____ C:\Users\armin.basten\Downloads\[kickass.to]grown.ups.2010.720p.brrip.x264.yify.torrent
2013-10-18 15:25 - 2013-10-18 15:25 - 00008244 _____ C:\Users\armin.basten\Downloads\[kickass.to]grown.ups.2.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008232 _____ C:\Users\armin.basten\Downloads\[kickass.to]despicable.me.2.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008198 _____ C:\Users\armin.basten\Downloads\[kickass.to]r.i.p.d.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008178 _____ C:\Users\armin.basten\Downloads\[kickass.to]parkland.2013.720p.brrip.x264.yify.torrent
2013-10-18 14:58 - 2013-10-18 14:58 - 00028958 _____ C:\ComboFix.txt
2013-10-18 13:47 - 2013-10-18 14:59 - 00000000 ____D C:\ComboFix
2013-10-18 13:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-18 13:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-18 13:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-18 12:34 - 2013-10-18 12:36 - 05134711 ____R (Swearware) C:\Users\armin.basten\Downloads\ComboFix.exe
2013-10-18 08:39 - 2013-10-18 15:07 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 12:48 - 2013-10-17 07:30 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-10 15:31 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 07:06 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 07:06 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 07:06 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 07:06 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 07:06 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 07:05 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 23:48 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 23:48 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 23:48 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 23:48 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 23:48 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 23:48 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 23:48 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 23:48 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 23:48 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 23:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 23:48 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 23:48 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 23:48 - 2013-07-12 12:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 23:48 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 23:48 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 23:48 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 23:48 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 23:48 - 2013-07-03 06:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 23:48 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 23:48 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 23:48 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 23:47 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:52 - 2013-10-03 12:53 - 12105568 _____ (EVC electronic GmbH                                         ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 13:28 - 2013-10-02 17:55 - 00000056 _____ C:\Windows\Acroread.ini
2013-09-30 21:49 - 2013-10-01 03:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 22:31 - 2013-09-29 23:14 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 22:13 - 2013-09-30 16:20 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-29 22:12 - 2013-09-29 23:11 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:10 - 1996-11-05 15:13 - 00299008 _____ (InstallShield Corporation, Inc.) C:\Windows\uninst.exe
2013-09-29 21:22 - 2013-09-29 21:35 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-10-18 14:06 - 00008454 _____ C:\Windows\PFRO.log
2013-09-29 21:17 - 2013-10-18 14:06 - 00001637 _____ C:\Windows\setupact.log
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:12 - 2013-09-29 13:57 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 12:12 - 2011-06-21 10:24 - 00032768 _____ C:\Windows\system32\Drivers\sp_rsdrv2.sys
2013-09-28 12:06 - 2013-09-28 12:08 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-27 23:28 - 2013-09-28 06:10 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 23:28 - 2012-12-10 10:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2013-09-27 23:28 - 2012-12-10 10:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2013-09-27 22:29 - 2013-09-27 22:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-09-27 22:22 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-25 15:48 - 2013-09-26 03:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 11:33 - 2013-10-09 14:06 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-09-21 08:52 - 2008-11-23 09:23 - 00097792 _____ (T0r0 2008) C:\Windows\system32\Drivers\NSHE.SYS
2013-09-21 08:50 - 2013-09-29 14:32 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 08:48 - 2006-12-20 10:55 - 03066968 _____ (Aladdin Knowledge Systems.) C:\Windows\system32\hinstd.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 02511360 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\haspds_windows.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 00671112 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hdinst_windows.dll
2013-09-21 08:48 - 2006-11-30 10:06 - 00069632 _____ (Aladdin Knowledge Systems) C:\Windows\system32\hasp_inst_help1.dll
2013-09-21 08:48 - 2005-09-06 16:06 - 00028672 _____ C:\Windows\system32\hlduinst.exe
2013-09-21 08:48 - 2002-07-26 16:02 - 00006836 _____ C:\Windows\system32\UNWISE.INI
2013-09-21 08:15 - 2013-09-29 14:02 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-20 19:00 - 2013-10-13 21:54 - 00005102 _____ C:\Users\armin.basten\Desktop\S6-4F.txt

==================== One Month Modified Files and Folders =======

2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:09 - 2013-10-18 16:08 - 01087213 _____ (Farbar) C:\Users\armin.basten\Downloads\FRST.exe
2013-10-18 16:06 - 2013-10-18 16:05 - 00000556 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:44 - 2011-07-27 11:04 - 01132133 _____ C:\Windows\WindowsUpdate.log
2013-10-18 15:42 - 2013-10-18 15:42 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DigitalSite
2013-10-18 15:41 - 2013-10-18 15:36 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 15:25 - 2013-10-18 15:25 - 00015001 _____ C:\Users\armin.basten\Downloads\[kickass.to]grown.ups.2010.720p.brrip.x264.yify.torrent
2013-10-18 15:25 - 2013-10-18 15:25 - 00008244 _____ C:\Users\armin.basten\Downloads\[kickass.to]grown.ups.2.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008232 _____ C:\Users\armin.basten\Downloads\[kickass.to]despicable.me.2.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008198 _____ C:\Users\armin.basten\Downloads\[kickass.to]r.i.p.d.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008178 _____ C:\Users\armin.basten\Downloads\[kickass.to]parkland.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:07 - 2013-10-18 08:39 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 14:59 - 2013-10-18 13:47 - 00000000 ____D C:\ComboFix
2013-10-18 14:58 - 2013-10-18 14:58 - 00028958 _____ C:\ComboFix.txt
2013-10-18 14:58 - 2013-08-10 11:57 - 00000000 ____D C:\Qoobox
2013-10-18 14:52 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-18 14:17 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-18 14:17 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-18 14:15 - 2011-10-14 17:18 - 00763840 _____ C:\Windows\system32\perfh01F.dat
2013-10-18 14:15 - 2011-10-14 17:18 - 00182854 _____ C:\Windows\system32\perfc01F.dat
2013-10-18 14:15 - 2011-08-09 13:24 - 00830312 _____ C:\Windows\system32\perfh019.dat
2013-10-18 14:15 - 2011-08-09 13:24 - 00193648 _____ C:\Windows\system32\perfc019.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00602068 _____ C:\Windows\system32\perfh014.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00549482 _____ C:\Windows\system32\perfh012.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00526592 _____ C:\Windows\system32\prfh0404.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00510290 _____ C:\Windows\system32\prfh0804.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00165054 _____ C:\Windows\system32\perfc012.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00164626 _____ C:\Windows\system32\prfc0804.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00159712 _____ C:\Windows\system32\prfc0404.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00137768 _____ C:\Windows\system32\perfc014.dat
2013-10-18 14:15 - 2010-07-01 02:19 - 00844522 _____ C:\Windows\system32\perfh010.dat
2013-10-18 14:15 - 2010-07-01 02:19 - 00188544 _____ C:\Windows\system32\perfc010.dat
2013-10-18 14:15 - 2010-06-30 16:31 - 11561664 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-18 14:06 - 2013-09-29 21:17 - 00008454 _____ C:\Windows\PFRO.log
2013-10-18 14:06 - 2013-09-29 21:17 - 00001637 _____ C:\Windows\setupact.log
2013-10-18 12:36 - 2013-10-18 12:34 - 05134711 ____R (Swearware) C:\Users\armin.basten\Downloads\ComboFix.exe
2013-10-18 12:13 - 2011-07-27 13:54 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Skype
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-18 07:02 - 2013-02-16 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\uTorrent
2013-10-17 23:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 09:33 - 2012-04-15 11:00 - 00000000 ____D C:\ProgramData\Apple
2013-10-17 07:30 - 2013-10-17 12:48 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-14 07:40 - 2011-08-17 07:37 - 00000000 ____D C:\Windows\Minidump
2013-10-13 21:54 - 2013-09-20 19:00 - 00005102 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ___RD C:\Program Files\Skype
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ____D C:\ProgramData\Skype
2013-10-10 17:11 - 2012-03-03 08:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\AIMP3
2013-10-10 08:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 07:43 - 2009-07-14 06:33 - 00509944 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-TW
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-CN
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\nb-NO
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ko-KR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\it-IT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fr-FR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fi-FI
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-10 07:15 - 2011-07-28 12:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 07:13 - 2013-07-20 12:09 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 07:07 - 2011-07-27 18:14 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 14:06 - 2013-09-21 11:33 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\WindSolutions
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-09 08:47 - 2013-05-06 13:40 - 00004756 _____ C:\Users\armin.basten\Desktop\Edenites.txt
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:53 - 2013-10-03 12:52 - 12105568 _____ (EVC electronic GmbH                                         ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-02 17:55 - 2013-10-01 13:28 - 00000056 _____ C:\Windows\Acroread.ini
2013-10-01 16:00 - 2013-05-06 10:45 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 03:49 - 2013-09-30 21:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 16:20 - 2013-09-29 22:13 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 23:14 - 2013-09-29 22:31 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 23:11 - 2013-09-29 22:12 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:09 - 2013-03-23 16:26 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DAEMON Tools Lite
2013-09-29 21:35 - 2013-09-29 21:22 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 17:18 - 2012-04-03 13:27 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\FileZilla
2013-09-29 16:10 - 2013-03-24 14:04 - 00000156 _____ C:\Windows\etkinst.ini
2013-09-29 14:32 - 2013-09-21 08:50 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-29 14:02 - 2013-09-21 08:15 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-29 14:02 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system
2013-09-29 13:57 - 2013-09-28 12:12 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:08 - 2013-09-28 12:06 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 09:16 - 2012-06-17 16:37 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Audacity
2013-09-28 07:32 - 2012-05-11 19:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-28 07:32 - 2011-07-27 15:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-28 06:10 - 2013-09-27 23:28 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 23:25 - 2013-07-27 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Local\SwvUpdater
2013-09-27 22:37 - 2013-09-27 22:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 22:22 - 2013-09-27 20:32 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-02-04 04:27 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-09-27 20:22 - 2013-03-23 16:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\BabSolution
2013-09-27 20:21 - 2011-08-03 13:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Canon
2013-09-27 20:21 - 2011-08-03 12:44 - 00000000 ____D C:\Program Files\Canon
2013-09-27 20:17 - 2011-08-03 13:32 - 00000000 ___HD C:\ProgramData\CanonIJScan
2013-09-27 20:17 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-09-27 20:08 - 2012-04-15 11:04 - 00000000 ____D C:\ProgramData\Apple Computer
2013-09-26 03:48 - 2013-09-25 15:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 01:28 - 2013-10-10 07:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-10 07:06 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:28 - 2013-10-10 07:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 09:01 - 2011-10-08 07:18 - 00000000 ____D C:\Users\armin.basten\Desktop\IFM VES003_2_6
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 05:30 - 2013-10-10 07:06 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-10 07:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

Some content of TEMP:
====================
C:\Users\armin.basten\AppData\Local\temp\avgnt.exe
C:\Users\armin.basten\AppData\Local\temp\ICReinstall_DownloadManagerSetup (1).exe
C:\Users\armin.basten\AppData\Local\temp\ICReinstall_DownloadManagerSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 00:20

==================== End Of Log ============================
         
--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by armin.basten at 2013-10-18 16:11:31
Running from C:\Users\armin.basten\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 8.1.1)
7-Zip 9.20
ABB DTM500 (Version: 05.03.00)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.175)
Adobe Flash Player 11 Plugin (Version: 11.6.602.180)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8)
Adobe SVG Viewer 3.0 (Version:  3.0)
AIMP3 (Version: v3.00.981)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Audacity 2.0
Autodesk Design Review 2009 DGN Importer (Version: 2.00.071)
Autodesk Design Review 2009 JT Importer (Version: 2.00.071)
Autodesk Design Review 2010 (Version: 10.0.0.108)
Avira Free Antivirus (Version: 14.0.0.383)
Bluetooth Stack for Windows by Toshiba (Version: v7.10.12)
Bonjour (Version: 3.0.0.10)
Bonjour-Druckdienste (Version: 2.0.2.0)
BufferChm (Version: 130.0.331.000)
CameraHelperMsi (Version: 13.31.1038.0)
CCleaner (Version: 3.09)
Core Temp 1.0 RC3 (Version: 1.0)
D3DX10 (Version: 15.4.2368.0902)
DAEMON Tools Lite (Version: 4.47.1.0333)
Destinations (Version: 130.0.0.0)
Disoplan (Version: 9.00.0006)
DocProc (Version: 13.0.0.0)
DTM 266-PdP HART (Version: 05.00.02.31)
DTM TTX300 HART (Version: 05.00.10.16)
DTM500 Library (Version: 05.00.17.25)
DWG TrueView 2010 (Version: 18.0.55.0)
Elcomsoft Advanced Office Password Recovery Professional (Version: v4.10)
ELECTRA 2.8
ElsaWin (Version: 4.00)
ElsterFormular (Version: 13.0.0.8086)
eReg (Version: 1.20.138.34)
ETKA 7.4 Germany 2013
FileZilla Client 3.7.3 (Version: 3.7.3)
FlukeView ScopeMeter 4
FluMoS Light V01.40R01
GOM Player (Version: 2.1.50.5145)
Google Chrome (HKCU Version: 29.0.1547.66)
GPBaseService2 (Version: 130.0.371.000)
HART Communication FDT 1.2 DTM (V1.0.39) (Version: 1.0.39.0)
HP Deskjet 3050 J610 series Basic Device Software (Version: 22.0.334.0)
HP Deskjet 3050 J610 series Hilfe (Version: 140.0.63.63)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP LaserJet 100 color MFP M175
HP LJ100 M175 HP Scan (Version: 1.0.302.0)
HP Photosmart 5510d series - Grundlegende Software für das Gerät (Version: 25.0.607.0)
HP Scanjet G3010 (Version: 13.0)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 5.003.001.001)
hpbDSService (Version: 001.001.05133)
hpbM175DSService (Version: 001.001.05133)
hpg3010 (Version: 13.0.0.0)
HPProductAssistant (Version: 130.0.371.000)
HUAWEI DataCard Driver 4.22.19.00 (Version: 4.22.19.00)
iCloud (Version: 2.1.2.8)
ICS Generic HART Release 4 FDT 1.2 DTM (Version: 4.0.3)
IDT Audio (Version: 5.10.0000.0)
ImgBurn (Version: 2.5.8.0)
Intel PROSet Wireless
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.2182)
Intel(R) Management Engine Components (Version: 6.0.0.1179)
Intel(R) Network Connections 15.4.82.0 (Version: 15.4.82.0)
Intel(R) PROSet/Wireless WiFi Software (Version: 13.03.0000)
iTunes (Version: 11.0.5.5)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Logitech SetPoint 6.32 (Version: 6.32.20)
Logitech Webcam Software (Version: 2.0)
LWS Facebook (Version: 13.31.1038.0)
LWS Gallery (Version: 13.31.1038.0)
LWS Help_main (Version: 13.31.1044.0)
LWS Launcher (Version: 13.31.1038.0)
LWS Motion Detection (Version: 13.30.1395.0)
LWS Pictures And Video (Version: 13.31.1038.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Video Mask Maker (Version: 13.30.1379.0)
LWS VideoEffects (Version: 13.30.1379.0)
LWS Webcam Software (Version: 13.31.1038.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Standard 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Primary Interoperability Assemblies 2005 (Version: 8.0.50727.42)
Microsoft SOAP Toolkit 3.0 (Version: 3.0.1325.4)
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Backward compatibility (Version: 8.05.2312)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft SQL Server 2005 Express Edition (WINCCFLEXEXPRESS) (Version: 9.4.5000.00)
Microsoft SQL Server 2005 Express Edition (WINCCPLUS) (Version: 9.4.5000.00)
Microsoft SQL Server 2005 Express Edition (WINCCPLUSMIG) (Version: 9.4.5000.00)
Microsoft SQL Server Native Client (Version: 9.00.5000.00)
Microsoft SQL Server Setup Support Files (English) (Version: 9.00.5000.00)
Microsoft SQL Server VSS Writer (Version: 9.00.5000.00)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft XML Parser (Version: 8.30.9530.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Neuratron PhotoScore Ultimate Demo (Version: 7.0.2)
NirSoft ShellExView
Notepad++ (Version: 6.1.2)
Nur Entfernen der CopyTrans Suite möglich (HKCU Version: 2.37)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
OPC .NET API 2.00 Redistributables (x86) 101.0 (Version: 2.00.10200)
OPC Core Components Redistributable (Version: 3.00.102)
OPC Core Components Redistributable (x86) 101.2 (Version: 3.00.10102)
OPC UA SDK 1.01 Redistributables 314.0 (Version: 1.01.31400)
PACTware 4.0 (Version: 4.0.06)
pdfsam (Version: 2.2.1)
PKZIP Server for Windows 12.40.0008 (Version: 12.40.0008)
Scan (Version: 13.0.0.0)
Sibelius 7 OpenType Fonts (Version: 7.0.0)
Siemens  Totally Integrated Automation Portal V10 (Version: V10.5 SP2)
Siemens Automation License Manager (Version: 05.01.0103)
Siemens Automation License Manager V5.1 + SP1 + Upd3   (Version: 05.01.0103)
Siemens Totally Integrated Automation Portal V11 (Version: V11)
SIMATIC  STEP 7 (Version: 05.05.0000)
SIMATIC  STEP 7 V5.5 Professional 2010   (Version: 05.05.0000)
SIMATIC Device Drivers (Version: 08.02.0200)
SIMATIC Event Database (Version: 05.05.0003)
SIMATIC HMI License Manager Panel Plugin (Version: 11.00.0100)
SIMATIC HMI ProSave (Version: 09.00.0300)
SIMATIC HMI Symbol Library (Version: 11.00.0200)
SIMATIC LanguageSupportTool (Version: 05.08.0100)
SIMATIC OPC-XML-Gateway (Version: 01.03.0200)
SIMATIC OPC-XML-Gateway V1.3 + SP 2   (Version: 01.03.0200)
SIMATIC Prosave (Version: 09.00.0300)
SIMATIC Prosave V9.0 incl. SP3   (Version: 09.00.0300)
SIMATIC S7 CP PtP Param (Version: 5.1.1300)
SIMATIC S7 CP PtP Param V5.1 + SP13   (Version: 5.1.1300)
SIMATIC S7 Distributed Safety Prog. V5.4 + SP5   (Version: 05.04.0500)
SIMATIC S7 Distributed Safety Prog. V5.4 SP5    
SIMATIC S7 F ConfigurationPack (Version: 05.05.0700)
SIMATIC S7 F ConfigurationPack V5.5 + SP7   (Version: 05.05.0700)
SIMATIC S7-GRAPH V5.3 + SP6 Professional 2010   (Version: 05.03.0600)
SIMATIC S7-GRAPH V5.3 inkl. SP6 Professional 2010  
SIMATIC S7-PCT (Version: 02.01.0000)
SIMATIC S7-PCT Advanced Services
SIMATIC S7-PCT V2.1 Professional 2010   (Version: 02.01.0000)
SIMATIC S7-PLCSIM (Version: 5.4.0401)
SIMATIC S7-PLCSIM V5.4 + SP4 + HF1   (Version: 5.4.0401)
SIMATIC S7-SCL V5.3 + SP5 Professional 2010   (Version: 5.3.5.0)
SIMATIC S7-SCL V5.3 SP5 Professional 2010  
SIMATIC STEP 7 Advanced Services
SIMATIC TS Adapter IE (Version: 03.00.0000)
SIMATIC TS Adapter IE V3.0   (Version: 03.00.0000)
SIMATIC TS Adapter MPI (Version: 3.0)
SIMATIC TS Adapter MPI V3.0 + SP1   (Version: 3.0)
SIMATIC Version View (Version: 01.07.0600)
SIMATIC WinCC flexible 2008 SP3 (Version: 01.04.0000)
SIMATIC WinCC flexible OCX (Version: 01.04.0000)
SIMATIC WinCC flexible Runtime (Version: 01.04.0000)
SIMATIC WinCC flexible Runtime 2008 SP3   (Version: 01.04.0000)
SIMATIC WinCC flexible Simulator (Version: 01.08.0300)
SIMATIC WinCC flexible Tag Simulator (Version: 01.04.0000)
Skype Click to Call (Version: 6.4.11328)
Skype™ 6.9 (Version: 6.9.106)
Softing PROFIdtm (Version: 2.11.00)
SolutionCenter (Version: 130.0.373.000)
Synaptics Pointing Device Driver (Version: 14.0.3.0)
Target 3001! V15 discover (Version: )
TeamViewer 8 (Version: 8.0.19617)
Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 2.00.0005)
ThirdPartyCompInstaller (Version: 05.00.04)
TIA Portal Single SetupPackage - Hardware Support Base Package 0  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Hardware Support Base Package 02  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Hardware Support Base Package 03  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Hardware Support Base Package WCF-01  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - HW Module Base Package  V10.5 + HF1 (Version: 10.05.0001)
TIA Portal Single SetupPackage - HWConfig Single SetupPackage  V10.5 + SP2 (Version: 10.05.0200)
TIA Portal Single SetupPackage - HWConfig Single SetupPackage  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - S7BASUCL  V10.5 + SP12 (Version: 10.05.1200)
TIA Portal Single SetupPackage - STEP 7 Single SetupPackage  V10.5 + SP2 (Version: 10.05.0200)
TIA Portal Single SetupPackage - STEP 7 Single SetupPackage  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Support Base Package TO-01  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Support Base Package TO-02  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - TIA ESTOUR  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - WinCC Single SetupPackage  V10.5 + SP2 (Version: 10.05.0200)
TIA Portal Single SetupPackage - WinCC Single SetupPackage  V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - WINCCBASUCL  V10.5 + SP12 (Version: 10.05.1200)
TIA Portal Single SetupPackage - WINCCBASUCL  V11.0 + SP11 (Version: 11.00.1100)
TIPCI (Version: 2.00.0005)
Totally Integrated Automation Portal V10 -  TIA Portal Single SetupPackage  V10.5 + SP2 (Version: 10.05.0200)
Totally Integrated Automation Portal V11 -  TIA Portal Single SetupPackage  V11.0 (Version: 11.00.0000)
Update for 2007 Microsoft Office System (KB967642)
Update for Codec Pack
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition
Update for Mipony Download Manager
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
VC User 71 RTL X86 --- (Version: 1.0)
VCDS Release 11.11.6 (Version: 11.11.6)
VCDS Release 12.12.0 (Version: 12.12.0)
VEGA DTM VEGADIF 55 V1.4.129.244 (Version: 1.7.244)
VEGA-DTM 1.65.0 (Version: 1.48.0000)
Visual C++ 2008 x86 Runtime - (v9.0.30729.5578) (Version: 9.0.30729.5578)
Visual C++ 2008 x86 Runtime - v9.0.30729.5578 (Version: 9.0.30729.5578)
WebReg (Version: 130.0.132.017)
Wetelecom (Version: 1.0)
WinCC flexible (Version: 01.04.0000)
WinCC flexible Graphics (Version: 1.04.0000)
WinCC flexible Languages (Version: 1.04.0000)
WinCC Runtime Advanced Simulator (Version: 11.00.0000)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows-Treiberpaket - Ross-Tech USB Driver Package (06/16/2010 2.06.02) (Version: 06/16/2010 2.06.02)
Xvid Video Codec (Version: 1.3.2)
ZTE USB Driver (Version: 1.0.1.5_Turkcell)

==================== Restore Points  =========================

17-10-2013 22:03:29 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2013-10-18 13:33 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {00AC3588-F115-444A-ABD0-93570EAF801B} - System32\Tasks\{9E14ADC3-014D-4A79-87AF-735E769D2294} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: {16A38688-0E30-401D-ADD7-272B1C07BAA0} - System32\Tasks\{D912E601-65A8-4EA4-9BDA-55202B39B343} => Chrome.exe hxxp://ui.skype.com/ui/0/6.3.66.105/de/go/help.faq.installer?LastError=1618
Task: {1BF3961C-D6C8-45A8-A146-D677174205BC} - System32\Tasks\AmiUpdXp => C:\Users\armin.basten\AppData\Local\SwvUpdater\Updater.exe
Task: {1CC7CCC9-30F7-4237-96A2-6DFD41554BDD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {267CEBFB-42AD-4935-A087-4535A557E249} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\system32\FlashPlayerUpdateService.exe
Task: {4ED61137-C6ED-4E41-8178-74B22D617E22} - System32\Tasks\{5D468662-5516-4BBC-8503-ACD84219E1FB} => Chrome.exe hxxp://ui.skype.com/ui/0/6.3.66.105/de/go/help.faq.installer?LastError=1618
Task: {6EC248CA-255C-4EB8-AE09-D5306C0ED2FA} - System32\Tasks\{A3FB6368-314A-482B-9579-0CA6E53194D3} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: {789F4F36-BCBB-4F01-8CBA-136DF573AD7A} - System32\Tasks\DealPlyUpdate => C:\Program
Task: {91C8F6E6-1DAF-476B-9965-D00AF65BF694} - System32\Tasks\{7E7FF179-F4F8-4C7B-A246-B94C10BE5A48} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: {92FF716D-60AD-4F4F-AA69-E68EC7148041} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\system32\FlashPlayerUpdateService.exe
Task: {9E50076B-5350-4E37-8DCB-8476B6480124} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005UA => C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-04] (Google Inc.)
Task: {A4CE552A-9A7F-4C36-9574-125690A46CDE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005Core => C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-04] (Google Inc.)
Task: {D12C3D3E-D9B0-4CD6-8647-DAB7AA0E967C} - System32\Tasks\{25A0B681-AEE8-4F2E-9F3C-7DDD726AAC5A} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: {DCD67A11-71BC-4DF6-B58B-ED2DE2D2B092} - System32\Tasks\{F38BB4CB-5BD7-4E3B-A0A5-7BDC59B1050F} => C:\Program Files\Skype\\Phone\Skype.exe [2013-10-02] (Skype Technologies S.A.)
Task: {E297CBDB-E008-4B41-A4D6-7962CE15DB5B} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect
Task: {EF41E1B1-2590-4F8B-9BB2-CFDB5040688C} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {FC548396-9875-4F3D-8EC9-E821867AF3DD} - System32\Tasks\{FC749B2D-4412-4C4C-813B-5144CC89805F} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005Core.job => C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005UA.job => C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-02-20 20:29 - 2012-02-20 20:29 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-02-20 20:28 - 2012-02-20 20:28 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-07-18 23:04 - 2011-07-18 23:04 - 00296448 _____ () C:\Program Files\Notepad++\NppShell_04.dll
2013-08-07 21:25 - 2013-08-07 21:25 - 00093696 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 00709584 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\libglesv2.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 00099792 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\libegl.dll
2010-05-10 03:24 - 2010-05-10 03:24 - 00581632 _____ () C:\Program Files\Wetelecom\sqlite3.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 04053456 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 00410576 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 01604560 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\ffmpegsumo.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 13599184 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:8CE646EE
AlternateDataStreams: C:\Users\armin.basten\Downloads\BonjourPSSetup.exe:AFP_AfpInfo
AlternateDataStreams: C:\Users\armin.basten\Downloads\BonjourPSSetup.exe:com.apple.metadata?kMDItemWhereFroms
AlternateDataStreams: C:\Users\armin.basten\Downloads\BonjourPSSetup.exe:com.apple.quarantine
AlternateDataStreams: C:\Users\armin.basten\Downloads\BonjourPSSetup.exe:Mac_Metadata

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Microsoft Virtual WiFi Miniport Adapter #2
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/09/2013 04:02:12 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pniopcac.exe, Version: 8.1.1.4312, Zeitstempel: 0x4ea68e07
Name des fehlerhaften Moduls: pniopcac.exe, Version: 8.1.1.4312, Zeitstempel: 0x4ea68e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000387a4
ID des fehlerhaften Prozesses: 0x2d04
Startzeit der fehlerhaften Anwendung: 0xpniopcac.exe0
Pfad der fehlerhaften Anwendung: pniopcac.exe1
Pfad des fehlerhaften Moduls: pniopcac.exe2
Berichtskennung: pniopcac.exe3

Error: (10/05/2013 07:31:22 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: WLANExt.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc89a
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db96c5
Ausnahmecode: 0xc0000008
Fehleroffset: 0x00081f84
ID des fehlerhaften Prozesses: 0xaa8
Startzeit der fehlerhaften Anwendung: 0xWLANExt.exe0
Pfad der fehlerhaften Anwendung: WLANExt.exe1
Pfad des fehlerhaften Moduls: WLANExt.exe2
Berichtskennung: WLANExt.exe3

Error: (10/03/2013 03:58:31 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pniopcac.exe, Version: 8.1.1.4312, Zeitstempel: 0x4ea68e07
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db96c5
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003224d
ID des fehlerhaften Prozesses: 0xfe0
Startzeit der fehlerhaften Anwendung: 0xpniopcac.exe0
Pfad der fehlerhaften Anwendung: pniopcac.exe1
Pfad des fehlerhaften Moduls: pniopcac.exe2
Berichtskennung: pniopcac.exe3

Error: (09/30/2013 10:29:43 AM) (Source: LCSVRADM) (User: NT-AUTORITÄT)
Description: LoadLibrary Instdllu.dll failed.

Error: (09/29/2013 11:10:00 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 7e8

Startzeit: 01cebd5814ee1b6d

Endzeit: 16

Anwendungspfad: F:\crack\keygen.exe

Berichts-ID: 7f0f394c-294b-11e3-924a-001060d1bbab

Error: (09/29/2013 11:08:34 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: d10

Startzeit: 01cebd57fd41abf3

Endzeit: 0

Anwendungspfad: F:\crack\keygen.exe

Berichts-ID: 4ae08eca-294b-11e3-924a-001060d1bbab

Error: (09/29/2013 10:30:01 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1038

Startzeit: 01cebd525a377337

Endzeit: 0

Anwendungspfad: F:\crack\keygen.exe

Berichts-ID: e7a72828-2945-11e3-924a-001060d1bbab

Error: (09/29/2013 10:26:06 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 9ac

Startzeit: 01cebd515bec562f

Endzeit: 0

Anwendungspfad: F:\crack\keygen.exe

Berichts-ID: 5a4c3bf1-2945-11e3-924a-001060d1bbab

Error: (09/29/2013 10:16:16 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 17e4

Startzeit: 01cebd5075d343d2

Endzeit: 15

Anwendungspfad: F:\crack\keygen.exe

Berichts-ID: fb993cc0-2943-11e3-924a-001060d1bbab

Error: (09/29/2013 01:47:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: etka7.exe, Version: 7.4.0.1643, Zeitstempel: 0x51fa2794
Name des fehlerhaften Moduls: EtUpdCon.dll, Version: 1.0.0.2, Zeitstempel: 0x4e799e51
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000041ec
ID des fehlerhaften Prozesses: 0x1338
Startzeit der fehlerhaften Anwendung: 0xetka7.exe0
Pfad der fehlerhaften Anwendung: etka7.exe1
Pfad des fehlerhaften Moduls: etka7.exe2
Berichtskennung: etka7.exe3


System errors:
=============
Error: (10/18/2013 03:02:49 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%13.

Error: (10/18/2013 03:02:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%13.

Error: (10/18/2013 03:02:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%13.

Error: (10/18/2013 02:10:15 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (10/18/2013 02:09:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Gemeinsame Nutzung der Internetverbindung" wurde nicht richtig gestartet.

Error: (10/18/2013 02:08:47 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (10/18/2013 02:07:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%13.

Error: (10/18/2013 02:06:55 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎18.‎10.‎2013 um 14:05:32 unerwartet heruntergefahren.

Error: (10/18/2013 01:58:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/18/2013 01:48:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================
Error: (08/19/2013 00:39:11 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1010 seconds with 480 seconds of active time.  This session ended with a crash.

Error: (08/16/2013 00:21:09 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 27 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/16/2013 04:34:31 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/03/2012 08:09:15 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2664 seconds with 1980 seconds of active time.  This session ended with a crash.

Error: (06/11/2012 08:00:40 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1274 seconds with 600 seconds of active time.  This session ended with a crash.

Error: (03/16/2012 10:25:39 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6654.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 813 seconds with 720 seconds of active time.  This session ended with a crash.

Error: (03/14/2012 00:07:00 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6654.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 18712 seconds with 5040 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 52%
Total physical RAM: 2997.86 MB
Available physical RAM: 1413.11 MB
Total Pagefile: 5991.95 MB
Available Pagefile: 3694.89 MB
Total Virtual: 2047.88 MB
Available Virtual: 1899.17 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:50 GB) (Free:2.91 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:182.88 GB) (Free:43.05 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 8BC4714F)
Partition 1: (Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=183 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-18 18:17:13
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ00 232,89GB
Running: 0i2g6zy8.exe; Driver: C:\Users\ARMIN~1.BAS\AppData\Local\Temp\kgriruog.sys


---- System - GMER 2.1 ----

SSDT                                                                                                                                  91DA3336                                                                                                                                                                                               ZwCreateSection
SSDT                                                                                                                                  91DA3340                                                                                                                                                                                               ZwRequestWaitReplyPort
SSDT                                                                                                                                  91DA333B                                                                                                                                                                                               ZwSetContextThread
SSDT                                                                                                                                  91DA3345                                                                                                                                                                                               ZwSetSecurityObject
SSDT                                                                                                                                  91DA334A                                                                                                                                                                                               ZwSystemDebugControl
SSDT                                                                                                                                  91DA32D7                                                                                                                                                                                               ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text                                                                                                                                 ntoskrnl.exe!ZwRollbackEnlistment + 1409                                                                                                                                                               838729A5 1 Byte  [06]
.text                                                                                                                                 ntoskrnl.exe!KiDispatchInterrupt + 5A2                                                                                                                                                                 83892512 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 14BF                                                                                                                                                                    83899AB4 4 Bytes  [36, 33, DA, 91] {XOR EBX, EDX; XCHG ECX, EAX}
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 181B                                                                                                                                                                    83899E10 4 Bytes  [40, 33, DA, 91] {INC EAX; XOR EBX, EDX; XCHG ECX, EAX}
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 185F                                                                                                                                                                    83899E54 4 Bytes  [3B, 33, DA, 91]
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 18DB                                                                                                                                                                    83899ED0 4 Bytes  [45, 33, DA, 91] {INC EBP; XOR EBX, EDX; XCHG ECX, EAX}
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 192F                                                                                                                                                                    83899F24 4 Bytes  [4A, 33, DA, 91] {DEC EDX; XOR EBX, EDX; XCHG ECX, EAX}
.text                                                                                                                                 ...                                                                                                                                                                                                    
.text                                                                                                                                 C:\Windows\system32\drivers\hardlock.sys                                                                                                                                                               section is writeable [0xA15C9400, 0x87EE2, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA166D620]  C:\Windows\system32\drivers\hardlock.sys                                                                                                                                                               entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA166D620]
.protectÿÿÿÿhardlockunknown last code section [0xA166D400, 0x5126, 0xE0000020]                                                        C:\Windows\system32\drivers\hardlock.sys                                                                                                                                                               unknown last code section [0xA166D400, 0x5126, 0xE0000020]
?                                                                                                                                     C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                                                                                                             Das System kann die angegebene Datei nicht finden. !

---- Devices - GMER 2.1 ----

AttachedDevice                                                                                                                        \Driver\kbdclass \Device\KeyboardClass0                                                                                                                                                                Wdf01000.sys
AttachedDevice                                                                                                                        \Driver\kbdclass \Device\KeyboardClass1                                                                                                                                                                Wdf01000.sys

Device                                                                                                                                \Driver\BTHUSB \Device\0000009f                                                                                                                                                                        bthport.sys

---- Registry - GMER 2.1 ----

Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\{4714AF41-F5B2-11d3-919D-00D0B71030AD}@IndexT                                                                                                           -1338417521
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1                                                                                                      
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@Alive                                                                                                1
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@UDN                                                                                                  uuid:1108ad33-bd15-4c8e-8b23-da7087643dc1
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@SerialNumber                                                                                         {4866A119-52BE-4828-B58B-C0E2F5FD19EF}
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@FriendlyName                                                                                         KIS-FIELD-PG: armin.basten:
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelName                                                                                            Windows Media Player Sharing
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelNumber                                                                                          12.0
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelURL                                                                                             hxxp://go.microsoft.com/fwlink/?LinkId=105926
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ManufacturerURL                                                                                      hxxp://www.microsoft.com/
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@Manufacturer                                                                                         Microsoft Corporation
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkInterface                                                                                     {E29AC6C2-7037-11DE-816D-806E6F6E6963}
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkIPCount                                                                                       1
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkIP0                                                                                           127.0.0.0/8
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@RemoteURLCount                                                                                       0
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@IPAddress                                                                                            127.0.0.1
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@IconFileName                                                                                         C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\Icon Files\1108ad33-bd15-4c8e-8b23-da7087643dc1.png
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Superfetch@VirtualStoreSize                                                                                                                          1798
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex@LazyCheckPointUpdateInterval                                                                                                         86400
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\armin.basten\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe  1

---- EOF - GMER 2.1 ----
         
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-18 18:17:13
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ00 232,89GB
Running: 0i2g6zy8.exe; Driver: C:\Users\ARMIN~1.BAS\AppData\Local\Temp\kgriruog.sys


---- System - GMER 2.1 ----

SSDT                                                                                                                                  91DA3336                                                                                                                                                                                               ZwCreateSection
SSDT                                                                                                                                  91DA3340                                                                                                                                                                                               ZwRequestWaitReplyPort
SSDT                                                                                                                                  91DA333B                                                                                                                                                                                               ZwSetContextThread
SSDT                                                                                                                                  91DA3345                                                                                                                                                                                               ZwSetSecurityObject
SSDT                                                                                                                                  91DA334A                                                                                                                                                                                               ZwSystemDebugControl
SSDT                                                                                                                                  91DA32D7                                                                                                                                                                                               ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text                                                                                                                                 ntoskrnl.exe!ZwRollbackEnlistment + 1409                                                                                                                                                               838729A5 1 Byte  [06]
.text                                                                                                                                 ntoskrnl.exe!KiDispatchInterrupt + 5A2                                                                                                                                                                 83892512 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 14BF                                                                                                                                                                    83899AB4 4 Bytes  [36, 33, DA, 91] {XOR EBX, EDX; XCHG ECX, EAX}
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 181B                                                                                                                                                                    83899E10 4 Bytes  [40, 33, DA, 91] {INC EAX; XOR EBX, EDX; XCHG ECX, EAX}
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 185F                                                                                                                                                                    83899E54 4 Bytes  [3B, 33, DA, 91]
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 18DB                                                                                                                                                                    83899ED0 4 Bytes  [45, 33, DA, 91] {INC EBP; XOR EBX, EDX; XCHG ECX, EAX}
.text                                                                                                                                 ntoskrnl.exe!KeRemoveQueueEx + 192F                                                                                                                                                                    83899F24 4 Bytes  [4A, 33, DA, 91] {DEC EDX; XOR EBX, EDX; XCHG ECX, EAX}
.text                                                                                                                                 ...                                                                                                                                                                                                    
.text                                                                                                                                 C:\Windows\system32\drivers\hardlock.sys                                                                                                                                                               section is writeable [0xA15C9400, 0x87EE2, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA166D620]  C:\Windows\system32\drivers\hardlock.sys                                                                                                                                                               entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA166D620]
.protectÿÿÿÿhardlockunknown last code section [0xA166D400, 0x5126, 0xE0000020]                                                        C:\Windows\system32\drivers\hardlock.sys                                                                                                                                                               unknown last code section [0xA166D400, 0x5126, 0xE0000020]
?                                                                                                                                     C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                                                                                                             Das System kann die angegebene Datei nicht finden. !

---- Devices - GMER 2.1 ----

AttachedDevice                                                                                                                        \Driver\kbdclass \Device\KeyboardClass0                                                                                                                                                                Wdf01000.sys
AttachedDevice                                                                                                                        \Driver\kbdclass \Device\KeyboardClass1                                                                                                                                                                Wdf01000.sys

Device                                                                                                                                \Driver\BTHUSB \Device\0000009f                                                                                                                                                                        bthport.sys

---- Registry - GMER 2.1 ----

Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\{4714AF41-F5B2-11d3-919D-00D0B71030AD}@IndexT                                                                                                           -1338417521
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1                                                                                                      
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@Alive                                                                                                1
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@UDN                                                                                                  uuid:1108ad33-bd15-4c8e-8b23-da7087643dc1
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@SerialNumber                                                                                         {4866A119-52BE-4828-B58B-C0E2F5FD19EF}
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@FriendlyName                                                                                         KIS-FIELD-PG: armin.basten:
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelName                                                                                            Windows Media Player Sharing
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelNumber                                                                                          12.0
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelURL                                                                                             hxxp://go.microsoft.com/fwlink/?LinkId=105926
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ManufacturerURL                                                                                      hxxp://www.microsoft.com/
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@Manufacturer                                                                                         Microsoft Corporation
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkInterface                                                                                     {E29AC6C2-7037-11DE-816D-806E6F6E6963}
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkIPCount                                                                                       1
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkIP0                                                                                           127.0.0.0/8
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@RemoteURLCount                                                                                       0
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@IPAddress                                                                                            127.0.0.1
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@IconFileName                                                                                         C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\Icon Files\1108ad33-bd15-4c8e-8b23-da7087643dc1.png
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Superfetch@VirtualStoreSize                                                                                                                          1798
Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex@LazyCheckPointUpdateInterval                                                                                                         86400
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\armin.basten\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe  1

---- EOF - GMER 2.1 ----
         
Im Voraus vielen Dank

Alt 18.10.2013, 16:10   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



hi,
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________

__________________

Alt 18.10.2013, 17:05   #3
Bassmann1968
 
Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Danke Schrauber!!!

Code:
ATTFilter
ComboFix 13-10-16.02 - armin.basten 18.10.2013  19:34:53.4.2 - x86
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.2998.1486 [GMT 2:00]
ausgeführt von:: c:\users\armin.basten\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-09-18 bis 2013-10-18  ))))))))))))))))))))))))))))))
.
.
2013-10-18 17:50 . 2013-10-18 17:50	--------	d-----w-	c:\users\Public\AppData\Local\temp
2013-10-18 17:50 . 2013-10-18 17:50	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-10-18 14:10 . 2013-10-18 14:10	--------	d-----w-	C:\FRST
2013-10-18 13:42 . 2013-10-18 13:42	--------	d-----w-	c:\users\armin.basten\AppData\Roaming\DigitalSite
2013-10-18 11:30 . 2013-10-18 17:52	--------	d-----w-	c:\users\armin.basten\AppData\Local\temp
2013-10-18 06:39 . 2013-10-18 14:23	--------	d-----w-	c:\program files\Wetelecom
2013-10-17 10:52 . 2013-10-17 10:52	--------	d-----w-	c:\program files\Bonjour Print Services
2013-10-10 13:31 . 2013-09-04 01:14	76288	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2013-10-10 13:31 . 2013-09-04 01:14	43008	----a-w-	c:\windows\system32\drivers\usbehci.sys
2013-10-10 13:31 . 2013-09-04 01:15	258560	----a-w-	c:\windows\system32\drivers\usbhub.sys
2013-10-10 13:31 . 2013-09-04 01:14	284672	----a-w-	c:\windows\system32\drivers\usbport.sys
2013-10-10 13:31 . 2013-09-04 01:14	20480	----a-w-	c:\windows\system32\drivers\usbohci.sys
2013-10-10 13:31 . 2013-09-04 01:14	24064	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2013-10-10 13:31 . 2013-09-04 01:14	6016	----a-w-	c:\windows\system32\drivers\usbd.sys
2013-10-10 05:05 . 2013-09-22 23:28	817664	----a-w-	c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-10-10 05:05 . 2013-09-22 23:54	770648	----a-w-	c:\program files\Internet Explorer\iexplore.exe
2013-10-10 05:05 . 2013-09-22 23:28	1767936	----a-w-	c:\windows\system32\wininet.dll
2013-10-09 21:47 . 2013-06-25 22:56	527064	----a-w-	c:\windows\system32\drivers\Wdf01000.sys
2013-09-30 15:00 . 2013-09-30 15:00	--------	d-----w-	C:\VW
2013-09-30 10:36 . 2013-09-30 10:36	--------	d-----w-	c:\programdata\Western Digital
2013-09-29 20:12 . 2013-09-29 21:11	--------	d-----w-	c:\program files\Diagnose-BK
2013-09-29 20:10 . 1996-11-05 13:13	299008	----a-w-	c:\windows\uninst.exe
2013-09-28 10:12 . 2011-06-21 08:24	32768	----a-w-	c:\windows\system32\drivers\sp_rsdrv2.sys
2013-09-28 10:12 . 2013-09-29 11:57	--------	d-----w-	c:\program files\Spyware Terminator
2013-09-27 21:28 . 2012-12-10 08:04	81920	----a-w-	c:\windows\eSellerateControl350.dll
2013-09-27 21:28 . 2012-12-10 08:04	356352	----a-w-	c:\windows\eSellerateEngine.dll
2013-09-27 21:28 . 2009-07-23 15:32	274432	----a-w-	c:\windows\system32\ssleay32.dll
2013-09-27 21:28 . 2009-07-23 15:32	1122304	----a-w-	c:\windows\system32\libeay32.dll
2013-09-27 21:28 . 2013-09-28 04:10	--------	d-----w-	c:\program files\Browser Protect Removal Tool
2013-09-27 20:29 . 2013-09-27 20:37	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2013-09-27 20:27 . 2013-09-27 20:27	--------	d-----w-	c:\users\armin.basten\AppData\Local\Programs
2013-09-27 18:34 . 2013-09-27 18:34	--------	d-----w-	c:\program files\Enigma Software Group
2013-09-27 18:32 . 2013-09-27 20:22	--------	d-----w-	c:\windows\865537E164904193A4B6669C62711852.TMP
2013-09-21 06:52 . 2008-11-23 07:23	97792	----a-w-	c:\windows\system32\drivers\NSHE.SYS
2013-09-21 06:48 . 2013-09-21 06:48	191488	----a-w-	c:\windows\system32\hlvdd.dll
2013-09-21 06:48 . 2006-12-20 07:00	671112	----a-w-	c:\windows\system32\hdinst_windows.dll
2013-09-21 06:48 . 2006-11-30 08:06	69632	----a-w-	c:\windows\system32\hasp_inst_help1.dll
2013-09-21 06:48 . 2005-09-06 14:06	28672	----a-w-	c:\windows\system32\hlduinst.exe
2013-09-21 06:48 . 2006-12-20 08:55	3066968	----a-w-	c:\windows\system32\hinstd.dll
2013-09-21 06:48 . 2006-12-20 07:00	2511360	----a-w-	c:\windows\system32\haspds_windows.dll
2013-09-21 06:15 . 2013-09-29 12:02	--------	d-----w-	c:\windows\ETKA7.4_Germany
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-01 14:00 . 2013-05-06 08:45	67680	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-10-01 14:00 . 2012-11-05 04:14	89376	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-10-01 14:00 . 2012-11-05 04:14	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-10-01 14:00 . 2012-11-05 04:14	137208	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-09-28 05:32 . 2012-05-11 17:25	692616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-09-28 05:32 . 2011-07-27 13:02	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-05 05:02 . 2013-10-17 22:05	7328304	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{A4C0FD0F-A2A1-4EA9-8A4B-DB139921A3E0}\mpengine.dll
2013-08-07 02:22 . 2011-07-27 11:50	238872	------w-	c:\windows\system32\MpSigStub.exe
2013-08-05 01:56 . 2013-09-11 12:26	133056	----a-w-	c:\windows\system32\drivers\ataport.sys
2013-08-02 01:50 . 2013-09-11 12:25	169984	----a-w-	c:\windows\system32\winsrv.dll
2013-08-02 01:49 . 2013-09-11 12:25	293376	----a-w-	c:\windows\system32\KernelBase.dll
2013-08-02 01:48 . 2013-09-11 12:25	5120	---ha-w-	c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3584	---ha-w-	c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	4608	---ha-w-	c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	4096	---ha-w-	c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	4096	---ha-w-	c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3584	---ha-w-	c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	4096	---ha-w-	c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	4096	---ha-w-	c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3584	---ha-w-	c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3584	---ha-w-	c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3584	---ha-w-	c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3584	---ha-w-	c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	4096	---ha-w-	c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-08-02 00:52 . 2013-09-11 12:25	271360	----a-w-	c:\windows\system32\conhost.exe
2013-08-02 00:43 . 2013-09-11 12:25	6144	---ha-w-	c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-08-02 00:43 . 2013-09-11 12:25	4608	---ha-w-	c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-08-02 00:43 . 2013-09-11 12:25	3584	---ha-w-	c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-08-02 00:43 . 2013-09-11 12:25	3072	---ha-w-	c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-07-25 08:57 . 2013-08-15 00:18	1620992	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-25 07:29 . 2013-07-25 07:29	94632	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2013-07-25 07:29 . 2012-08-16 19:09	867240	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-07-25 07:29 . 2011-10-30 06:57	789416	----a-w-	c:\windows\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-10-01 681032]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2013-08-16 152392]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"LoadMdm"="c:\program files\Wetelecom\LoadMdm.exe" [2010-09-13 397312]
.
c:\users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
RT-Updater.lnk - d:\program files\VCDS\VCDS.EXE Update [2013-9-9 1430104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03	66328	----a-w-	c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean.exe
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Status Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Status Monitor.lnk
backup=c:\windows\pss\Status Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^armin.basten^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk]
path=c:\users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk
backup=c:\windows\pss\Logitech . Produktregistrierung.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^armin.basten^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk]
path=c:\users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk
backup=c:\windows\pss\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\9de5]
c:\users\armin.basten\AppData\Roaming\8bf\9de5.js [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06	958576	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-04-21 19:43	59720	----a-w-	c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2013-03-14 08:23	3672640	----a-w-	d:\program files\DAEMON Tools\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6]
2011-10-07 09:40	1387288	----a-w-	c:\program files\Logitech\SetPointP\SetPoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-12-04 12:34	136176	----atw-	c:\users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2011-02-11 17:26	171032	----a-w-	c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Photosmart 5510d series (NET)]
2011-08-16 06:47	1804648	----a-w-	c:\program files\HP\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-09 23:41	49208	----a-w-	c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2011-02-11 17:26	137752	----a-w-	c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2010-07-19 15:26	1206544	----a-w-	c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ITSecMng]
2009-07-22 11:40	83336	----a-w-	c:\program files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-08-16 07:07	152392	----a-w-	d:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Download Assistant]
2010-11-03 17:50	1246544	----a-w-	c:\windows\System32\LogiLDA.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-11-11 11:08	205336	----a-w-	c:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2011-02-11 17:26	172568	----a-w-	c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S7UB Start]
2010-06-03 00:29	102453	----a-w-	c:\program files\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2010-11-20 00:17	1174016	----a-w-	c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiemensAutomationFileStorage]
2011-04-13 20:42	806912	----a-w-	c:\program files\Siemens\Automation\Portal V11\Bin\Siemens.Automation.ObjectFrame.FileStorage.Server.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-10-02 10:11	20473504	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-03-12 05:32	253816	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-08-28 08:32	1557800	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinCC flexible Smart Start]
2011-12-14 04:07	118784	----a-w-	c:\program files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\HmiSmartStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xvid]
2011-01-17 19:41	8192	----a-w-	c:\program files\Xvid\CheckUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"="1"
"FirewallOverride"="1"
.
R2 CCAgent;CCAgent;c:\program files\Common Files\Siemens\ACE\bin\CCAgent.exe [2009-07-16 344064]
R2 CCEServer;CCEServer;c:\program files\Common Files\Siemens\ace\bin\CCEServer.exe [2009-07-16 237568]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-09-05 171680]
R3 ALSysIO;ALSysIO;c:\users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
R3 CCEClient;CCEClient;c:\program files\Common Files\Siemens\ace\bin\CCEClient.exe [2009-07-16 262144]
R3 dpmcslv;dpmcslv; [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [2011-05-31 349184]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 HPFXBULKLEDM;HPFXBULKLEDM;c:\windows\system32\drivers\hppcbulkio.sys [2011-05-10 20504]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 IAMT03;Driver for Intel(R) Active Management Technology - KCS;c:\windows\system32\DRIVERS\IAMT03.sys [2007-04-11 40848]
R3 IAMTV;Driver for Intel(R) Active Management Technology - KCS;c:\windows\system32\DRIVERS\IAMTV.sys [2007-04-11 38288]
R3 IAMTXP;Driver for Intel(R) Active Management Technology - KCS;c:\windows\system32\DRIVERS\IAMTXP.sys [2007-04-11 47496]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\Drivers\LEqdUsb.Sys [2011-04-30 42648]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\Drivers\LHidEqd.Sys [2011-04-30 12184]
R3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-07-19 227600]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2011-08-02 18432]
R3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
R3 PROFIpnp;PROFIBUS PnP Hardware Driver (Softing); [x]
R3 PROFIusb;PROFIusb Device Driver (Softing AG); [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 RedundancyControl;RedundancyControl;c:\program files\Common Files\Siemens\ace\bin\RedundancyControl.exe [2009-07-16 430080]
R3 RedundancyState;RedundancyState;c:\program files\Common Files\Siemens\ace\bin\RedundancyState.exe [2009-07-16 180224]
R3 RT-USB;Ross-Tech USB driver;c:\windows\system32\drivers\RT-USB.SYS [2010-06-16 59464]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 usbbulk;USBBulk driver;c:\windows\system32\Drivers\USBBulk.sys [2008-07-04 18776]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-09 1343400]
R3 wmdusbser;Wetelecom USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\wmdusbser.sys [2010-06-11 107136]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys [2009-07-14 20480]
R3 ZTEusbMB;ZTE NMEAExt2 Port;c:\windows\system32\DRIVERS\ZTEusbnmeaext2.sys [2011-07-04 107520]
R3 ZTEusbwwan;ZTE MBN Miniport;c:\windows\system32\DRIVERS\ZTEusbwwan.sys [2011-12-01 195072]
R4 BrowserProtect;BrowserProtect;c:\programdata\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]
R4 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-10-02 3064000]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-01 37352]
S1 dpmconv;SIMATIC NET DP Driver;c:\windows\system32\DRIVERS\dpmconv32.sys [2010-04-28 288256]
S1 DPMTRCDD;SIMATIC NET Softnet Trace Driver;c:\windows\system32\DRIVERS\DPMTRCDD32.sys [2010-03-22 72248]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-23 242240]
S1 vsnl2ada;SIMATIC NET FDL Driver;c:\windows\system32\DRIVERS\vsnl2ada32.sys [2010-03-22 98944]
S2 almservice;Automation License Manager Service;c:\program files\Common Files\Siemens\sws\almsrv\almsrvx.exe [2011-12-11 1138312]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-10-01 440392]
S2 HP DS Service;HP DS Service;c:\program files\HP\HPBDSService\HPBDSService.exe [2010-10-27 13824]
S2 LcSvrAdm;ELSA Administration Service;d:\elsawin\bin\LcSvrAdm.exe [2011-12-06 240640]
S2 LcSvrDba;ELSA DBA Server;d:\elsawin\bin\LcSvrDba.exe [2011-12-06 392704]
S2 LcSvrHis;ELSA Historie Server;d:\elsawin\bin\LcSvrHis.exe [2011-12-06 335360]
S2 LcSvrPAS;ELSA PASS Server;d:\elsawin\bin\LcSvrPas.exe [2011-12-06 477696]
S2 LcSvrSaz;ELSA APOSpro Server;d:\elsawin\bin\LcSvrSaz.exe [2011-12-06 373248]
S2 MSSQL$WINCCFLEXEXPRESS;SQL Server (WINCCFLEXEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 MSSQL$WINCCPLUS;SQL Server (WINCCPLUS);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 MSSQL$WINCCPLUSMIG;SQL Server (WINCCPLUSMIG);c:\program files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 NSHE;Guardant Emulator Driver;c:\windows\system32\Drivers\NSHE.SYS [2008-11-23 97792]
S2 PROFIbrd;PROFIBUS V5 Hardware Driver (Softing); [x]
S2 PROFIprt;PROFIBUS Protocol Driver (Softing); [x]
S2 PROFIstack;PROFIBUS V6 Hardware Driver (Softing); [x]
S2 s7hspsvx;S7 HSP Service;c:\program files\Siemens\Step7\s7bin\s7hspsvx.exe [2010-06-02 61493]
S2 s7oiehsx;SIMATIC IEPG Help Service;c:\program files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [2011-11-03 412808]
S2 S7opcsrtx;PROFINET IO RT-Protocol (LLDP);c:\windows\system32\DRIVERS\s7opcsrtx.sys [2011-02-22 31744]
S2 s7ousbu32x;SIMATIC USB Service;c:\windows\system32\DRIVERS\s7ousbu32x.sys [2011-09-29 641280]
S2 s7sn2srtx;PROFINET IO RT-Protocol V2.0;c:\windows\system32\DRIVERS\s7sn2srtx.sys [2011-06-16 63104]
S2 s7snsrtx;PROFINET IO RT-Protocol V1.0;c:\windows\system32\DRIVERS\s7snsrtx.sys [2009-02-24 73088]
S2 S7TraceServiceX;S7TraceServiceX;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [2011-11-03 556168]
S2 SCSMonitor;SCSMonitor;c:\program files\Common Files\Siemens\ace\bin\SCSMX.exe [2009-07-16 167936]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2010-06-09 5120]
S2 TeamViewer8;TeamViewer 8;c:\program files\TeamViewer\Version8\TeamViewer_Service.exe [2013-07-08 4153184]
S2 UA Local Discovery Server;UA Local Discovery Server;c:\program files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [2010-05-05 28160]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-09 2320920]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2011-07-19 225280]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2010-04-05 224424]
S3 fwkbdrtm;fwkbdrtm;c:\windows\system32\drivers\fwkbdrtm.sys [2011-12-06 21464]
S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-07-19 47104]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 132480]
S3 LcSvrAuf;ELSA Auftragsverwaltungs Service;d:\elsawin\bin\LcSvrAuf.exe [2011-12-06 1321472]
S3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [2010-07-14 6814720]
S3 S7odpx2x32;SIMATIC Knotentaufe;c:\windows\system32\Drivers\S7odpx2x32.sys [2011-05-06 87552]
S3 s7opciax32;SIMATIC CP 5611;c:\windows\system32\DRIVERS\s7opciax32.sys [2011-06-22 227840]
S3 s7otmcd32x;SIMATIC Memory Cards;c:\windows\system32\Drivers\s7otmcd32x.sys [2011-05-06 256512]
S3 S7otranx32;SIMATIC Transport;c:\windows\system32\Drivers\S7otranx32.sys [2011-05-06 521216]
S3 s7otsadx32;SIMATIC TS Adapter RS232-32;c:\windows\system32\Drivers\s7otsadx32.sys [2011-09-29 182784]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005Core.job
- c:\users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-04 12:34]
.
2013-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005UA.job
- c:\users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-04 12:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: samsungsetup.com\www
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\conhost.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\DllHost.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Siemens\SimNetCom\pniopcac.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\unsecapp.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-10-18  20:01:07 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-10-18 18:01
ComboFix2.txt  2013-10-18 12:58
ComboFix3.txt  2013-10-18 11:42
.
Vor Suchlauf: 3.076.698.112 Bytes frei
Nach Suchlauf: 2.889.506.816 Bytes frei
.
- - End Of File - - 3B4DA9B691BE1CE46053E91BD8C2A732
5C616939100B85E558DA92B899A0FC36
         
__________________

Alt 19.10.2013, 07:58   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 19.10.2013, 08:21   #5
Bassmann1968
 
Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Und weiter geht es:
Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.18.11

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16721
armin.basten :: KIS-FIELD-PG [Administrator]

19.10.2013 01:00:29
mbam-log-2013-10-19 (01-00-29).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 270645
Laufzeit: 19 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 8
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DigitalSite (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\BabylonToolbar (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 4
HKCU\SOFTWARE\DealPly|Partner (PUP.Optional.DealPly.A) -> Daten: dpmnt -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Daten: hxxp://search.babylon.com/?affID=119816&babsrc=HP_ss_din2g&mntrId=FECE001060D1BBAB -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Daten: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\DealPly|ChromeCrxPath (PUP.Optional.DealPly.A) -> Daten: C:\Program Files\DealPly\DealPly.crx -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel|HomePage (PUM.Hijack.HomePageControl) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 7
C:\Users\armin.basten\AppData\Roaming\DigitalSite\UpdateProc (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\Dealply (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\Dealply\UpdateProc (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 8
C:\Users\armin.basten\AppData\Roaming\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\DigitalSite\UpdateProc\config.dat (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\DigitalSite\UpdateProc\prod.dat (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\Dealply\UpdateProc\config.dat (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\Dealply\UpdateProc\TTL.DAT (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\armin.basten\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         
Code:
ATTFilter
# AdwCleaner v3.008 - Bericht erstellt am 19/10/2013 um 06:01:05
# Updated 17/10/2013 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzername : armin.basten - KIS-FIELD-PG
# Gestartet von : C:\Users\armin.basten\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : BrowserProtect

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\armin.basten\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\armin.basten\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\armin.basten\AppData\Roaming\digitalsite
Ordner Gelöscht : C:\Users\armin.basten\AppData\Roaming\DSite
Datei Gelöscht : C:\Windows\System32\Tasks\AmiUpdXp
Datei Gelöscht : C:\Windows\System32\Tasks\BrowserProtect
Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyUpdate

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AmiUpdXp
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1BF3961C-D6C8-45A8-A146-D677174205BC}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1BF3961C-D6C8-45A8-A146-D677174205BC}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BrowserProtect
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E297CBDB-E008-4B41-A4D6-7962CE15DB5B}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E297CBDB-E008-4B41-A4D6-7962CE15DB5B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{789F4F36-BCBB-4F01-8CBA-136DF573AD7A}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{789F4F36-BCBB-4F01-8CBA-136DF573AD7A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKCU\Software\d538d8cbd3beb49
Schlüssel Gelöscht : HKLM\SOFTWARE\d538d8cbd3beb49
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7697BC38-D0FA-454B-AC75-968B4CCABFCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Freeze.com
Schlüssel Gelöscht : HKLM\Software\systweak

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Google Chrome v

[ Datei : C:\Users\armin.basten\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht : homepage

*************************

AdwCleaner[R0].txt - [5437 octets] - [19/10/2013 05:57:54]
AdwCleaner[S0].txt - [5453 octets] - [19/10/2013 06:01:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5513 octets] ##########
         
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows 7 Ultimate x86
Ran by armin.basten on 19.10.2013 at  6:18:58,79
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3934052282-1587484455-2844972666-1005\Software\SweetIM



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\armin.basten\appdata\local\{092C2B63-9B93-4609-95DB-F586E0B63327}
Successfully deleted: [Empty Folder] C:\Users\armin.basten\appdata\local\{38FAABDB-FAEA-45A5-99BB-89E129CD821C}
Successfully deleted: [Empty Folder] C:\Users\armin.basten\appdata\local\{79E91B86-EBD4-4980-BC51-3F64A82A9F53}
Successfully deleted: [Empty Folder] C:\Users\armin.basten\appdata\local\{81DC7DCF-7ED9-4355-8D3B-410FEBFE60ED}



~~~ Chrome

Successfully deleted: [Folder] C:\Users\armin.basten\appdata\local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.10.2013 at  6:23:18,30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by armin.basten (administrator) on KIS-FIELD-PG on 19-10-2013 11:18:02
Running from C:\Users\armin.basten\Downloads
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Siemens AG) C:\PROGRAM FILES\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
(Hewlett-Packard Company) C:\Program Files\HP\HPBDSService\HPBDSService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\Program Files\iTunes\iTunesHelper.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\LoadMdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrDba.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrHis.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrPas.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrSaz.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
(Siemens AG) C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(OPC Foundation) C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\pniopcac.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAuf.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - D:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [LoadMdm] - C:\Program Files\Wetelecom\LoadMdm.exe [397312 2010-09-13] (TODO: <Company name>)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Startup: C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Updater.lnk
ShortcutTarget: RT-Updater.lnk -> D:\Program Files\VCDS\VCDS.EXE (Ross-Tech, LLC)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.siemens.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9A70EA11C858CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - D:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - hxxp://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t
CHR DefaultSuggestURL: (Google) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Google Update) - C:\Users\armin.basten\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak\1.0_0
CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp\5.0.94.1_0
CHR Extension: (Gmail) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [1138312 2011-12-11] (SIEMENS AG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CCAgent; C:\Program Files\Common Files\Siemens\ACE\bin\CCAgent.exe [344064 2009-07-16] (SIEMENS AG)
S3 CCEClient; C:\Program Files\Common Files\Siemens\ace\bin\CCEClient.exe [262144 2009-07-16] (SIEMENS AG)
S2 CCEServer; C:\Program Files\Common Files\Siemens\ace\bin\CCEServer.exe [237568 2009-07-16] (SIEMENS AG)
R2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2010-10-27] (Hewlett-Packard Company)
R2 LcSvrAdm; D:\ElsaWin\bin\LcSvrAdm.exe [240640 2011-12-06] (Volkswagen AG)
R3 LcSvrAuf; D:\ElsaWin\bin\LcSvrAuf.exe [1321472 2011-12-06] (Volkswagen AG)
R2 LcSvrDba; D:\ElsaWin\bin\LcSvrDba.exe [392704 2011-12-06] (Volkswagen AG)
R2 LcSvrHis; D:\ElsaWin\bin\LcSvrHis.exe [335360 2011-12-06] (Volkswagen AG)
R2 LcSvrPAS; D:\ElsaWin\bin\LcSvrPas.exe [477696 2011-12-06] (Volkswagen AG)
R2 LcSvrSaz; D:\ElsaWin\bin\LcSvrSaz.exe [373248 2011-12-06] (Volkswagen AG)
R2 MSSQL$WINCCFLEXEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUS; C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUSMIG; C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [227600 2010-07-19] ()
S3 OpcEnum; C:\Windows\system32\Opcenum.exe [139488 2009-02-05] (OPC Foundation)
S3 RedundancyControl; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyControl.exe [430080 2009-07-16] (SIEMENS AG)
S3 RedundancyState; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyState.exe [180224 2009-07-16] (SIEMENS AG)
R2 s7hspsvx; C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2010-06-02] (SIEMENS AG)
R2 s7oiehsx; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [412808 2011-11-04] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [556168 2011-11-04] (SIEMENS AG)
R2 SCSMonitor; C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe [167936 2009-07-16] (SIEMENS AG)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 smartserver; C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe [558416 2011-12-06] (Siemens AG)
R2 UA Local Discovery Server; C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [28160 2010-05-05] (OPC Foundation)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dpmconv; C:\Windows\System32\DRIVERS\dpmconv32.sys [288256 2010-04-28] (SIEMENS AG)
S3 dpmcslv; C:\Windows\System32\Drivers\dpmcslv.sys [68280 2005-07-04] (Siemens AG)
R1 DPMTRCDD; C:\Windows\System32\DRIVERS\DPMTRCDD32.sys [72248 2010-03-22] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-23] (DT Soft Ltd)
R3 e1qexpress; C:\Windows\System32\DRIVERS\e1q6232.sys [215208 2009-11-05] (Intel Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R3 fwkbdrtm; C:\Windows\system32\drivers\fwkbdrtm.sys [21464 2011-12-06] (Windows (R) Win 7 DDK provider)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 HPFXBULKLEDM; C:\Windows\System32\drivers\hppcbulkio.sys [20504 2011-05-10] (Hewlett Packard)
S3 IAMT03; C:\Windows\system32\DRIVERS\IAMT03.sys [40848 2007-04-11] (Intel Corporation)
S3 IAMTV; C:\Windows\system32\DRIVERS\IAMTV.sys [38288 2007-04-11] (Intel Corporation)
S3 IAMTXP; C:\Windows\system32\DRIVERS\IAMTXP.sys [47496 2007-04-11] (Intel Corporation)
R3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-19] (Intel Corporation)
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42648 2011-04-30] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [12184 2011-04-30] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-04-30] (Logitech, Inc.)
S3 NAL; C:\Windows\system32\Drivers\iqvw32.sys [30880 2010-03-24] (Intel Corporation )
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [6814720 2010-07-14] (Intel Corporation)
R2 NSHE; C:\Windows\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008)
R2 PROFIbrd; C:\Windows\System32\Drivers\PROFIbrd.sys [165432 2010-03-10] (Softing AG)
S3 PROFIpnp; C:\Windows\System32\Drivers\PROFIpnp.sys [19256 2010-03-10] (Softing AG)
R2 PROFIprt; C:\Windows\System32\Drivers\PROFIprt.sys [39480 2010-03-10] (Softing AG)
R2 PROFIstack; C:\Windows\System32\Drivers\PROFIstack.sys [130104 2010-03-10] (Softing AG)
S3 PROFIusb; C:\Windows\System32\Drivers\PROFIusb.sys [39352 2010-03-10] (Softing AG)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [59464 2010-06-16] (Ross-Tech LLC)
R3 S7odpx2x32; C:\Windows\System32\Drivers\S7odpx2x32.sys [87552 2011-05-06] (SIEMENS AG)
R3 s7opciax32; C:\Windows\System32\DRIVERS\s7opciax32.sys [227840 2011-06-22] (SIEMENS AG)
R2 S7opcsrtx; C:\Windows\System32\DRIVERS\s7opcsrtx.sys [31744 2011-02-22] (SIEMENS AG)
R3 s7otmcd32x; C:\Windows\System32\Drivers\s7otmcd32x.sys [256512 2011-05-06] (SIEMENS AG)
R3 S7otranx32; C:\Windows\System32\Drivers\S7otranx32.sys [521216 2011-05-06] (SIEMENS AG)
R3 s7otsadx32; C:\Windows\System32\Drivers\s7otsadx32.sys [182784 2011-09-29] (SIEMENS AG)
R2 s7ousbu32x; C:\Windows\System32\DRIVERS\s7ousbu32x.sys [641280 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [63104 2011-06-16] (SIEMENS AG)
R2 s7snsrtx; C:\Windows\System32\DRIVERS\s7snsrtx.sys [73088 2009-02-24] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [343888 2011-10-11] (SIEMENS AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2010-06-09] (Samsung Electronics)
S3 usbbulk; C:\Windows\System32\Drivers\USBBulk.sys [18776 2008-07-04] (SEGGER MICROCONTROLLER GmbH & Co. KG)
R1 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada32.sys [98944 2010-03-22] (SIEMENS AG)
S3 wmdusbser; C:\Windows\System32\DRIVERS\wmdusbser.sys [107136 2010-06-11] (WeTelecom Incorporated)
S3 ZTEusbMB; C:\Windows\System32\DRIVERS\ZTEusbnmeaext2.sys [107520 2011-07-04] (ZTE Incorporated)
S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [195072 2011-12-01] (ZTE Incorporated)
S3 ALSysIO; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 massfilter; system32\DRIVERS\massfilter.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-19 06:23 - 2013-10-19 06:23 - 00001436 _____ C:\Users\armin.basten\Desktop\JRT.txt
2013-10-19 06:18 - 2013-10-19 06:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 05:57 - 2013-10-19 06:01 - 00000000 ____D C:\AdwCleaner
2013-10-19 01:06 - 2013-10-19 01:07 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 00:53 - 2013-10-19 00:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 00:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-19 00:50 - 2013-10-19 00:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 00:48 - 2013-10-19 00:50 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 20:01 - 2013-10-18 20:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 19:33 - 2013-10-18 20:02 - 00000000 ____D C:\ComboFix
2013-10-18 19:29 - 2013-10-18 19:31 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 18:17 - 2013-10-18 18:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 16:20 - 2013-10-18 16:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 16:11 - 2013-10-18 16:12 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:08 - 2013-10-18 16:09 - 01087213 _____ (Farbar) C:\Users\armin.basten\Downloads\FRST.exe
2013-10-18 16:05 - 2013-10-19 11:16 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:36 - 2013-10-18 15:41 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 13:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-18 13:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-18 13:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-18 08:39 - 2013-10-18 16:23 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 12:48 - 2013-10-17 07:30 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-10 15:31 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 07:06 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 07:06 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 07:06 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 07:06 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 07:06 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 07:05 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 23:48 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 23:48 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 23:48 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 23:48 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 23:48 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 23:48 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 23:48 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 23:48 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 23:48 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 23:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 23:48 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 23:48 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 23:48 - 2013-07-12 12:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 23:48 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 23:48 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 23:48 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 23:48 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 23:48 - 2013-07-03 06:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 23:48 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 23:48 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 23:48 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 23:47 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:52 - 2013-10-03 12:53 - 12105568 _____ (EVC electronic GmbH                                         ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 13:28 - 2013-10-02 17:55 - 00000056 _____ C:\Windows\Acroread.ini
2013-09-30 21:49 - 2013-10-01 03:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 22:31 - 2013-09-29 23:14 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 22:13 - 2013-09-30 16:20 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-29 22:12 - 2013-09-29 23:11 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:10 - 1996-11-05 15:13 - 00299008 _____ (InstallShield Corporation, Inc.) C:\Windows\uninst.exe
2013-09-29 21:22 - 2013-09-29 21:35 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-10-19 06:04 - 00001805 _____ C:\Windows\setupact.log
2013-09-29 21:17 - 2013-10-19 01:42 - 00013016 _____ C:\Windows\PFRO.log
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:12 - 2013-09-29 13:57 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 12:12 - 2011-06-21 10:24 - 00032768 _____ C:\Windows\system32\Drivers\sp_rsdrv2.sys
2013-09-28 12:06 - 2013-09-28 12:08 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-27 23:28 - 2013-09-28 06:10 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 23:28 - 2012-12-10 10:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2013-09-27 23:28 - 2012-12-10 10:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2013-09-27 22:29 - 2013-09-27 22:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-09-27 22:22 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-25 15:48 - 2013-09-26 03:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 11:33 - 2013-10-09 14:06 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-09-21 08:52 - 2008-11-23 09:23 - 00097792 _____ (T0r0 2008) C:\Windows\system32\Drivers\NSHE.SYS
2013-09-21 08:50 - 2013-09-29 14:32 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 08:48 - 2006-12-20 10:55 - 03066968 _____ (Aladdin Knowledge Systems.) C:\Windows\system32\hinstd.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 02511360 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\haspds_windows.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 00671112 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hdinst_windows.dll
2013-09-21 08:48 - 2006-11-30 10:06 - 00069632 _____ (Aladdin Knowledge Systems) C:\Windows\system32\hasp_inst_help1.dll
2013-09-21 08:48 - 2005-09-06 16:06 - 00028672 _____ C:\Windows\system32\hlduinst.exe
2013-09-21 08:48 - 2002-07-26 16:02 - 00006836 _____ C:\Windows\system32\UNWISE.INI
2013-09-21 08:15 - 2013-09-29 14:02 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-20 19:00 - 2013-10-13 21:54 - 00005102 _____ C:\Users\armin.basten\Desktop\S6-4F.txt

==================== One Month Modified Files and Folders =======

2013-10-19 11:16 - 2013-10-18 16:05 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-19 11:15 - 2011-07-27 13:54 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Skype
2013-10-19 06:23 - 2013-10-19 06:23 - 00001436 _____ C:\Users\armin.basten\Desktop\JRT.txt
2013-10-19 06:18 - 2013-10-19 06:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 06:13 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-19 06:13 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-19 06:04 - 2013-09-29 21:17 - 00001805 _____ C:\Windows\setupact.log
2013-10-19 06:03 - 2011-07-27 11:04 - 01186438 _____ C:\Windows\WindowsUpdate.log
2013-10-19 06:01 - 2013-10-19 05:57 - 00000000 ____D C:\AdwCleaner
2013-10-19 01:52 - 2011-10-14 17:18 - 00763840 _____ C:\Windows\system32\perfh01F.dat
2013-10-19 01:52 - 2011-10-14 17:18 - 00182854 _____ C:\Windows\system32\perfc01F.dat
2013-10-19 01:52 - 2011-08-09 13:24 - 00830312 _____ C:\Windows\system32\perfh019.dat
2013-10-19 01:52 - 2011-08-09 13:24 - 00193648 _____ C:\Windows\system32\perfc019.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00602068 _____ C:\Windows\system32\perfh014.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00549482 _____ C:\Windows\system32\perfh012.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00526592 _____ C:\Windows\system32\prfh0404.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00510290 _____ C:\Windows\system32\prfh0804.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00165054 _____ C:\Windows\system32\perfc012.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00164626 _____ C:\Windows\system32\prfc0804.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00159712 _____ C:\Windows\system32\prfc0404.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00137768 _____ C:\Windows\system32\perfc014.dat
2013-10-19 01:52 - 2010-07-01 02:19 - 00844522 _____ C:\Windows\system32\perfh010.dat
2013-10-19 01:52 - 2010-07-01 02:19 - 00188544 _____ C:\Windows\system32\perfc010.dat
2013-10-19 01:52 - 2010-06-30 16:31 - 11561664 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-19 01:42 - 2013-09-29 21:17 - 00013016 _____ C:\Windows\PFRO.log
2013-10-19 01:38 - 2011-08-30 07:22 - 00000000 ____D C:\Windows\3PUPrgWsQafmis
2013-10-19 01:07 - 2013-10-19 01:06 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 01:01 - 2013-02-16 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\uTorrent
2013-10-19 00:53 - 2013-10-19 00:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 00:50 - 2013-10-19 00:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 00:50 - 2013-10-19 00:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 20:02 - 2013-10-18 19:33 - 00000000 ____D C:\ComboFix
2013-10-18 20:01 - 2013-10-18 20:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 20:01 - 2013-08-10 11:57 - 00000000 ____D C:\Qoobox
2013-10-18 19:52 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-18 19:31 - 2013-10-18 19:29 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 18:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-18 18:17 - 2013-10-18 18:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 16:23 - 2013-10-18 08:39 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 16:20 - 2013-10-18 16:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 16:12 - 2013-10-18 16:11 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:09 - 2013-10-18 16:08 - 01087213 _____ (Farbar) C:\Users\armin.basten\Downloads\FRST.exe
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:41 - 2013-10-18 15:36 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 09:33 - 2012-04-15 11:00 - 00000000 ____D C:\ProgramData\Apple
2013-10-17 07:30 - 2013-10-17 12:48 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-14 07:40 - 2011-08-17 07:37 - 00000000 ____D C:\Windows\Minidump
2013-10-13 21:54 - 2013-09-20 19:00 - 00005102 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ___RD C:\Program Files\Skype
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ____D C:\ProgramData\Skype
2013-10-10 17:11 - 2012-03-03 08:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\AIMP3
2013-10-10 08:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 07:43 - 2009-07-14 06:33 - 00509944 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-TW
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-CN
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\nb-NO
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ko-KR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\it-IT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fr-FR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fi-FI
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-10 07:15 - 2011-07-28 12:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 07:13 - 2013-07-20 12:09 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 07:07 - 2011-07-27 18:14 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 14:06 - 2013-09-21 11:33 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\WindSolutions
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-09 08:47 - 2013-05-06 13:40 - 00004756 _____ C:\Users\armin.basten\Desktop\Edenites.txt
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:53 - 2013-10-03 12:52 - 12105568 _____ (EVC electronic GmbH                                         ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-02 17:55 - 2013-10-01 13:28 - 00000056 _____ C:\Windows\Acroread.ini
2013-10-01 16:00 - 2013-05-06 10:45 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 03:49 - 2013-09-30 21:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 16:20 - 2013-09-29 22:13 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 23:14 - 2013-09-29 22:31 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 23:11 - 2013-09-29 22:12 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:09 - 2013-03-23 16:26 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DAEMON Tools Lite
2013-09-29 21:35 - 2013-09-29 21:22 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 17:18 - 2012-04-03 13:27 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\FileZilla
2013-09-29 16:10 - 2013-03-24 14:04 - 00000156 _____ C:\Windows\etkinst.ini
2013-09-29 14:32 - 2013-09-21 08:50 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-29 14:02 - 2013-09-21 08:15 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-29 14:02 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system
2013-09-29 13:57 - 2013-09-28 12:12 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:08 - 2013-09-28 12:06 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 09:16 - 2012-06-17 16:37 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Audacity
2013-09-28 07:32 - 2012-05-11 19:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-28 07:32 - 2011-07-27 15:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-28 06:10 - 2013-09-27 23:28 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 22:37 - 2013-09-27 22:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 22:22 - 2013-09-27 20:32 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-02-04 04:27 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-09-27 20:21 - 2011-08-03 13:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Canon
2013-09-27 20:21 - 2011-08-03 12:44 - 00000000 ____D C:\Program Files\Canon
2013-09-27 20:17 - 2011-08-03 13:32 - 00000000 ___HD C:\ProgramData\CanonIJScan
2013-09-27 20:17 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-09-27 20:08 - 2012-04-15 11:04 - 00000000 ____D C:\ProgramData\Apple Computer
2013-09-26 03:48 - 2013-09-25 15:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 01:28 - 2013-10-10 07:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-10 07:06 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:28 - 2013-10-10 07:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 09:01 - 2011-10-08 07:18 - 00000000 ____D C:\Users\armin.basten\Desktop\IFM VES003_2_6
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 05:30 - 2013-10-10 07:06 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-10 07:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

Some content of TEMP:
====================
C:\Users\armin.basten\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 00:20

==================== End Of Log ============================
         
--- --- ---

Gruss, Bassi


Geändert von Bassmann1968 (19.10.2013 um 09:02 Uhr)

Alt 19.10.2013, 14:54   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9

Alt 20.10.2013, 07:28   #7
Bassmann1968
 
Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



und weiter....
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e73be8c59584de4ba68bbc560c778d22
# engine=15551
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-20 05:00:34
# local_time=2013-10-20 07:00:34 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 97 26290 247682924 0 0
# compatibility_mode=5893 16776573 100 94 0 133876425 0 0
# compatibility_mode=7937 16777214 0 25 1789379 1789379 0 0
# scanned=862038
# found=2
# cleaned=0
# scan_time=20035
sh=8BBBA031B29F78ED58DA9BE5489162A70142D207 ft=0 fh=0000000000000000 vn="JS/Kryptik.ALI trojan" ac=I fn="C:\Program Files\94\95fa.js"
sh=8BBBA031B29F78ED58DA9BE5489162A70142D207 ft=0 fh=0000000000000000 vn="JS/Kryptik.ALI trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\armin.basten\AppData\Roaming\8bf\9de5.js.vir"
         
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.74  
 Windows 7 Service Pack 1 x86 (UAC is disabled!)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 CCleaner     
 Java 7 Update 25  
 Java version out of Date! 
 Adobe Flash Player 	11.6.602.180  
 Adobe Reader 10.1.8 Adobe Reader out of Date!  
 Google Chrome 29.0.1547.62  
 Google Chrome 29.0.1547.66  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-10-2013
Ran by armin.basten (administrator) on KIS-FIELD-PG on 20-10-2013 11:05:24
Running from C:\Users\armin.basten\Desktop
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Siemens AG) C:\PROGRAM FILES\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
(Hewlett-Packard Company) C:\Program Files\HP\HPBDSService\HPBDSService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\Program Files\iTunes\iTunesHelper.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\LoadMdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrDba.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrHis.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrPas.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrSaz.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
(Siemens AG) C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(OPC Foundation) C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\pniopcac.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAuf.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - D:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [LoadMdm] - C:\Program Files\Wetelecom\LoadMdm.exe [397312 2010-09-13] (TODO: <Company name>)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Startup: C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Updater.lnk
ShortcutTarget: RT-Updater.lnk -> D:\Program Files\VCDS\VCDS.EXE (Ross-Tech, LLC)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.siemens.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9A70EA11C858CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - D:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - hxxp://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t
CHR DefaultSuggestURL: (Google) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Google Update) - C:\Users\armin.basten\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak\1.0_0
CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp\5.0.94.1_0
CHR Extension: (Gmail) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [1138312 2011-12-11] (SIEMENS AG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CCAgent; C:\Program Files\Common Files\Siemens\ACE\bin\CCAgent.exe [344064 2009-07-16] (SIEMENS AG)
S3 CCEClient; C:\Program Files\Common Files\Siemens\ace\bin\CCEClient.exe [262144 2009-07-16] (SIEMENS AG)
S2 CCEServer; C:\Program Files\Common Files\Siemens\ace\bin\CCEServer.exe [237568 2009-07-16] (SIEMENS AG)
R2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2010-10-27] (Hewlett-Packard Company)
R2 LcSvrAdm; D:\ElsaWin\bin\LcSvrAdm.exe [240640 2011-12-06] (Volkswagen AG)
R3 LcSvrAuf; D:\ElsaWin\bin\LcSvrAuf.exe [1321472 2011-12-06] (Volkswagen AG)
R2 LcSvrDba; D:\ElsaWin\bin\LcSvrDba.exe [392704 2011-12-06] (Volkswagen AG)
R2 LcSvrHis; D:\ElsaWin\bin\LcSvrHis.exe [335360 2011-12-06] (Volkswagen AG)
R2 LcSvrPAS; D:\ElsaWin\bin\LcSvrPas.exe [477696 2011-12-06] (Volkswagen AG)
R2 LcSvrSaz; D:\ElsaWin\bin\LcSvrSaz.exe [373248 2011-12-06] (Volkswagen AG)
R2 MSSQL$WINCCFLEXEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUS; C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUSMIG; C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [227600 2010-07-19] ()
S3 OpcEnum; C:\Windows\system32\Opcenum.exe [139488 2009-02-05] (OPC Foundation)
S3 RedundancyControl; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyControl.exe [430080 2009-07-16] (SIEMENS AG)
S3 RedundancyState; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyState.exe [180224 2009-07-16] (SIEMENS AG)
R2 s7hspsvx; C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2010-06-02] (SIEMENS AG)
R2 s7oiehsx; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [412808 2011-11-04] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [556168 2011-11-04] (SIEMENS AG)
R2 SCSMonitor; C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe [167936 2009-07-16] (SIEMENS AG)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 smartserver; C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe [558416 2011-12-06] (Siemens AG)
R2 UA Local Discovery Server; C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [28160 2010-05-05] (OPC Foundation)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dpmconv; C:\Windows\System32\DRIVERS\dpmconv32.sys [288256 2010-04-28] (SIEMENS AG)
S3 dpmcslv; C:\Windows\System32\Drivers\dpmcslv.sys [68280 2005-07-04] (Siemens AG)
R1 DPMTRCDD; C:\Windows\System32\DRIVERS\DPMTRCDD32.sys [72248 2010-03-22] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-23] (DT Soft Ltd)
R3 e1qexpress; C:\Windows\System32\DRIVERS\e1q6232.sys [215208 2009-11-05] (Intel Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R3 fwkbdrtm; C:\Windows\system32\drivers\fwkbdrtm.sys [21464 2011-12-06] (Windows (R) Win 7 DDK provider)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 HPFXBULKLEDM; C:\Windows\System32\drivers\hppcbulkio.sys [20504 2011-05-10] (Hewlett Packard)
S3 IAMT03; C:\Windows\system32\DRIVERS\IAMT03.sys [40848 2007-04-11] (Intel Corporation)
S3 IAMTV; C:\Windows\system32\DRIVERS\IAMTV.sys [38288 2007-04-11] (Intel Corporation)
S3 IAMTXP; C:\Windows\system32\DRIVERS\IAMTXP.sys [47496 2007-04-11] (Intel Corporation)
R3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-19] (Intel Corporation)
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42648 2011-04-30] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [12184 2011-04-30] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-04-30] (Logitech, Inc.)
S3 NAL; C:\Windows\system32\Drivers\iqvw32.sys [30880 2010-03-24] (Intel Corporation )
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [6814720 2010-07-14] (Intel Corporation)
R2 NSHE; C:\Windows\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008)
R2 PROFIbrd; C:\Windows\System32\Drivers\PROFIbrd.sys [165432 2010-03-10] (Softing AG)
S3 PROFIpnp; C:\Windows\System32\Drivers\PROFIpnp.sys [19256 2010-03-10] (Softing AG)
R2 PROFIprt; C:\Windows\System32\Drivers\PROFIprt.sys [39480 2010-03-10] (Softing AG)
R2 PROFIstack; C:\Windows\System32\Drivers\PROFIstack.sys [130104 2010-03-10] (Softing AG)
S3 PROFIusb; C:\Windows\System32\Drivers\PROFIusb.sys [39352 2010-03-10] (Softing AG)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [59464 2010-06-16] (Ross-Tech LLC)
R3 S7odpx2x32; C:\Windows\System32\Drivers\S7odpx2x32.sys [87552 2011-05-06] (SIEMENS AG)
R3 s7opciax32; C:\Windows\System32\DRIVERS\s7opciax32.sys [227840 2011-06-22] (SIEMENS AG)
R2 S7opcsrtx; C:\Windows\System32\DRIVERS\s7opcsrtx.sys [31744 2011-02-22] (SIEMENS AG)
R3 s7otmcd32x; C:\Windows\System32\Drivers\s7otmcd32x.sys [256512 2011-05-06] (SIEMENS AG)
R3 S7otranx32; C:\Windows\System32\Drivers\S7otranx32.sys [521216 2011-05-06] (SIEMENS AG)
R3 s7otsadx32; C:\Windows\System32\Drivers\s7otsadx32.sys [182784 2011-09-29] (SIEMENS AG)
R2 s7ousbu32x; C:\Windows\System32\DRIVERS\s7ousbu32x.sys [641280 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [63104 2011-06-16] (SIEMENS AG)
R2 s7snsrtx; C:\Windows\System32\DRIVERS\s7snsrtx.sys [73088 2009-02-24] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [343888 2011-10-11] (SIEMENS AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2010-06-09] (Samsung Electronics)
S3 usbbulk; C:\Windows\System32\Drivers\USBBulk.sys [18776 2008-07-04] (SEGGER MICROCONTROLLER GmbH & Co. KG)
R1 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada32.sys [98944 2010-03-22] (SIEMENS AG)
S3 wmdusbser; C:\Windows\System32\DRIVERS\wmdusbser.sys [107136 2010-06-11] (WeTelecom Incorporated)
S3 ZTEusbMB; C:\Windows\System32\DRIVERS\ZTEusbnmeaext2.sys [107520 2011-07-04] (ZTE Incorporated)
S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [195072 2011-12-01] (ZTE Incorporated)
S3 ALSysIO; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 massfilter; system32\DRIVERS\massfilter.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-20 11:04 - 2013-10-20 11:04 - 01087515 _____ (Farbar) C:\Users\armin.basten\Desktop\FRST.exe
2013-10-20 10:11 - 2013-10-20 10:11 - 00891167 _____ C:\Users\armin.basten\Downloads\SecurityCheck.exe
2013-10-19 18:09 - 2013-10-19 18:09 - 02347384 _____ (ESET) C:\Users\armin.basten\Downloads\esetsmartinstaller_enu (1).exe
2013-10-19 12:22 - 2013-10-19 12:22 - 02347384 _____ (ESET) C:\Users\armin.basten\Downloads\esetsmartinstaller_enu.exe
2013-10-19 11:19 - 2013-10-19 11:19 - 00047920 _____ C:\Users\armin.basten\Downloads\FRST.txt
2013-10-19 06:23 - 2013-10-19 06:23 - 00001436 _____ C:\Users\armin.basten\Desktop\JRT.txt
2013-10-19 06:18 - 2013-10-19 06:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 05:57 - 2013-10-19 06:01 - 00000000 ____D C:\AdwCleaner
2013-10-19 01:06 - 2013-10-19 01:07 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 00:53 - 2013-10-19 00:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 00:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-19 00:50 - 2013-10-19 00:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 00:48 - 2013-10-19 00:50 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 20:01 - 2013-10-18 20:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 19:33 - 2013-10-18 20:02 - 00000000 ____D C:\ComboFix
2013-10-18 19:29 - 2013-10-18 19:31 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 18:17 - 2013-10-18 18:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 16:20 - 2013-10-18 16:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 16:11 - 2013-10-18 16:12 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:05 - 2013-10-19 11:16 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:36 - 2013-10-18 15:41 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 13:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-18 13:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-18 13:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-18 08:39 - 2013-10-18 16:23 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 12:48 - 2013-10-17 07:30 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-10 15:31 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 07:06 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 07:06 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 07:06 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 07:06 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 07:06 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 07:05 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 23:48 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 23:48 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 23:48 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 23:48 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 23:48 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 23:48 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 23:48 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 23:48 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 23:48 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 23:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 23:48 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 23:48 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 23:48 - 2013-07-12 12:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 23:48 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 23:48 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 23:48 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 23:48 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 23:48 - 2013-07-03 06:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 23:48 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 23:48 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 23:48 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 23:47 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:52 - 2013-10-03 12:53 - 12105568 _____ (EVC electronic GmbH                                         ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 13:28 - 2013-10-02 17:55 - 00000056 _____ C:\Windows\Acroread.ini
2013-09-30 21:49 - 2013-10-01 03:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 22:31 - 2013-09-29 23:14 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 22:13 - 2013-09-30 16:20 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-29 22:12 - 2013-09-29 23:11 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:10 - 1996-11-05 15:13 - 00299008 _____ (InstallShield Corporation, Inc.) C:\Windows\uninst.exe
2013-09-29 21:22 - 2013-09-29 21:35 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-10-19 06:04 - 00001805 _____ C:\Windows\setupact.log
2013-09-29 21:17 - 2013-10-19 01:42 - 00013016 _____ C:\Windows\PFRO.log
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:12 - 2013-09-29 13:57 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 12:12 - 2011-06-21 10:24 - 00032768 _____ C:\Windows\system32\Drivers\sp_rsdrv2.sys
2013-09-28 12:06 - 2013-09-28 12:08 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-27 23:28 - 2013-09-28 06:10 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 23:28 - 2012-12-10 10:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2013-09-27 23:28 - 2012-12-10 10:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2013-09-27 22:29 - 2013-09-27 22:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-09-27 22:22 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-25 15:48 - 2013-09-26 03:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 11:33 - 2013-10-19 18:40 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-09-21 08:52 - 2008-11-23 09:23 - 00097792 _____ (T0r0 2008) C:\Windows\system32\Drivers\NSHE.SYS
2013-09-21 08:50 - 2013-09-29 14:32 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 08:48 - 2006-12-20 10:55 - 03066968 _____ (Aladdin Knowledge Systems.) C:\Windows\system32\hinstd.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 02511360 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\haspds_windows.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 00671112 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hdinst_windows.dll
2013-09-21 08:48 - 2006-11-30 10:06 - 00069632 _____ (Aladdin Knowledge Systems) C:\Windows\system32\hasp_inst_help1.dll
2013-09-21 08:48 - 2005-09-06 16:06 - 00028672 _____ C:\Windows\system32\hlduinst.exe
2013-09-21 08:48 - 2002-07-26 16:02 - 00006836 _____ C:\Windows\system32\UNWISE.INI
2013-09-21 08:15 - 2013-09-29 14:02 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-20 19:00 - 2013-10-20 00:28 - 00005122 _____ C:\Users\armin.basten\Desktop\S6-4F.txt

==================== One Month Modified Files and Folders =======

2013-10-20 11:05 - 2011-07-27 13:54 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Skype
2013-10-20 11:04 - 2013-10-20 11:04 - 01087515 _____ (Farbar) C:\Users\armin.basten\Desktop\FRST.exe
2013-10-20 10:11 - 2013-10-20 10:11 - 00891167 _____ C:\Users\armin.basten\Downloads\SecurityCheck.exe
2013-10-20 08:35 - 2011-07-27 11:04 - 01200664 _____ C:\Windows\WindowsUpdate.log
2013-10-20 00:28 - 2013-09-20 19:00 - 00005122 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
2013-10-19 18:40 - 2013-09-21 11:33 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-10-19 18:09 - 2013-10-19 18:09 - 02347384 _____ (ESET) C:\Users\armin.basten\Downloads\esetsmartinstaller_enu (1).exe
2013-10-19 12:31 - 2011-10-14 17:18 - 00763840 _____ C:\Windows\system32\perfh01F.dat
2013-10-19 12:31 - 2011-10-14 17:18 - 00182854 _____ C:\Windows\system32\perfc01F.dat
2013-10-19 12:31 - 2011-08-09 13:24 - 00830312 _____ C:\Windows\system32\perfh019.dat
2013-10-19 12:31 - 2011-08-09 13:24 - 00193648 _____ C:\Windows\system32\perfc019.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00602068 _____ C:\Windows\system32\perfh014.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00549482 _____ C:\Windows\system32\perfh012.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00526592 _____ C:\Windows\system32\prfh0404.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00510290 _____ C:\Windows\system32\prfh0804.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00165054 _____ C:\Windows\system32\perfc012.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00164626 _____ C:\Windows\system32\prfc0804.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00159712 _____ C:\Windows\system32\prfc0404.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00137768 _____ C:\Windows\system32\perfc014.dat
2013-10-19 12:31 - 2010-07-01 02:19 - 00844522 _____ C:\Windows\system32\perfh010.dat
2013-10-19 12:31 - 2010-07-01 02:19 - 00188544 _____ C:\Windows\system32\perfc010.dat
2013-10-19 12:31 - 2010-06-30 16:31 - 11561664 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-19 12:22 - 2013-10-19 12:22 - 02347384 _____ (ESET) C:\Users\armin.basten\Downloads\esetsmartinstaller_enu.exe
2013-10-19 11:19 - 2013-10-19 11:19 - 00047920 _____ C:\Users\armin.basten\Downloads\FRST.txt
2013-10-19 11:16 - 2013-10-18 16:05 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-19 06:23 - 2013-10-19 06:23 - 00001436 _____ C:\Users\armin.basten\Desktop\JRT.txt
2013-10-19 06:18 - 2013-10-19 06:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 06:13 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-19 06:13 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-19 06:04 - 2013-09-29 21:17 - 00001805 _____ C:\Windows\setupact.log
2013-10-19 06:01 - 2013-10-19 05:57 - 00000000 ____D C:\AdwCleaner
2013-10-19 01:42 - 2013-09-29 21:17 - 00013016 _____ C:\Windows\PFRO.log
2013-10-19 01:42 - 2011-08-30 07:22 - 00000000 ____D C:\Windows\3PUPrgWsQafmis
2013-10-19 01:07 - 2013-10-19 01:06 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 01:01 - 2013-02-16 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\uTorrent
2013-10-19 00:53 - 2013-10-19 00:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 00:50 - 2013-10-19 00:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 00:50 - 2013-10-19 00:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 20:02 - 2013-10-18 19:33 - 00000000 ____D C:\ComboFix
2013-10-18 20:01 - 2013-10-18 20:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 20:01 - 2013-08-10 11:57 - 00000000 ____D C:\Qoobox
2013-10-18 19:52 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-18 19:31 - 2013-10-18 19:29 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 18:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-18 18:17 - 2013-10-18 18:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 16:23 - 2013-10-18 08:39 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 16:20 - 2013-10-18 16:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 16:12 - 2013-10-18 16:11 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:41 - 2013-10-18 15:36 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 09:33 - 2012-04-15 11:00 - 00000000 ____D C:\ProgramData\Apple
2013-10-17 07:30 - 2013-10-17 12:48 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-14 07:40 - 2011-08-17 07:37 - 00000000 ____D C:\Windows\Minidump
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ___RD C:\Program Files\Skype
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ____D C:\ProgramData\Skype
2013-10-10 17:11 - 2012-03-03 08:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\AIMP3
2013-10-10 08:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 07:43 - 2009-07-14 06:33 - 00509944 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-TW
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-CN
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\nb-NO
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ko-KR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\it-IT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fr-FR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fi-FI
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-10 07:15 - 2011-07-28 12:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 07:13 - 2013-07-20 12:09 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 07:07 - 2011-07-27 18:14 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\WindSolutions
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-09 08:47 - 2013-05-06 13:40 - 00004756 _____ C:\Users\armin.basten\Desktop\Edenites.txt
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:53 - 2013-10-03 12:52 - 12105568 _____ (EVC electronic GmbH                                         ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-02 17:55 - 2013-10-01 13:28 - 00000056 _____ C:\Windows\Acroread.ini
2013-10-01 16:00 - 2013-05-06 10:45 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 03:49 - 2013-09-30 21:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 16:20 - 2013-09-29 22:13 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 23:14 - 2013-09-29 22:31 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 23:11 - 2013-09-29 22:12 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:09 - 2013-03-23 16:26 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DAEMON Tools Lite
2013-09-29 21:35 - 2013-09-29 21:22 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 17:18 - 2012-04-03 13:27 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\FileZilla
2013-09-29 16:10 - 2013-03-24 14:04 - 00000156 _____ C:\Windows\etkinst.ini
2013-09-29 14:32 - 2013-09-21 08:50 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-29 14:02 - 2013-09-21 08:15 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-29 14:02 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system
2013-09-29 13:57 - 2013-09-28 12:12 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:08 - 2013-09-28 12:06 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 09:16 - 2012-06-17 16:37 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Audacity
2013-09-28 07:32 - 2012-05-11 19:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-28 07:32 - 2011-07-27 15:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-28 06:10 - 2013-09-27 23:28 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 22:37 - 2013-09-27 22:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 22:22 - 2013-09-27 20:32 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-02-04 04:27 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-09-27 20:21 - 2011-08-03 13:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Canon
2013-09-27 20:21 - 2011-08-03 12:44 - 00000000 ____D C:\Program Files\Canon
2013-09-27 20:17 - 2011-08-03 13:32 - 00000000 ___HD C:\ProgramData\CanonIJScan
2013-09-27 20:17 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-09-27 20:08 - 2012-04-15 11:04 - 00000000 ____D C:\ProgramData\Apple Computer
2013-09-26 03:48 - 2013-09-25 15:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 01:28 - 2013-10-10 07:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-10 07:06 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:28 - 2013-10-10 07:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 09:01 - 2011-10-08 07:18 - 00000000 ____D C:\Users\armin.basten\Desktop\IFM VES003_2_6
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 05:30 - 2013-10-10 07:06 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-10 07:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

Some content of TEMP:
====================
C:\Users\armin.basten\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 00:20

==================== End Of Log ============================
         
--- --- ---

Noch Probleme? Ich würde sagen ja.
Noch ein Trojaner vorhanden, Firewall lässt sich immernoch nicht bedienen.

Mein Schutz scheint auch nicht der Beste zu sein.
Obwohl der Beste Schutz mein Verhalten ist.
Trotzdem, was emphielt der Experte?

Geändert von Bassmann1968 (20.10.2013 um 08:08 Uhr)

Alt 20.10.2013, 14:20   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Java und ADobe updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
C:\Program Files\94
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Ich empfehle immer Emsisoft.

Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.


__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 20.10.2013, 15:08   #9
Bassmann1968
 
Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Java update auf 7.45 durchgeführt.
Adobe wird als aktuell angezeigt.
Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 19-10-2013
Ran by armin.basten at 2013-10-20 17:56:35 Run:1
Running from C:\Users\armin.basten\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Program Files\94
*****************

C:\Program Files\94 => Moved successfully.

==== End of Fixlog ====
         
Code:
ATTFilter
Farbar Service Scanner Version: 13-09-2013
Ran by armin.basten (administrator) on 20-10-2013 at 18:06:35
Running from "C:\Users\armin.basten\Desktop"
Microsoft Windows 7 Ultimate  Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.


Firewall Disabled Policy: 
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys
[2013-10-09 23:48] - [2013-09-14 02:48] - 0338944 ____A (Microsoft Corporation) F81BB7E487EDCEAB630A7EE66CF23913

C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-10-09 23:48] - [2013-09-08 04:07] - 1294272 ____A (Microsoft Corporation) CA59F7C570AF70BC174F477CFE2D9EE3

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-08-15 02:18] - [2013-07-09 06:46] - 0140288 ____A (Microsoft Corporation) 7CA1BECEA5DE2643ADDAD32670E7A4C9

C:\Program Files\Windows Defender\MpSvc.dll
[2013-07-18 05:24] - [2013-05-27 06:57] - 0680960 ____A (Microsoft Corporation) 082CF481F659FAE0DE51AD060881EB47

C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****
         
und wieder ein fettes Danke

Alt 20.10.2013, 18:02   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Downloade dir bitte Windows Repair (All In One) von hier.
  • Installiere das Programm. Starte es, nachdem die Installation abgeschlossen wurde.
  • Klicke auf Step 2 und drücke unter Check Disk auf Do It.

  • Wenn der Vorgang abgeschlossen ist, klicke auf Step 3 und drücke unter System File Check auf Do It.

  • Nachdem der Vorgang abgeschlossen ist, klicke auf Start Repairs, wähle den Advanced Mode und drücke Start.

  • Gehe bitte sicher, dass die Kästchen wie unten zu sehen angehakt sind. Bitte hake zusätzlich noch Set Windows Services to Default Startup an.
  • Hake Restart System when Finished an.
  • Drücke Start.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 21.10.2013, 07:31   #11
Bassmann1968
 
Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Hallo Schrauber,

alles scheint wieder normal zu laufen. Firewall ist aktiv und lässt sich wieder einstellen.
Vielen Dank dafür.
Soll ich noch etwas machen?
Gruss Bassi

Jetzt ist mir doch noch etwas aufgefallen.
Im Wartungscenter werde ich dazu aufgefordert den Defender ein zu schalten.
Wenn ich auf "Jetzt Einschalten" klicke, dann komme ich zu Defender und es wird gemeldet: "Es wurde keine unerwünschte oder schädliche Software ermittelt. Der Computer wird normal ausgeführt". Aber die Meldung, dass ich den Defender aktivieren soll bleibt bestehen.

Alt 21.10.2013, 08:13   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Poste bitte ein frisches FSS und FRST log.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 21.10.2013, 15:49   #13
Bassmann1968
 
Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Frisch auf den Tisch
Code:
ATTFilter
Farbar Service Scanner Version: 13-09-2013
Ran by armin.basten (administrator) on 21-10-2013 at 11:15:48
Running from "C:\Users\armin.basten\Desktop"
Microsoft Windows 7 Ultimate  Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
WAN connected
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys
[2013-10-10 01:48] - [2013-09-14 04:48] - 0338944 ____A (Microsoft Corporation) F81BB7E487EDCEAB630A7EE66CF23913

C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-10-10 01:48] - [2013-09-08 06:07] - 1294272 ____A (Microsoft Corporation) CA59F7C570AF70BC174F477CFE2D9EE3

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-08-15 04:18] - [2013-07-09 08:46] - 0140288 ____A (Microsoft Corporation) 7CA1BECEA5DE2643ADDAD32670E7A4C9

C:\Program Files\Windows Defender\MpSvc.dll
[2013-07-18 07:24] - [2013-05-27 08:57] - 0680960 ____A (Microsoft Corporation) 082CF481F659FAE0DE51AD060881EB47

C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****
         
FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-10-2013
Ran by armin.basten (administrator) on KIS-FIELD-PG on 21-10-2013 11:16:28
Running from C:\Users\armin.basten\Desktop
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Siemens AG) C:\PROGRAM FILES\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
(Hewlett-Packard Company) C:\Program Files\HP\HPBDSService\HPBDSService.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrDba.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrHis.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrPas.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrSaz.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe
(Siemens AG) C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(OPC Foundation) C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAuf.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\Program Files\iTunes\iTunesHelper.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\LoadMdm.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\pniopcac.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\NetKit.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\system32\wbengine.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - D:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-05] (Adobe Systems Incorporated)
HKLM\...\Run: [LoadMdm] - C:\Program Files\Wetelecom\LoadMdm.exe [397312 2010-09-13] (TODO: <Company name>)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [Google Update] - C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-12-04] (Google Inc.)
HKCU\...\Run: [Xvid] - C:\Program Files\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
Startup: C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Updater.lnk
ShortcutTarget: RT-Updater.lnk -> D:\Program Files\VCDS\VCDS.EXE (Ross-Tech, LLC)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.siemens.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9A70EA11C858CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - D:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 10.0.1.1
Tcpip\..\Interfaces\{506F0F6B-7885-4DEE-978F-D31EEF8B6428}: [NameServer]77.243.240.230 77.243.240.231
Tcpip\..\Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR Extension: (YouTube) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak\1.0_0
CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp\5.0.94.1_0
CHR Extension: (Gmail) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [1138312 2011-12-11] (SIEMENS AG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CCAgent; C:\Program Files\Common Files\Siemens\ACE\bin\CCAgent.exe [344064 2009-07-16] (SIEMENS AG)
S3 CCEClient; C:\Program Files\Common Files\Siemens\ace\bin\CCEClient.exe [262144 2009-07-16] (SIEMENS AG)
S2 CCEServer; C:\Program Files\Common Files\Siemens\ace\bin\CCEServer.exe [237568 2009-07-16] (SIEMENS AG)
R2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2010-10-27] (Hewlett-Packard Company)
R2 LcSvrAdm; D:\ElsaWin\bin\LcSvrAdm.exe [240640 2011-12-06] (Volkswagen AG)
R3 LcSvrAuf; D:\ElsaWin\bin\LcSvrAuf.exe [1321472 2011-12-06] (Volkswagen AG)
R2 LcSvrDba; D:\ElsaWin\bin\LcSvrDba.exe [392704 2011-12-06] (Volkswagen AG)
R2 LcSvrHis; D:\ElsaWin\bin\LcSvrHis.exe [335360 2011-12-06] (Volkswagen AG)
R2 LcSvrPAS; D:\ElsaWin\bin\LcSvrPas.exe [477696 2011-12-06] (Volkswagen AG)
R2 LcSvrSaz; D:\ElsaWin\bin\LcSvrSaz.exe [373248 2011-12-06] (Volkswagen AG)
R2 MSSQL$WINCCFLEXEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUS; C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUSMIG; C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [227600 2010-07-19] ()
S3 OpcEnum; C:\Windows\system32\Opcenum.exe [139488 2009-02-05] (OPC Foundation)
S3 RedundancyControl; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyControl.exe [430080 2009-07-16] (SIEMENS AG)
S3 RedundancyState; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyState.exe [180224 2009-07-16] (SIEMENS AG)
R2 s7hspsvx; C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2010-06-02] (SIEMENS AG)
R2 s7oiehsx; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [412808 2011-11-04] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [556168 2011-11-04] (SIEMENS AG)
R2 SCSMonitor; C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe [167936 2009-07-16] (SIEMENS AG)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 smartserver; C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe [558416 2011-12-07] (Siemens AG)
R2 UA Local Discovery Server; C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [28160 2010-05-06] (OPC Foundation)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dpmconv; C:\Windows\System32\DRIVERS\dpmconv32.sys [288256 2010-04-28] (SIEMENS AG)
S3 dpmcslv; C:\Windows\System32\Drivers\dpmcslv.sys [68280 2005-07-04] (Siemens AG)
R1 DPMTRCDD; C:\Windows\System32\DRIVERS\DPMTRCDD32.sys [72248 2010-03-22] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-23] (DT Soft Ltd)
R3 e1qexpress; C:\Windows\System32\DRIVERS\e1q6232.sys [215208 2009-11-05] (Intel Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R3 fwkbdrtm; C:\Windows\system32\drivers\fwkbdrtm.sys [21464 2011-12-07] (Windows (R) Win 7 DDK provider)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 HPFXBULKLEDM; C:\Windows\System32\drivers\hppcbulkio.sys [20504 2011-05-10] (Hewlett Packard)
S3 IAMT03; C:\Windows\system32\DRIVERS\IAMT03.sys [40848 2007-04-12] (Intel Corporation)
S3 IAMTV; C:\Windows\system32\DRIVERS\IAMTV.sys [38288 2007-04-12] (Intel Corporation)
S3 IAMTXP; C:\Windows\system32\DRIVERS\IAMTXP.sys [47496 2007-04-12] (Intel Corporation)
R3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-20] (Intel Corporation)
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42648 2011-04-30] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [12184 2011-04-30] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-04-30] (Logitech, Inc.)
S3 NAL; C:\Windows\system32\Drivers\iqvw32.sys [30880 2010-03-24] (Intel Corporation )
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [6814720 2010-07-14] (Intel Corporation)
R2 NSHE; C:\Windows\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008)
R2 PROFIbrd; C:\Windows\System32\Drivers\PROFIbrd.sys [165432 2010-03-10] (Softing AG)
S3 PROFIpnp; C:\Windows\System32\Drivers\PROFIpnp.sys [19256 2010-03-10] (Softing AG)
R2 PROFIprt; C:\Windows\System32\Drivers\PROFIprt.sys [39480 2010-03-10] (Softing AG)
R2 PROFIstack; C:\Windows\System32\Drivers\PROFIstack.sys [130104 2010-03-10] (Softing AG)
S3 PROFIusb; C:\Windows\System32\Drivers\PROFIusb.sys [39352 2010-03-10] (Softing AG)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [59464 2010-06-17] (Ross-Tech LLC)
R3 S7odpx2x32; C:\Windows\System32\Drivers\S7odpx2x32.sys [87552 2011-05-06] (SIEMENS AG)
R3 s7opciax32; C:\Windows\System32\DRIVERS\s7opciax32.sys [227840 2011-06-22] (SIEMENS AG)
R2 S7opcsrtx; C:\Windows\System32\DRIVERS\s7opcsrtx.sys [31744 2011-02-22] (SIEMENS AG)
R3 s7otmcd32x; C:\Windows\System32\Drivers\s7otmcd32x.sys [256512 2011-05-06] (SIEMENS AG)
R3 S7otranx32; C:\Windows\System32\Drivers\S7otranx32.sys [521216 2011-05-06] (SIEMENS AG)
R3 s7otsadx32; C:\Windows\System32\Drivers\s7otsadx32.sys [182784 2011-09-29] (SIEMENS AG)
R2 s7ousbu32x; C:\Windows\System32\DRIVERS\s7ousbu32x.sys [641280 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [63104 2011-06-16] (SIEMENS AG)
R2 s7snsrtx; C:\Windows\System32\DRIVERS\s7snsrtx.sys [73088 2009-02-24] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [343888 2011-10-11] (SIEMENS AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2010-06-09] (Samsung Electronics)
S3 usbbulk; C:\Windows\System32\Drivers\USBBulk.sys [18776 2008-07-04] (SEGGER MICROCONTROLLER GmbH & Co. KG)
R1 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada32.sys [98944 2010-03-22] (SIEMENS AG)
R3 wmdusbser; C:\Windows\System32\DRIVERS\wmdusbser.sys [107136 2010-06-11] (WeTelecom Incorporated)
S3 ZTEusbMB; C:\Windows\System32\DRIVERS\ZTEusbnmeaext2.sys [107520 2011-07-04] (ZTE Incorporated)
S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [195072 2011-12-01] (ZTE Incorporated)
S3 ALSysIO; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 massfilter; system32\DRIVERS\massfilter.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-21 11:15 - 2013-10-21 11:15 - 00002507 _____ C:\Users\armin.basten\Desktop\FSS.txt
2013-10-21 10:33 - 2011-05-30 17:42 - 00240640 _____ C:\Windows\system32\xvidvfw.dll
2013-10-21 10:33 - 2011-05-23 13:52 - 00153088 _____ C:\Windows\system32\xvid.ax
2013-10-21 10:33 - 2011-05-23 11:46 - 00645632 _____ C:\Windows\system32\xvidcore.dll
2013-10-21 10:25 - 2013-10-21 10:27 - 10768856 _____ (Xvid Team) C:\Users\armin.basten\Downloads\Xvid-1.3.2-20110601.exe
2013-10-21 00:49 - 2013-10-21 07:57 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-10-20 23:24 - 2013-10-20 23:24 - 00003408 ____N C:\bootsqm.dat
2013-10-20 23:05 - 2013-10-20 23:05 - 00000000 ____D C:\Users\armin.basten\Downloads\tweaking.com_windows_repair_aio
2013-10-20 20:04 - 2013-10-20 20:04 - 00358923 _____ (Farbar) C:\Users\armin.basten\Desktop\FSS.exe
2013-10-20 19:54 - 2013-10-20 19:54 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 19:53 - 2013-10-08 09:50 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-20 19:53 - 2013-10-08 09:46 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-20 19:53 - 2013-10-08 09:46 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-20 19:53 - 2013-10-08 09:46 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-20 19:51 - 2013-10-20 19:53 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-20 13:04 - 2013-10-20 13:04 - 01087515 _____ (Farbar) C:\Users\armin.basten\Desktop\FRST.exe
2013-10-20 12:11 - 2013-10-20 12:11 - 00891167 _____ C:\Users\armin.basten\Downloads\SecurityCheck.exe
2013-10-19 13:19 - 2013-10-19 13:19 - 00047920 _____ C:\Users\armin.basten\Downloads\FRST.txt
2013-10-19 08:18 - 2013-10-19 08:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 07:57 - 2013-10-19 08:01 - 00000000 ____D C:\AdwCleaner
2013-10-19 03:06 - 2013-10-19 03:07 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 02:53 - 2013-10-19 02:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 02:53 - 2013-04-04 16:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-19 02:50 - 2013-10-19 02:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 02:48 - 2013-10-19 02:50 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 22:01 - 2013-10-18 22:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 21:33 - 2013-10-18 22:02 - 00000000 ____D C:\ComboFix
2013-10-18 21:29 - 2013-10-18 21:31 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 20:17 - 2013-10-18 20:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 18:20 - 2013-10-18 18:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 18:11 - 2013-10-18 18:12 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 18:10 - 2013-10-18 18:10 - 00000000 ____D C:\FRST
2013-10-18 18:05 - 2013-10-19 13:16 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 18:05 - 2013-10-18 18:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 18:04 - 2013-10-18 18:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:13 - 2011-06-26 10:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-18 15:13 - 2010-11-07 21:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-18 15:13 - 2009-04-20 08:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-18 10:39 - 2013-10-21 08:37 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 10:39 - 2013-10-18 10:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 10:39 - 2013-10-18 10:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 14:48 - 2013-10-17 09:30 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 09:40 - 2013-10-14 09:40 - 00131072 _____ C:\Windows\Minidump\101413-31184-01.dmp
2013-10-10 17:31 - 2013-09-04 05:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 09:06 - 2013-09-23 03:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 09:06 - 2013-09-23 03:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 09:06 - 2013-09-23 03:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 09:06 - 2013-09-21 07:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 09:06 - 2013-09-21 06:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 09:05 - 2013-09-23 03:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 09:05 - 2013-09-23 03:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 09:05 - 2013-09-23 03:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 01:48 - 2013-09-14 04:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 01:48 - 2013-09-08 06:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 01:48 - 2013-09-08 06:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 01:48 - 2013-08-29 05:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-10 01:48 - 2013-08-29 05:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 01:48 - 2013-08-29 05:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 01:48 - 2013-08-29 05:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 01:48 - 2013-08-29 05:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 01:48 - 2013-08-28 05:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 01:48 - 2013-08-28 04:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 01:48 - 2013-08-01 15:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 01:48 - 2013-07-20 14:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 01:48 - 2013-07-12 14:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-10 01:48 - 2013-07-12 14:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 01:48 - 2013-07-12 14:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-10 01:48 - 2013-07-04 15:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 01:48 - 2013-07-04 15:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 01:48 - 2013-07-04 15:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 01:48 - 2013-07-04 13:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 01:48 - 2013-07-03 08:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 01:48 - 2013-07-03 07:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-10 01:48 - 2013-07-03 07:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 01:48 - 2013-06-06 08:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 01:48 - 2013-06-06 08:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 01:48 - 2013-06-06 08:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 01:48 - 2013-06-06 07:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 01:48 - 2013-06-06 07:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 01:47 - 2013-06-26 02:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 14:24 - 2013-10-09 14:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 14:24 - 2013-10-09 14:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-03 22:49 - 2013-10-03 22:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 14:52 - 2013-10-03 14:53 - 12105568 _____ (EVC electronic GmbH                                         ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 15:28 - 2013-10-20 15:02 - 00000056 _____ C:\Windows\Acroread.ini
2013-09-30 23:49 - 2013-10-01 05:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 19:01 - 2013-09-30 19:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 19:01 - 2013-09-30 19:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 19:01 - 2013-09-30 19:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 19:00 - 2013-09-30 19:00 - 00000000 ____D C:\VW
2013-09-30 14:36 - 2013-09-30 14:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-30 00:31 - 2013-09-30 01:14 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-30 00:13 - 2013-09-30 18:20 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 00:12 - 2013-09-30 01:11 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-30 00:10 - 1996-11-05 17:13 - 00299008 _____ (InstallShield Corporation, Inc.) C:\Windows\uninst.exe
2013-09-29 23:22 - 2013-09-29 23:35 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 23:17 - 2013-10-21 07:59 - 00015858 _____ C:\Windows\PFRO.log
2013-09-29 23:17 - 2013-10-21 07:59 - 00001917 _____ C:\Windows\setupact.log
2013-09-29 23:17 - 2013-09-29 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 16:18 - 2013-09-29 16:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-28 23:50 - 2013-09-28 23:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 14:12 - 2013-09-29 15:57 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 14:12 - 2011-06-21 12:24 - 00032768 _____ C:\Windows\system32\Drivers\sp_rsdrv2.sys
2013-09-28 14:06 - 2013-09-28 14:08 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 01:28 - 2013-09-28 08:10 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-28 01:28 - 2012-12-10 12:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2013-09-28 01:28 - 2012-12-10 12:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2013-09-28 01:28 - 2009-07-23 19:32 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2013-09-28 01:28 - 2009-07-23 19:32 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2013-09-28 00:29 - 2013-09-28 00:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 22:34 - 2013-09-27 22:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 22:32 - 2013-09-28 00:22 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-25 17:48 - 2013-09-26 05:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 02:51 - 2013-09-23 02:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 13:33 - 2013-10-19 20:40 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-09-21 10:52 - 2008-11-23 11:23 - 00097792 _____ (T0r0 2008) C:\Windows\system32\Drivers\NSHE.SYS
2013-09-21 10:50 - 2013-09-29 16:32 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-21 10:48 - 2013-09-21 10:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 10:48 - 2006-12-20 12:55 - 03066968 _____ (Aladdin Knowledge Systems.) C:\Windows\system32\hinstd.dll
2013-09-21 10:48 - 2006-12-20 11:00 - 02511360 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\haspds_windows.dll
2013-09-21 10:48 - 2006-12-20 11:00 - 00671112 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hdinst_windows.dll
2013-09-21 10:48 - 2006-11-30 12:06 - 00069632 _____ (Aladdin Knowledge Systems) C:\Windows\system32\hasp_inst_help1.dll
2013-09-21 10:48 - 2005-09-06 18:06 - 00028672 _____ C:\Windows\system32\hlduinst.exe
2013-09-21 10:48 - 2002-07-26 18:02 - 00006836 _____ C:\Windows\system32\UNWISE.INI
2013-09-21 10:15 - 2013-09-29 16:02 - 00000000 ____D C:\Windows\ETKA7.4_Germany

==================== One Month Modified Files and Folders =======

2013-10-21 11:15 - 2013-10-21 11:15 - 00002507 _____ C:\Users\armin.basten\Desktop\FSS.txt
2013-10-21 11:08 - 2011-07-27 15:54 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Skype
2013-10-21 10:52 - 2011-12-04 16:34 - 00001148 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005UA.job
2013-10-21 10:33 - 2012-02-04 13:55 - 00000000 ____D C:\Program Files\Xvid
2013-10-21 10:27 - 2013-10-21 10:25 - 10768856 _____ (Xvid Team) C:\Users\armin.basten\Downloads\Xvid-1.3.2-20110601.exe
2013-10-21 08:38 - 2011-07-27 13:04 - 01235735 _____ C:\Windows\WindowsUpdate.log
2013-10-21 08:37 - 2013-10-18 10:39 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-21 07:59 - 2013-09-29 23:17 - 00015858 _____ C:\Windows\PFRO.log
2013-10-21 07:59 - 2013-09-29 23:17 - 00001917 _____ C:\Windows\setupact.log
2013-10-21 07:59 - 2009-07-14 08:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-21 07:59 - 2009-07-14 08:33 - 00509944 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-21 07:57 - 2013-10-21 00:49 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-10-21 06:52 - 2011-12-04 16:34 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005Core.job
2013-10-21 06:43 - 2011-07-27 13:02 - 00111912 _____ C:\Users\armin.basten\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-21 06:07 - 2011-10-14 19:18 - 00760046 _____ C:\Windows\system32\perfh01F.dat
2013-10-21 06:07 - 2011-10-14 19:18 - 00179060 _____ C:\Windows\system32\perfc01F.dat
2013-10-21 06:07 - 2011-08-09 15:24 - 00826518 _____ C:\Windows\system32\perfh019.dat
2013-10-21 06:07 - 2011-08-09 15:24 - 00189854 _____ C:\Windows\system32\perfc019.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00598274 _____ C:\Windows\system32\perfh014.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00545688 _____ C:\Windows\system32\perfh012.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00522798 _____ C:\Windows\system32\prfh0404.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00506496 _____ C:\Windows\system32\prfh0804.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00161260 _____ C:\Windows\system32\perfc012.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00160832 _____ C:\Windows\system32\prfc0804.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00155918 _____ C:\Windows\system32\prfc0404.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00133974 _____ C:\Windows\system32\perfc014.dat
2013-10-21 06:07 - 2010-07-01 04:19 - 00840728 _____ C:\Windows\system32\perfh010.dat
2013-10-21 06:07 - 2010-07-01 04:19 - 00184750 _____ C:\Windows\system32\perfc010.dat
2013-10-21 06:07 - 2010-06-30 18:31 - 11561664 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-21 06:07 - 2009-07-14 08:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-21 06:07 - 2009-07-14 08:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-20 23:24 - 2013-10-20 23:24 - 00003408 ____N C:\bootsqm.dat
2013-10-20 23:05 - 2013-10-20 23:05 - 00000000 ____D C:\Users\armin.basten\Downloads\tweaking.com_windows_repair_aio
2013-10-20 20:04 - 2013-10-20 20:04 - 00358923 _____ (Farbar) C:\Users\armin.basten\Desktop\FSS.exe
2013-10-20 19:54 - 2013-10-20 19:54 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 19:53 - 2013-10-20 19:51 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-20 19:53 - 2012-04-03 12:04 - 00000000 ____D C:\Program Files\Java
2013-10-20 15:02 - 2013-10-01 15:28 - 00000056 _____ C:\Windows\Acroread.ini
2013-10-20 14:18 - 2013-02-16 19:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\uTorrent
2013-10-20 13:44 - 2013-09-20 21:00 - 00005140 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
2013-10-20 13:04 - 2013-10-20 13:04 - 01087515 _____ (Farbar) C:\Users\armin.basten\Desktop\FRST.exe
2013-10-20 12:11 - 2013-10-20 12:11 - 00891167 _____ C:\Users\armin.basten\Downloads\SecurityCheck.exe
2013-10-19 20:40 - 2013-09-21 13:33 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-10-19 13:19 - 2013-10-19 13:19 - 00047920 _____ C:\Users\armin.basten\Downloads\FRST.txt
2013-10-19 13:16 - 2013-10-18 18:05 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-19 08:18 - 2013-10-19 08:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 08:01 - 2013-10-19 07:57 - 00000000 ____D C:\AdwCleaner
2013-10-19 03:42 - 2011-08-30 09:22 - 00000000 ____D C:\Windows\3PUPrgWsQafmis
2013-10-19 03:07 - 2013-10-19 03:06 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 02:53 - 2013-10-19 02:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 02:50 - 2013-10-19 02:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 02:50 - 2013-10-19 02:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 22:02 - 2013-10-18 21:33 - 00000000 ____D C:\ComboFix
2013-10-18 22:01 - 2013-10-18 22:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 22:01 - 2013-08-10 13:57 - 00000000 ____D C:\Qoobox
2013-10-18 21:52 - 2009-07-14 06:04 - 00000215 _____ C:\Windows\system.ini
2013-10-18 21:31 - 2013-10-18 21:29 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 20:19 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-18 20:17 - 2013-10-18 20:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 18:20 - 2013-10-18 18:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 18:12 - 2013-10-18 18:11 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 18:10 - 2013-10-18 18:10 - 00000000 ____D C:\FRST
2013-10-18 18:05 - 2013-10-18 18:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 18:04 - 2013-10-18 18:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 10:39 - 2013-10-18 10:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 10:39 - 2013-10-18 10:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 11:33 - 2012-04-15 13:00 - 00000000 ____D C:\ProgramData\Apple
2013-10-17 09:30 - 2013-10-17 14:48 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 09:40 - 2013-10-14 09:40 - 00131072 _____ C:\Windows\Minidump\101413-31184-01.dmp
2013-10-14 09:40 - 2011-08-17 09:37 - 00000000 ____D C:\Windows\Minidump
2013-10-12 15:41 - 2011-07-27 15:52 - 00000000 ___RD C:\Program Files\Skype
2013-10-12 15:41 - 2011-07-27 15:52 - 00000000 ____D C:\ProgramData\Skype
2013-10-10 19:11 - 2012-03-03 10:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\AIMP3
2013-10-10 10:32 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\zh-TW
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\zh-CN
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\nb-NO
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\ko-KR
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\it-IT
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\fr-FR
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\fi-FI
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-10 09:15 - 2011-07-28 14:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 09:13 - 2013-07-20 14:09 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 09:07 - 2011-07-27 20:14 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 14:24 - 2013-10-09 14:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 14:24 - 2013-10-09 14:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-09 14:24 - 2012-05-21 06:20 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\WindSolutions
2013-10-09 14:24 - 2012-05-21 06:20 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-09 10:47 - 2013-05-06 15:40 - 00004756 _____ C:\Users\armin.basten\Desktop\Edenites.txt
2013-10-08 09:50 - 2013-10-20 19:53 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-08 09:46 - 2013-10-20 19:53 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-08 09:46 - 2013-10-20 19:53 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-08 09:46 - 2013-10-20 19:53 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-03 22:49 - 2013-10-03 22:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 14:53 - 2013-10-03 14:52 - 12105568 _____ (EVC electronic GmbH                                         ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 18:00 - 2013-05-06 12:45 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 18:00 - 2012-11-05 08:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 18:00 - 2012-11-05 08:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 18:00 - 2012-11-05 08:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 05:49 - 2013-09-30 23:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 19:01 - 2013-09-30 19:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 19:01 - 2013-09-30 19:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 19:01 - 2013-09-30 19:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 19:00 - 2013-09-30 19:00 - 00000000 ____D C:\VW
2013-09-30 18:20 - 2013-09-30 00:13 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 14:36 - 2013-09-30 14:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-30 01:14 - 2013-09-30 00:31 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-30 01:11 - 2013-09-30 00:12 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-30 00:09 - 2013-03-23 18:26 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DAEMON Tools Lite
2013-09-29 23:35 - 2013-09-29 23:22 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 23:17 - 2013-09-29 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 19:18 - 2012-04-03 15:27 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\FileZilla
2013-09-29 18:10 - 2013-03-24 16:04 - 00000156 _____ C:\Windows\etkinst.ini
2013-09-29 16:32 - 2013-09-21 10:50 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-29 16:18 - 2013-09-29 16:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-29 16:02 - 2013-09-21 10:15 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-29 16:02 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system
2013-09-29 15:57 - 2013-09-28 14:12 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 23:50 - 2013-09-28 23:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 14:08 - 2013-09-28 14:06 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 11:16 - 2012-06-17 18:37 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Audacity
2013-09-28 09:32 - 2012-05-11 21:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-28 09:32 - 2011-07-27 17:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-28 08:10 - 2013-09-28 01:28 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-28 00:37 - 2013-09-28 00:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-28 00:22 - 2013-09-27 22:32 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-27 22:34 - 2013-09-27 22:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 22:32 - 2013-02-04 06:27 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-09-27 22:21 - 2011-08-03 15:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Canon
2013-09-27 22:21 - 2011-08-03 14:44 - 00000000 ____D C:\Program Files\Canon
2013-09-27 22:17 - 2011-08-03 15:32 - 00000000 ___HD C:\ProgramData\CanonIJScan
2013-09-27 22:17 - 2009-07-14 08:52 - 00000000 ____D C:\Windows\twain_32
2013-09-27 22:08 - 2012-04-15 13:04 - 00000000 ____D C:\ProgramData\Apple Computer
2013-09-26 05:48 - 2013-09-25 17:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 03:28 - 2013-10-10 09:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 03:28 - 2013-10-10 09:06 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 03:28 - 2013-10-10 09:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 03:27 - 2013-10-10 09:05 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 03:27 - 2013-10-10 09:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 02:51 - 2013-09-23 02:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 11:01 - 2011-10-08 09:18 - 00000000 ____D C:\Users\armin.basten\Desktop\IFM VES003_2_6
2013-09-21 10:48 - 2013-09-21 10:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 07:30 - 2013-10-10 09:06 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 06:39 - 2013-10-10 09:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

Some content of TEMP:
====================
C:\Users\armin.basten\AppData\Local\temp\avgnt.exe
C:\Users\armin.basten\AppData\Local\temp\jre-7u45-windows-i586-iftw.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 02:20

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Alles wird gut!!!
Nach einem Neustart wurde der Defender nun als aktiv angezeigt.

Vielen Dank für die Hilfe!!!

Alt 22.10.2013, 07:34   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
C:\Program Files\Enigma Software Group
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 22.10.2013, 16:48   #15
Bassmann1968
 
Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Standard

Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9



Alles ausgeführt.
FRST Log File ist leider gelöscht, aber es war alles ok.

Updates Auto, Secunia installiert, AV habe ich jetzt erst mal Avira drauf gelassen bis ich in Deutschland zurück bin.

Werde alle empfohlenen Programme nun laden und nutzen.

Browser nutze ich momentan Chrome. Nicht zu empfehlen?

Englische Links sind kein Problem.

Vielen vielen Dank.
Dann werde ich mich jetzt mal um die Spende kümmern

Nach einem Lauf von Malwarebytes habe ich das noch gefunden:
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.22.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16721
armin.basten :: KIS-FIELD-PG [Administrator]

Schutz: Aktiviert

22.10.2013 13:07:35
MBAM-log-2013-10-22 (13-32-55).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 270886
Laufzeit: 24 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\armin.basten\AppData\Local\temp\OCS\ocs_v7f.exe (PUP.Optional.DownloadSponsor.A) -> Keine Aktion durchgeführt.

(Ende)
         
So,
abendlichen Scan durchgeführt und alles sieht gut aus!

System schnurrt wie ein Kätzchen.

Vielen vielen Dank nochmal. ABO kann gelöscht werden!

Antwort

Themen zu Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9
4d36e972-e325-11ce-bfc1-08002be10318, antivir, antivirus, chromium, continue, entfernen, farbar, farbar recovery scan tool, flash player, homepage, icreinstall, js/kryptik.ali, minidump, mipony, nicht möglich, plug-in, programm, pum.hijack.homepagecontrol, pup.bprotector, pup.optional.1clickdownload.a, pup.optional.babsolution.a, pup.optional.babylon.a, pup.optional.babylontoolbar.a, pup.optional.bprotector.a, pup.optional.datamngr.a, pup.optional.dealply.a, pup.optional.delta.a, pup.optional.digitalsite.a, pup.optional.filescout.a, software, spyware, svchost.exe, system, windows, ändern



Ähnliche Themen: Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9


  1. Fehlercode 0x8007042c Windows & GData-Firewall starten nicht
    Antiviren-, Firewall- und andere Schutzprogramme - 26.08.2015 (160)
  2. Windows 7 Firewall startet nicht - Fehlercode 0x8007042c
    Plagegeister aller Art und deren Bekämpfung - 21.05.2015 (12)
  3. Windows 7: Snap-In "Windows-Firewall mit erweiterter Sicherheit" Fehlercode 0x6D9
    Plagegeister aller Art und deren Bekämpfung - 28.03.2015 (15)
  4. Windows Firewall nicht bedienbar, Fehlercode: 0x6D9
    Antiviren-, Firewall- und andere Schutzprogramme - 06.02.2015 (1)
  5. Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9
    Log-Analyse und Auswertung - 07.01.2015 (7)
  6. Windows Firewall startet nicht - Fehlercode 0x8007042c
    Log-Analyse und Auswertung - 29.12.2014 (13)
  7. Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424
    Plagegeister aller Art und deren Bekämpfung - 30.04.2014 (28)
  8. Windows 7: Windows Firewall nicht aktivierbar, Fehlercode: 0x6D9
    Log-Analyse und Auswertung - 19.10.2013 (13)
  9. Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9
    Mülltonne - 18.10.2013 (0)
  10. Windows Firewall lässt sich nicht aktivieren fehlercode 0x80070424
    Plagegeister aller Art und deren Bekämpfung - 29.09.2013 (26)
  11. Windows Firewall lässt sich nicht aktivieren. Fehlercode 0x80070424
    Log-Analyse und Auswertung - 05.08.2013 (13)
  12. Windows XP Updates nicht mehr möglich /Windows Firewall ist immer beim Start deaktiviert
    Antiviren-, Firewall- und andere Schutzprogramme - 26.05.2013 (82)
  13. Windows 7 Firewall funktioniert nicht mehr Fehlercode 0x80070424
    Log-Analyse und Auswertung - 09.12.2012 (12)
  14. Windows-Sicherheitscenter kann nicht aktiviert werden und Windows-Firewall Fehlercode 0x80070424
    Log-Analyse und Auswertung - 17.10.2012 (27)
  15. Windows Firewall/Defender reagieren nicht Fehlercode 0x80070424
    Plagegeister aller Art und deren Bekämpfung - 05.10.2012 (5)
  16. Firewall Fehlercode 0x80070424,Microsoft Security Essentials deaktiviert,kann nicht gestartet werden
    Plagegeister aller Art und deren Bekämpfung - 11.07.2012 (1)
  17. Windows Firewall funktionier nicht Fehlercode 0x80070424
    Log-Analyse und Auswertung - 10.02.2012 (5)

Zum Thema Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 - Hallo zusammen, ich habe oben genanntes Problem. Ich nutze den Rechner beruflisch und Privat und bin viel auf Reisen. Wahrscheinlich enstanden nach der Nutzung eines Memory-Sticks diese Probleme. Zumindestens ist - Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9...
Archiv
Du betrachtest: Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.