BKA-Trojaner, fährt bei abgesichertem Modus runter

Duzmichruhig · 18.11.2013, 17:28

Servus, der Herr Vater hat seinen Rechner verseucht, hier die Logdatei

ï»¿Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013 02
Ran by SYSTEM on MININT-PP5QROO on 18-11-2013 17:21:15
Running from H:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Winlogon: [Userinit] C:\WINDOWS\system32\userinit.exe
HKLM-x32\...\Run: [hpsysdrv] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [KBD] - C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.exe [12288 2008-07-21] (Microsoft)
HKLM-x32\...\Run: [KMCONFIG] - C:\Program Files (x86)\Silvercrest MTS2218 driver\StartAutorun.exe KMConfig.exe
HKLM-x32\...\Run: [Launch SilverCrest MTS2219-SL-K] - C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\KbClient_FD2.exe [1424384 2010-09-03] (Siliten)
HKLM-x32\...\Run: [Launch SilverCrest MTS2219-SL-M] - C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\MouClient_FD2.exe [860672 2010-09-03] (Siliten)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\Cyberlink\LabelPrint\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\Cyberlink\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDIRShortCut] - C:\Program Files (x86)\Cyberlink\PowerDirector\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\Cyberlink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe [210216 2009-02-02] (CyberLink Corp.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1561768 2012-05-04] (Ask)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Willi\...\Winlogon: [Shell] explorer.exe,C:\Users\Willi\AppData\Roaming\Other.res [147456 2013-08-02] () <==== ATTENTION
AppInit_DLLs-x32: c:\progra~3\browse~1\23796~1.11\{16cdf~1\browse~1.dll [ ] ()
Startup: C:\Users\Willi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S2 KMWDSERVICE; C:\Program Files (x86)\Silvercrest MTS2218 driver\KMWDSrv.exe [208896 2008-05-30] (UASSOFT.COM)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [1524824 2013-10-23] (Symantec Corporation)
S1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-17] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20131115.001\IDSvia64.sys [521816 2013-10-28] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20131115.017\ENG64.SYS [126040 2013-11-08] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20131115.017\EX64.SYS [2099288 2013-11-08] (Symantec Corporation)
S3 OV550I; C:\Windows\System32\Drivers\ov550ivx.sys [196992 2008-02-21] (Omnivision Technologies, Inc.)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
S1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2009-08-26] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
S3 SYMFW; \SystemRoot\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [x]
S3 SYMNDISV; \SystemRoot\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-11-18 17:21 - 2013-11-18 17:21 - 00000000 ____D C:\FRST
2013-11-16 11:49 - 2013-11-17 18:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 13:22 - 2013-11-14 13:22 - 00000000 ____D C:\Windows\Panther
2013-11-14 12:05 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-14 12:05 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-14 12:05 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-14 12:05 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-14 12:05 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 12:05 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 12:05 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-14 12:05 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 12:05 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-14 12:05 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 07:33 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-11-14 07:33 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 07:33 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2013-11-14 07:33 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-11-14 07:33 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 07:33 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2013-11-14 07:32 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\System32\nshwfp.dll
2013-11-14 07:32 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-11-14 07:32 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-11-14 07:32 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 07:32 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 07:32 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-11-14 07:32 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 07:32 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2013-11-14 07:32 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-11-14 07:32 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2013-11-14 07:32 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2013-11-14 07:32 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-11-14 07:32 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-11-14 07:32 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2013-11-14 07:32 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 07:32 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 07:32 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 07:32 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-10-23 08:42 - 2013-11-18 13:26 - 00203224 _____ C:\Windows\setupact.log
2013-10-23 08:42 - 2013-10-23 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 15:10 - 2013-10-20 15:10 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 15:10 - 2013-10-08 06:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-20 15:10 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-20 15:10 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-20 15:10 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-20 15:09 - 2013-10-20 15:10 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log

==================== One Month Modified Files and Folders =======

2013-11-18 17:21 - 2013-11-18 17:21 - 00000000 ____D C:\FRST
2013-11-18 13:26 - 2013-10-23 08:42 - 00203224 _____ C:\Windows\setupact.log
2013-11-18 13:26 - 2010-01-18 15:55 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-18 13:26 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-18 10:39 - 2012-04-13 11:33 - 01367745 _____ C:\Windows\WindowsUpdate.log
2013-11-18 10:39 - 2010-01-19 16:42 - 00014880 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-18 10:39 - 2010-01-19 16:42 - 00014880 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-18 10:37 - 2010-01-18 15:55 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-18 10:36 - 2009-07-14 18:58 - 00654150 _____ C:\Windows\System32\perfh007.dat
2013-11-18 10:36 - 2009-07-14 18:58 - 00130022 _____ C:\Windows\System32\perfc007.dat
2013-11-18 10:36 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\System32\FxsTmp
2013-11-18 10:36 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI
2013-11-18 10:33 - 2012-04-13 11:00 - 00000000 ____D C:\users\Willi
2013-11-17 18:50 - 2013-11-16 11:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-17 18:50 - 2012-05-09 22:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 18:50 - 2009-12-24 15:25 - 00000000 ____D C:\Users\Willi\AppData\Roaming\vlc
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-17 18:50 - 2009-05-19 05:54 - 00000000 ____D C:\ProgramData\Norton
2013-11-17 16:13 - 2013-08-15 21:41 - 00000000 ____D C:\Windows\System32\MRT
2013-11-16 16:39 - 2010-01-19 12:11 - 00000000 _____ C:\Users\Willi\AppData\Roaming\wklnhst.dat
2013-11-16 16:23 - 2013-03-15 18:30 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-16 12:46 - 2010-01-19 17:34 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{6587D8B7-C844-481A-8772-26373D901CB6}
2013-11-15 17:01 - 2010-08-30 13:58 - 00000448 ____H C:\Windows\Tasks\Norton Security Scan for Willi.job
2013-11-14 13:33 - 2012-04-13 11:57 - 00000099 _____ C:\Users\Public\LMDebug.log
2013-11-14 13:26 - 2012-09-14 18:44 - 00012754 _____ C:\Users\Willi\Desktop\Notizen.odt
2013-11-14 13:23 - 2013-05-26 19:19 - 00010107 _____ C:\Users\Willi\Desktop\erledigen.odt
2013-11-14 13:22 - 2013-11-14 13:22 - 00000000 ____D C:\Windows\Panther
2013-11-14 12:03 - 2012-04-13 12:37 - 82896128 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-11-05 12:10 - 2012-02-28 22:02 - 00094208 _____ C:\Users\Willi\Desktop\buch.xls
2013-11-01 10:35 - 2013-10-16 19:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 21:20 - 2010-08-26 17:17 - 00003188 _____ C:\Windows\System32\Tasks\HPCeeScheduleForWilli
2013-10-30 21:20 - 2010-08-26 17:17 - 00000334 _____ C:\Windows\Tasks\HPCeeScheduleForWilli.job
2013-10-28 17:32 - 2012-07-12 20:42 - 00000000 ____D C:\Users\Willi\AppData\Local\CrashDumps
2013-10-23 08:42 - 2013-10-23 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 15:10 - 2013-10-20 15:10 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 15:10 - 2013-10-20 15:09 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-20 15:10 - 2013-06-22 08:38 - 00000000 ____D C:\Program Files (x86)\Java

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

40
Restore point made on: 2013-04-28 17:23:44
Restore point made on: 2013-05-11 17:15:27
Restore point made on: 2013-05-16 18:27:02
Restore point made on: 2013-05-16 18:35:49
Restore point made on: 2013-05-16 21:57:38
Restore point made on: 2013-05-30 18:00:01
Restore point made on: 2013-06-07 17:30:57
Restore point made on: 2013-06-12 21:17:11
Restore point made on: 2013-06-16 22:25:40
Restore point made on: 2013-06-17 15:39:49
Restore point made on: 2013-06-18 02:00:39
Restore point made on: 2013-06-22 08:37:58
Restore point made on: 2013-07-01 20:47:12
Restore point made on: 2013-07-09 12:26:41
Restore point made on: 2013-07-11 22:03:37
Restore point made on: 2013-07-18 23:11:55
Restore point made on: 2013-07-26 15:23:12
Restore point made on: 2013-07-29 20:20:52
Restore point made on: 2013-08-06 10:43:04
Restore point made on: 2013-08-13 17:11:38
Restore point made on: 2013-08-15 21:40:12
Restore point made on: 2013-08-23 18:49:48
Restore point made on: 2013-09-03 18:17:05
Restore point made on: 2013-09-10 23:00:31
Restore point made on: 2013-09-12 02:00:36
Restore point made on: 2013-09-12 22:01:28
Restore point made on: 2013-09-17 19:52:22
Restore point made on: 2013-09-25 10:24:17
Restore point made on: 2013-10-02 11:45:09
Restore point made on: 2013-10-08 18:13:02
Restore point made on: 2013-10-08 18:13:23
Restore point made on: 2013-10-08 18:17:49
Restore point made on: 2013-10-09 21:38:00
Restore point made on: 2013-10-20 15:09:24
Restore point made on: 2013-10-29 15:20:27
Restore point made on: 2013-11-06 08:18:10
Restore point made on: 2013-11-14 11:05:16
Restore point made on: 2013-11-14 12:03:03
Restore point made on: 2013-11-16 16:49:06
Restore point made on: 2013-11-17 16:12:19

==================== Memory info ===========================

Percentage of memory in use: 14%
Total physical RAM: 4095.18 MB
Available physical RAM: 3504.52 MB
Total Pagefile: 4093.33 MB
Available Pagefile: 3483.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: (COMPAQ) (Fixed) (Total:305.61 GB) (Free:177.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Festplatte) (Fixed) (Total:276.02 GB) (Free:177.44 GB) NTFS
Drive e: (FACTORY_IMAGE) (Fixed) (Total:14.53 GB) (Free:2.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (Software) (CDROM) (Total:0.11 GB) (Free:0 GB) CDFS
Drive h: (USB-STICK) (Removable) (Total:7.45 GB) (Free:7.45 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=306 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=276 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 1CB57BDF)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

LastRegBack: 2013-11-10 19:16

==================== End Of Log ============================

Danke schon mal für Eure Hilfe.

aharonov · 18.11.2013, 17:46

Hi,

startet die Kiste wieder normal nach folgendem Fix?

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\Willi\...\Winlogon: [Shell] explorer.exe,C:\Users\Willi\AppData\Roaming\Other.res [147456 2013-08-02] () <==== ATTENTION 
C:\Users\Willi\AppData\Roaming\Other.res

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Duzmichruhig · 18.11.2013, 17:51

Hy, hier die Fix: (er ist jetzt normal oben und scheint auch stabil zu sein)

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-11-2013 02
Ran by SYSTEM at 2013-11-18 17:50:32 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKU\Willi\...\Winlogon: [Shell] explorer.exe,C:\Users\Willi\AppData\Roaming\Other.res [147456 2013-08-02] () <==== ATTENTION
C:\Users\Willi\AppData\Roaming\Other.res

*****************

HKU\Willi\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Users\Willi\AppData\Roaming\Other.res => Moved successfully.

==== End of Fixlog ====

aharonov · 18.11.2013, 17:52

Dann wieder in den normalen Modus starten und dort neu scannen:

Verschiebe die frst64.exe vom USB-Stick auf den Desktop.

Starte dann FRST.
Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.

Duzmichruhig · 18.11.2013, 18:00

Hey,

ï»¿
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013 02
Ran by Willi (administrator) on WILLI-PC on 18-11-2013 17:58:11
Running from C:\Users\Willi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMWDSrv.exe
(Hewlett-Packard Company) c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\StartAutorun.exe
(Siliten) C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\KbClient_FD2.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMConfig.exe
(Siliten) C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\MouClient_FD2.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMProcess.exe
(CyberLink) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(CyberLink Corp.) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\symerr.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\KBD\kbd.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Winlogon: [Userinit] C:\WINDOWS\system32\userinit.exe
MountPoints2: {e0fffd72-770b-11de-9472-806e6f6e6963} - E:\autorun.exe
HKLM-x32\...\Run: [hpsysdrv] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [KBD] - C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.exe [12288 2008-07-21] (Microsoft)
HKLM-x32\...\Run: [KMCONFIG] - C:\Program Files (x86)\Silvercrest MTS2218 driver\StartAutorun.exe KMConfig.exe
HKLM-x32\...\Run: [Launch SilverCrest MTS2219-SL-K] - C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\KbClient_FD2.exe [1424384 2010-09-03] (Siliten)
HKLM-x32\...\Run: [Launch SilverCrest MTS2219-SL-M] - C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\MouClient_FD2.exe [860672 2010-09-03] (Siliten)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\Cyberlink\LabelPrint\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\Cyberlink\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDIRShortCut] - C:\Program Files (x86)\Cyberlink\PowerDirector\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\Cyberlink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe [210216 2009-02-02] (CyberLink Corp.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1561768 2012-05-04] (Ask)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
AppInit_DLLs-x32: c:\progra~3\browse~1\23796~1.11\{16cdf~1\browse~1.dll [ ] ()
Startup: C:\Users\Willi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=93&bd=Presario&pf=cndt
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=110824&tt=4212_2&babsrc=HP_ss&mntrId=86ed29740000000000000026180e69b4
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - DefaultScope {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM-x32 - DefaultScope {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM-x32 - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM-x32 - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM-x32 - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - DefaultScope {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110824&tt=4212_2&babsrc=SP_ss&mntrId=86ed29740000000000000026180e69b4
SearchScopes: HKCU - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {5AE612B1-2BCD-478E-AC38-FA47CA3138FA} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=6421419A-6C72-478F-9B9A-11BBC7030DC9&apn_sauid=B885066A-EF97-4256-A0AC-4615AB7323FD
SearchScopes: HKCU - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=20&locale=de_DE&gct=kwd&qsrc=2869
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52272 2009-05-19] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default
FF user.js: detected! => C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\user.js
FF Homepage: hxxp://www.google.de/ig
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\safesearch.xml
FF SearchPlugin: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\WebSearch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: LavaFox V2-Blue - C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\Extensions\djziggy@gmail.com
FF Extension: No Name - C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [ntfdsaftsfdfdxx@mozilla.org] - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_firefox.xpi
FF Extension: No Name - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_firefox.xpi
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFF

Chrome: 
=======
CHR HomePage: hxxp://websearch.oversearch.info/?pid=969&r=2013/09/17&hid=8392900373862859251&lg=EN&cc=DE&unqvl=36
CHR RestoreOnStartup: 		"urls_to_restore_on_startup": [
CHR Extension: (Browse2save) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbofdekhceiophbojfilglehgciieapk\1
CHR Extension: (saVenashare ) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibimjopifbpdgllmenfbedjhifpbfbij\5.10
CHR Extension: (Plus-HD-2.2) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfakeonomonapccoamcmdgpoaicnpnoo\1.23.10_0
CHR Extension: (SearchNewTab) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\legepjmdalkoddjgaplaipoclplbhbcl\1.0
CHR Extension: (PricePeep) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb\2.1.0.22_0
CHR HKLM-x32\...\Chrome\Extension: [gkjoindjjcmbdpbfppabdgflnkgbbcli] - C:\Program Files (x86)\FTDownloader.com\FTDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [kekfoodhbhpjhjcdecjngamojfhknooc] - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.crx

==================== Services (Whitelisted) =================

R2 KMWDSERVICE; C:\Program Files (x86)\Silvercrest MTS2218 driver\KMWDSrv.exe [208896 2008-05-30] (UASSOFT.COM)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [1524824 2013-10-23] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-17] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20131115.001\IDSvia64.sys [521816 2013-10-28] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20131115.017\ENG64.SYS [126040 2013-11-08] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20131115.017\EX64.SYS [2099288 2013-11-08] (Symantec Corporation)
S3 OV550I; C:\Windows\System32\Drivers\ov550ivx.sys [196992 2008-02-21] (Omnivision Technologies, Inc.)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
S1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2009-08-26] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
S3 SYMFW; \SystemRoot\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [x]
S3 SYMNDISV; \SystemRoot\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-18 17:58 - 2013-11-18 17:58 - 00016763 _____ C:\Users\Willi\Desktop\FRST.txt
2013-11-18 17:57 - 2013-11-18 14:33 - 01958026 _____ (Farbar) C:\Users\Willi\Desktop\FRST64.exe
2013-11-18 17:21 - 2013-11-18 17:21 - 00000000 ____D C:\FRST
2013-11-16 11:49 - 2013-11-17 18:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 13:22 - 2013-11-14 13:22 - 00000000 ____D C:\Windows\Panther
2013-11-14 12:05 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 12:05 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 12:05 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 12:05 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-14 12:05 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 12:05 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 12:05 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 12:05 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 12:05 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-14 12:05 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 07:33 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 07:33 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 07:33 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 07:33 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 07:33 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 07:33 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-14 07:32 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 07:32 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 07:32 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 07:32 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 07:32 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 07:32 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 07:32 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 07:32 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 07:32 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 07:32 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 07:32 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 07:32 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 07:32 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 07:32 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 07:32 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 07:32 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 07:32 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 07:32 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-10-23 08:42 - 2013-11-18 17:52 - 00210482 _____ C:\Windows\setupact.log
2013-10-23 08:42 - 2013-10-23 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 15:10 - 2013-10-20 15:10 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 15:10 - 2013-10-08 06:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-20 15:10 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-20 15:10 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-20 15:10 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-20 15:09 - 2013-10-20 15:10 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log

==================== One Month Modified Files and Folders =======

2013-11-18 17:58 - 2013-11-18 17:58 - 00016763 _____ C:\Users\Willi\Desktop\FRST.txt
2013-11-18 17:56 - 2012-04-13 11:33 - 01396250 _____ C:\Windows\WindowsUpdate.log
2013-11-18 17:55 - 2010-01-19 17:34 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{6587D8B7-C844-481A-8772-26373D901CB6}
2013-11-18 17:52 - 2013-10-23 08:42 - 00210482 _____ C:\Windows\setupact.log
2013-11-18 17:52 - 2010-01-18 15:55 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-18 17:52 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-18 17:21 - 2013-11-18 17:21 - 00000000 ____D C:\FRST
2013-11-18 14:33 - 2013-11-18 17:57 - 01958026 _____ (Farbar) C:\Users\Willi\Desktop\FRST64.exe
2013-11-18 10:39 - 2010-01-19 16:42 - 00014880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-18 10:39 - 2010-01-19 16:42 - 00014880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-18 10:37 - 2010-01-18 15:55 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-18 10:36 - 2009-07-14 18:58 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-11-18 10:36 - 2009-07-14 18:58 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-11-18 10:36 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-18 10:36 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-18 10:33 - 2012-04-13 11:00 - 00000000 ____D C:\Users\Willi
2013-11-17 18:50 - 2013-11-16 11:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-17 18:50 - 2012-05-09 22:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 18:50 - 2009-12-24 15:25 - 00000000 ____D C:\Users\Willi\AppData\Roaming\vlc
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-17 18:50 - 2009-05-19 05:54 - 00000000 ____D C:\ProgramData\Norton
2013-11-17 16:14 - 2013-08-15 21:41 - 00000000 ____D C:\Windows\system32\MRT
2013-11-16 16:39 - 2010-01-19 12:11 - 00000000 _____ C:\Users\Willi\AppData\Roaming\wklnhst.dat
2013-11-16 16:23 - 2013-03-15 18:30 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-15 17:01 - 2010-08-30 13:58 - 00000448 ____H C:\Windows\Tasks\Norton Security Scan for Willi.job
2013-11-14 13:33 - 2012-04-13 11:57 - 00000099 _____ C:\Users\Public\LMDebug.log
2013-11-14 13:26 - 2012-09-14 18:44 - 00012754 _____ C:\Users\Willi\Desktop\Notizen.odt
2013-11-14 13:23 - 2013-05-26 19:19 - 00010107 _____ C:\Users\Willi\Desktop\erledigen.odt
2013-11-14 13:22 - 2013-11-14 13:22 - 00000000 ____D C:\Windows\Panther
2013-11-14 12:03 - 2012-04-13 12:37 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-05 12:10 - 2012-02-28 22:02 - 00094208 _____ C:\Users\Willi\Desktop\buch.xls
2013-11-01 10:35 - 2013-10-16 19:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 21:20 - 2010-08-26 17:17 - 00003188 _____ C:\Windows\System32\Tasks\HPCeeScheduleForWilli
2013-10-30 21:20 - 2010-08-26 17:17 - 00000334 _____ C:\Windows\Tasks\HPCeeScheduleForWilli.job
2013-10-28 17:32 - 2012-07-12 20:42 - 00000000 ____D C:\Users\Willi\AppData\Local\CrashDumps
2013-10-23 08:42 - 2013-10-23 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 15:10 - 2013-10-20 15:10 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 15:10 - 2013-10-20 15:09 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-20 15:10 - 2013-06-22 08:38 - 00000000 ____D C:\Program Files (x86)\Java

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-10 19:16

==================== End Of Log ============================

--- --- ---

ï»¿FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2013 02
Ran by Willi at 2013-11-18 17:59:02
Running from C:\Users\Willi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Enabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

64 Bit HP CIO Components Installer (Version: 6.2.2)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0.1)
Activation Assistant for the 2007 Microsoft Office suites (x32)
Adobe Flash Player 10 ActiveX (x32 Version: 10.0.12.36)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe SVG Viewer 3.0 (x32 Version:  3.0)
ArcSoft PhotoImpression 6 (x32 Version: 6.1.8.146)
Ask Toolbar (x32 Version: 1.15.2.0)
Ask Toolbar Updater (HKCU Version: 1.2.1.23037)
Compatibility Pack fÃ¼r 2007 Office System (x32 Version: 12.0.6612.1000)
CyberLink DVD Suite Deluxe (x32 Version: 6.0.2602)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904)
DJ_SF_06_D1600_SW_Min (x32 Version: 140.0.690.000)
Foxit Reader (x32 Version: 3.1.4.1125)
Free Audio CD Burner version 1.2 (x32)
Free Media Pack (HKCU)
Free Media Pack Usenet.nl (x32)
FTDownloader (x32 Version: 2.1 Build 26473)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.165)
Hardwarediagnosetools (Version: 6.0.5205.31)
HP Customer Experience Enhancements (x32 Version: 5.7.0.2945)
HP Deskjet D1600 Printer Driver 14.0 Rel. 6 (Version: 14.0)
HP MediaSmart DVD (x32 Version: 3.0.3420)
HP MediaSmart Music/Photo/Video (x32 Version: 3.0.3228)
HP Picasso Media Center Add-In (x32 Version: 9.1.7.0)
HP Recovery Manager RSS (x32 Version: 92.0.0.11)
HP Total Care Setup (x32 Version: 1.2.2854.2975)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
LabelPrint (x32 Version: 2.5.1402)
LightScribe System Software (x32 Version: 1.18.3.2)
Magic Desktop (x32)
Malwarebytes Anti-Malware Version 1.62.0.1300 (x32 Version: 1.62.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Works (x32 Version: 9.7.0621)
Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 25.0.1)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Multimedia-EnzyklopÃ¤die (x32)
Norton Internet Security (x32 Version: 20.4.0.40)
Norton Security Scan (x32 Version: 3.5.1.8)
NVIDIA Drivers (Version: 1.3)
OpenOffice.org 3.1 (x32 Version: 3.1.9420)
Optimierte Multimedia-Tastatur-LÃ¶sung (x32 Version: 1.0.9.2)
OVTScanner_Vista64 (x32 Version: 1.00.0000)
Power2Go (x32 Version: 6.0.2602)
PowerDirector (x32 Version: 7.0.2611)
Python 2.6 pywin32-212 (x32 Version: 2.12)
Python 2.6.1 (x32 Version: 2.6.1150)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5882)
Registry Repair 4.1.0.388 (x32 Version: 4.1.0.388)
Samsung Easy Printer Manager (x32 Version: 1.00.62.00)
Samsung ML-1670 Series (x32)
Samsung Printer Live Update (x32)
Silvercrest MTS2218 driver (x32 Version: 5.09.04.21)
SilverCrest MTS2219-SL Driver (x32 Version: 1.0)
Toolbox (x32 Version: 140.0.428.000)
Uninstall 1.0.0.1 (x32)
VLC media player 1.1.7 (x32 Version: 1.1.7)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
WinRAR
Yontoo 1.10.03 (Version: 1.10.03)

==================== Restore Points  =========================

28-04-2013 16:23:23 Installed Java 7 Update 21
11-05-2013 16:10:29 Geplanter PrÃ¼fpunkt
16-05-2013 17:26:41 Wiederherstellungsvorgang
16-05-2013 17:34:59 Windows Update
16-05-2013 20:56:59 Windows Update
30-05-2013 16:59:45 Geplanter PrÃ¼fpunkt
07-06-2013 16:30:42 Geplanter PrÃ¼fpunkt
12-06-2013 20:16:58 Windows Update
16-06-2013 21:25:26 Windows Update
17-06-2013 14:39:31 Wiederherstellungsvorgang
18-06-2013 01:00:24 Windows Update
22-06-2013 07:37:41 Installed Java 7 Update 25
01-07-2013 19:47:03 Geplanter PrÃ¼fpunkt
09-07-2013 11:26:25 Geplanter PrÃ¼fpunkt
11-07-2013 21:03:13 Windows Update
18-07-2013 22:11:40 Geplanter PrÃ¼fpunkt
26-07-2013 14:22:56 Geplanter PrÃ¼fpunkt
29-07-2013 19:20:35 Wiederherstellungsvorgang
06-08-2013 09:42:55 Geplanter PrÃ¼fpunkt
13-08-2013 16:11:22 Geplanter PrÃ¼fpunkt
15-08-2013 20:39:57 Windows Update
23-08-2013 17:49:31 Geplanter PrÃ¼fpunkt
03-09-2013 17:16:49 Geplanter PrÃ¼fpunkt
10-09-2013 22:00:14 Geplanter PrÃ¼fpunkt
12-09-2013 01:00:28 Windows Update
12-09-2013 21:01:13 Windows Update
17-09-2013 18:51:57 Wiederherstellungsvorgang
25-09-2013 09:24:04 Geplanter PrÃ¼fpunkt
02-10-2013 10:44:52 Geplanter PrÃ¼fpunkt
08-10-2013 17:12:50 Installed OVTScanner_Vista64.
08-10-2013 17:13:17 Installed OVTScanner_Vista64.
08-10-2013 17:17:26 Installiert PhotoImpression
09-10-2013 20:37:52 Windows Update
20-10-2013 14:09:02 Installed Java 7 Update 45
29-10-2013 14:20:15 Geplanter PrÃ¼fpunkt
06-11-2013 07:17:56 Geplanter PrÃ¼fpunkt
14-11-2013 10:05:03 Geplanter PrÃ¼fpunkt
14-11-2013 11:02:58 Windows Update
16-11-2013 15:48:50 Wiederherstellungsvorgang
17-11-2013 15:11:40 Windows Update

==================== Hosts content: ==========================

2006-11-02 13:34 - 2006-09-18 22:37 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {0C739CE5-6B07-4166-A93D-C699B0422782} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {110EBD4B-0297-40C6-B6E2-A2F3C681F08F} - System32\Tasks\Games\UpdateCheck_S-1-5-21-3671571329-2275905496-885990249-1000
Task: {16869ED2-DD15-4BE8-845A-F073B38BD74F} - System32\Tasks\CLMLSvc => C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [2009-08-28] (CyberLink)
Task: {20F8AF39-59E7-4944-9656-2B4A5F7E4DD4} - System32\Tasks\DVDAgent => C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [2009-10-20] (CyberLink Corp.)
Task: {3C35140A-578B-4A33-BBD8-793AC8CCF62F} - System32\Tasks\HPCeeScheduleForWilli => C:\Program Files (x86)\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2009-02-24] (Hewlett-Packard)
Task: {5E3BECA9-4AC3-4ADB-87DE-8311A16853C1} - \SidebarExecute No Task File
Task: {69387679-F8A6-438C-A7CA-7E22C909C22C} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\wscstub.exe [2013-06-04] (Symantec Corporation)
Task: {712C6861-2B14-4E72-92BA-22B6921FE2B7} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {89AFA96B-19BF-43F5-9963-7FF59A2AD3C4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {A4C1BF27-697A-4CF4-8F18-910A76E70126} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-18] (Google Inc.)
Task: {B8537ED1-083F-4869-B999-2686D4355BBF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-18] (Google Inc.)
Task: {CAC5FE53-D35D-4D79-B98A-490BB5E07173} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-05-04] ()
Task: {DC59D859-1F13-4539-BA21-CD7AADABCC88} - System32\Tasks\Norton Security Scan for Willi => C:\PROGRA~2\NORTON~3\Engine\351~1.8\Nss.exe
Task: {E7F7550C-D3FA-46AE-8BBD-7D268037DC27} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {EACA307C-706A-4B5C-B38D-C5E3A31B6CBC} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\symerr.exe [2013-06-04] (Symantec Corporation)
Task: {EB4D4184-19B8-4C38-9D9D-31DF1D4A742D} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\symerr.exe [2013-06-04] (Symantec Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForWilli.job => C:\Program Files (x86)\Hewlett-Packard\SDP\Ceement\HPCEE.exe
Task: C:\Windows\Tasks\Norton Security Scan for Willi.job => C:\PROGRA~2\NORTON~3\Engine\351~1.8\Nss.exe

==================== Loaded Modules (whitelisted) =============

2011-02-26 13:41 - 2010-03-15 11:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2013-06-17 15:48 - 2012-05-30 07:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\20.4.0.40\wincfi39.dll
2009-08-18 15:54 - 2009-08-18 15:54 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2010-12-09 10:17 - 2010-09-03 14:31 - 00053248 _____ () C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\UniFunc.dll
2008-07-11 16:27 - 2008-07-11 16:27 - 00106496 _____ () C:\Program Files (x86)\Silvercrest MTS2218 driver\keydll.dll
2008-06-16 09:06 - 2008-06-16 09:06 - 00053248 _____ () C:\Program Files (x86)\Silvercrest MTS2218 driver\MouseHook.dll
2009-08-28 11:52 - 2009-08-28 11:52 - 00931112 _____ () c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Symantec Network Security Intermediate Filter Driver
Description: Symantec Network Security Intermediate Filter Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: SymIM
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/18/2013 05:53:56 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/18/2013 10:35:18 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 06:35:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 06:30:56 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a144
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005132a
ID des fehlerhaften Prozesses: 0xa98
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (11/17/2013 06:28:21 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.


Details:
Could not query the status of the EventSystem service.

System Error:
Der Computer wird heruntergefahren.
.

Error: (11/17/2013 04:09:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 04:06:43 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 04:05:22 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a144
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005175a
ID des fehlerhaften Prozesses: 0xa48
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (11/17/2013 00:50:34 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 00:47:22 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (11/18/2013 05:52:31 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SymIM

Error: (11/18/2013 01:26:03 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SymIM

Error: (11/18/2013 10:40:31 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SymIM

Error: (11/18/2013 10:34:00 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SymIM

Error: (11/17/2013 06:39:07 PM) (Source: DCOM) (User: )
Description: 1084ShellHWDetection{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhÃ¤ngig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhÃ¤ngig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhÃ¤ngig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhÃ¤ngig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhÃ¤ngig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================
Error: (11/18/2013 05:53:56 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/18/2013 10:35:18 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 06:35:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 06:30:56 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175144ce7a144ntdll.dll6.1.7601.1822951fb164ac0000005000000000005132aa9801cee3babf64e1ecC:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll0378e4ab-4fae-11e3-9e72-0026180e69b4

Error: (11/17/2013 06:28:21 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
Could not query the status of the EventSystem service.

System Error:
Der Computer wird heruntergefahren.

Error: (11/17/2013 04:09:26 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 04:06:43 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 04:05:22 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175144ce7a144ntdll.dll6.1.7601.1822951fb164ac0000005000000000005175aa4801cee3a66bfad762C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dlladc2e63d-4f99-11e3-a7ad-0026180e69b4

Error: (11/17/2013 00:50:34 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 00:47:22 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2012-07-12 20:31:59.498
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.480
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.463
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.443
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.424
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.404
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.385
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.367
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.349
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.331
  Description: Die AbbildintegritÃ¤t der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht Ã¼berprÃ¼ft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 39%
Total physical RAM: 4095.18 MB
Available physical RAM: 2468 MB
Total Pagefile: 8188.54 MB
Available Pagefile: 6443.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (COMPAQ) (Fixed) (Total:305.61 GB) (Free:177.43 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:14.53 GB) (Free:2.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Software) (CDROM) (Total:0.11 GB) (Free:0 GB) CDFS
Drive g: (Festplatte) (Fixed) (Total:276.02 GB) (Free:177.44 GB) NTFS
Drive i: (USB-STICK) (Removable) (Total:7.45 GB) (Free:7.45 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=306 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=276 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 1CB57BDF)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================

--- --- ---

aharonov · 18.11.2013, 18:10

Ok.

Schritt 1

Gehe zu Start --> Systemsteuerung und öffne Programme und Funktionen.
Suche und deinstalliere dort der Reihe nach folgende Einträge:
Ask Toolbar
Ask Toolbar Updater
Yontoo 1.10.03
Schliesse das Fenster wieder und führe einen Neustart durch, wenn das gefordert wurde.

Schritt 2

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Log von AdwCleaner
Log von FRST

Duzmichruhig · 18.11.2013, 18:20

Sodele:
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.012 - Bericht erstellt am 18/11/2013 um 18:16:06
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Willi - WILLI-PC
# Gestartet von : G:\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BrowserProtect
Ordner Gelöscht : C:\ProgramData\RightClick
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\saVenashare
Ordner Gelöscht : C:\ProgramData\SearchNewTab
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DownTango
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Protected Search
Ordner Gelöscht : C:\Program Files (x86)\CertifiedToolbar
Ordner Gelöscht : C:\Program Files (x86)\ExpressFiles
Ordner Gelöscht : C:\Program Files (x86)\EZDownloader
Ordner Gelöscht : C:\Program Files (x86)\FTDownloader.com
Ordner Gelöscht : C:\Program Files (x86)\LyricsTube
Ordner Gelöscht : C:\Program Files (x86)\optimizer pro
Ordner Gelöscht : C:\Program Files (x86)\Plus-HD-2.2
Ordner Gelöscht : C:\Program Files (x86)\Protected Search
Ordner Gelöscht : C:\Program Files (x86)\Red Sky
Ordner Gelöscht : C:\Program Files (x86)\SingAlong
Ordner Gelöscht : C:\Users\Willi\AppData\Local\DownTango
Ordner Gelöscht : C:\Users\Willi\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Willi\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\Willi\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Willi\AppData\LocalLow\CertifiedToolbar
Ordner Gelöscht : C:\Users\Willi\AppData\LocalLow\ShopperReports3
Ordner Gelöscht : C:\Users\Willi\AppData\LocalLow\SimplyTech
Ordner Gelöscht : C:\Users\Willi\AppData\Roaming\BabSolution
Ordner Gelöscht : C:\Users\Willi\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Willi\AppData\Roaming\CertifiedToolbar
Ordner Gelöscht : C:\Users\Willi\AppData\Roaming\ExpressFiles
Ordner Gelöscht : C:\Users\Willi\AppData\Roaming\EZDownloader
Ordner Gelöscht : C:\Users\Willi\AppData\Roaming\optimizer pro
Ordner Gelöscht : C:\Users\Willi\AppData\Roaming\WebCake
Ordner Gelöscht : C:\Users\Willi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FTDownloader.com
Ordner Gelöscht : C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfakeonomonapccoamcmdgpoaicnpnoo
Ordner Gelöscht : C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb
[!] Ordner Gelöscht : C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfakeonomonapccoamcmdgpoaicnpnoo
Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gelöscht : C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\safesearch.xml
Datei Gelöscht : C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\WebSearch.xml
Datei Gelöscht : C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\user.js
Datei Gelöscht : C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences
Datei Gelöscht : C:\Windows\System32\Tasks\ProtectedSearch

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\babylon.com
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\FTDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FTDownloader_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FTDownloader_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKCU\Software\5308b8db635eb45
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\DataMngr
[#] Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16736

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v25.0.1 (de)

[ Datei : C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.id", "86ed29740000000000000026180e69b4");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15632");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "tb9");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=86ed29740000000000000026180e69b4&q=");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.812:39:49");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1403ba7d24608471b7ab3ed9a63d9d3f");

-\\ Google Chrome v

[ Datei : C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht : homepage
Gelöscht : urls_to_restore_on_startup

*************************

AdwCleaner[R0].txt - [8993 octets] - [18/11/2013 18:14:05]
AdwCleaner[S0].txt - [8267 octets] - [18/11/2013 18:16:06]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8327 octets] ##########

--- --- ---

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013 02
Ran by Willi (administrator) on WILLI-PC on 18-11-2013 18:19:52
Running from C:\Users\Willi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMWDSrv.exe
(Hewlett-Packard Company) c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Microsoft) C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\StartAutorun.exe
(Siliten) C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\KbClient_FD2.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMConfig.exe
(Siliten) C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\MouClient_FD2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMProcess.exe
(CyberLink) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(CyberLink Corp.) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Winlogon: [Userinit] C:\WINDOWS\system32\userinit.exe
MountPoints2: {e0fffd72-770b-11de-9472-806e6f6e6963} - E:\autorun.exe
HKLM-x32\...\Run: [hpsysdrv] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [KBD] - C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.exe [12288 2008-07-21] (Microsoft)
HKLM-x32\...\Run: [KMCONFIG] - C:\Program Files (x86)\Silvercrest MTS2218 driver\StartAutorun.exe KMConfig.exe
HKLM-x32\...\Run: [Launch SilverCrest MTS2219-SL-K] - C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\KbClient_FD2.exe [1424384 2010-09-03] (Siliten)
HKLM-x32\...\Run: [Launch SilverCrest MTS2219-SL-M] - C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\MouClient_FD2.exe [860672 2010-09-03] (Siliten)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\Cyberlink\LabelPrint\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\Cyberlink\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDIRShortCut] - C:\Program Files (x86)\Cyberlink\PowerDirector\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\Cyberlink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe [210216 2009-02-02] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
AppInit_DLLs-x32: c:\progra~3\browse~1\23796~1.11\{16cdf~1\browse~1.dll [ ] ()
Startup: C:\Users\Willi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=93&bd=Presario&pf=cndt
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKLM - DefaultScope {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM-x32 - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM-x32 - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM-x32 - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKCU - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {5AE612B1-2BCD-478E-AC38-FA47CA3138FA} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=6421419A-6C72-478F-9B9A-11BBC7030DC9&apn_sauid=B885066A-EF97-4256-A0AC-4615AB7323FD
SearchScopes: HKCU - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52272 2009-05-19] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default
FF Homepage: hxxp://www.google.de/ig
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: LavaFox V2-Blue - C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\Extensions\djziggy@gmail.com
FF Extension: No Name - C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [ntfdsaftsfdfdxx@mozilla.org] - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_firefox.xpi
FF Extension: No Name - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_firefox.xpi
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: 		"urls_to_restore_on_startup": [
CHR Extension: (Browse2save) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbofdekhceiophbojfilglehgciieapk\1
CHR Extension: (saVenashare ) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibimjopifbpdgllmenfbedjhifpbfbij\5.10
CHR Extension: (SearchNewTab) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\legepjmdalkoddjgaplaipoclplbhbcl\1.0
CHR HKLM-x32\...\Chrome\Extension: [gkjoindjjcmbdpbfppabdgflnkgbbcli] - C:\Program Files (x86)\FTDownloader.com\FTDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [kekfoodhbhpjhjcdecjngamojfhknooc] - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx

==================== Services (Whitelisted) =================

R2 KMWDSERVICE; C:\Program Files (x86)\Silvercrest MTS2218 driver\KMWDSrv.exe [208896 2008-05-30] (UASSOFT.COM)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [1524824 2013-10-23] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-17] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20131115.001_ac4\IDSvia64.sys [521816 2013-11-15] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20131118.002\ENG64.SYS [126040 2013-11-18] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20131118.002\EX64.SYS [2099288 2013-11-18] (Symantec Corporation)
S3 OV550I; C:\Windows\System32\Drivers\ov550ivx.sys [196992 2008-02-21] (Omnivision Technologies, Inc.)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
S1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2009-08-26] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
S3 SYMFW; \SystemRoot\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [x]
S3 SYMNDISV; \SystemRoot\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-18 18:19 - 2013-11-18 18:19 - 00013942 _____ C:\Users\Willi\Desktop\FRST.txt
2013-11-18 18:19 - 2013-11-18 18:19 - 00008411 _____ C:\Users\Willi\Desktop\ADWCleaner.txt
2013-11-18 18:14 - 2013-11-18 18:19 - 00000000 ____D C:\AdwCleaner
2013-11-18 17:57 - 2013-11-18 14:33 - 01958026 _____ (Farbar) C:\Users\Willi\Desktop\FRST64.exe
2013-11-18 17:21 - 2013-11-18 17:21 - 00000000 ____D C:\FRST
2013-11-16 11:49 - 2013-11-17 18:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 13:22 - 2013-11-14 13:22 - 00000000 ____D C:\Windows\Panther
2013-11-14 12:05 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 12:05 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 12:05 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 12:05 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-14 12:05 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 12:05 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 12:05 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 12:05 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 12:05 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-14 12:05 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 07:33 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 07:33 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 07:33 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 07:33 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 07:33 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 07:33 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-14 07:32 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 07:32 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 07:32 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 07:32 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 07:32 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 07:32 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 07:32 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 07:32 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 07:32 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 07:32 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 07:32 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 07:32 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 07:32 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 07:32 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 07:32 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 07:32 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 07:32 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 07:32 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-10-23 08:42 - 2013-11-18 18:19 - 00217740 _____ C:\Windows\setupact.log
2013-10-23 08:42 - 2013-10-23 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 15:10 - 2013-10-20 15:10 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 15:10 - 2013-10-08 06:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-20 15:10 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-20 15:10 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-20 15:10 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-20 15:09 - 2013-10-20 15:10 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log

==================== One Month Modified Files and Folders =======

2013-11-18 18:19 - 2013-11-18 18:19 - 00013942 _____ C:\Users\Willi\Desktop\FRST.txt
2013-11-18 18:19 - 2013-11-18 18:19 - 00008411 _____ C:\Users\Willi\Desktop\ADWCleaner.txt
2013-11-18 18:19 - 2013-11-18 18:14 - 00000000 ____D C:\AdwCleaner
2013-11-18 18:19 - 2013-10-23 08:42 - 00217740 _____ C:\Windows\setupact.log
2013-11-18 18:19 - 2010-01-18 15:55 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-18 18:19 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-18 18:18 - 2012-04-13 11:33 - 01396875 _____ C:\Windows\WindowsUpdate.log
2013-11-18 17:59 - 2010-01-19 16:42 - 00014880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-18 17:59 - 2010-01-19 16:42 - 00014880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-18 17:59 - 2009-07-14 18:58 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-11-18 17:59 - 2009-07-14 18:58 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-11-18 17:59 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-18 17:55 - 2010-01-19 17:34 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{6587D8B7-C844-481A-8772-26373D901CB6}
2013-11-18 17:21 - 2013-11-18 17:21 - 00000000 ____D C:\FRST
2013-11-18 14:33 - 2013-11-18 17:57 - 01958026 _____ (Farbar) C:\Users\Willi\Desktop\FRST64.exe
2013-11-18 10:37 - 2010-01-18 15:55 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-18 10:36 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-18 10:33 - 2012-04-13 11:00 - 00000000 ____D C:\Users\Willi
2013-11-17 18:50 - 2013-11-16 11:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-17 18:50 - 2012-05-09 22:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 18:50 - 2009-12-24 15:25 - 00000000 ____D C:\Users\Willi\AppData\Roaming\vlc
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-17 18:50 - 2009-05-19 05:54 - 00000000 ____D C:\ProgramData\Norton
2013-11-17 16:14 - 2013-08-15 21:41 - 00000000 ____D C:\Windows\system32\MRT
2013-11-16 16:39 - 2010-01-19 12:11 - 00000000 _____ C:\Users\Willi\AppData\Roaming\wklnhst.dat
2013-11-16 16:23 - 2013-03-15 18:30 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-15 17:01 - 2010-08-30 13:58 - 00000448 ____H C:\Windows\Tasks\Norton Security Scan for Willi.job
2013-11-14 13:33 - 2012-04-13 11:57 - 00000099 _____ C:\Users\Public\LMDebug.log
2013-11-14 13:26 - 2012-09-14 18:44 - 00012754 _____ C:\Users\Willi\Desktop\Notizen.odt
2013-11-14 13:23 - 2013-05-26 19:19 - 00010107 _____ C:\Users\Willi\Desktop\erledigen.odt
2013-11-14 13:22 - 2013-11-14 13:22 - 00000000 ____D C:\Windows\Panther
2013-11-14 12:03 - 2012-04-13 12:37 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-05 12:10 - 2012-02-28 22:02 - 00094208 _____ C:\Users\Willi\Desktop\buch.xls
2013-11-01 10:35 - 2013-10-16 19:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 21:20 - 2010-08-26 17:17 - 00003188 _____ C:\Windows\System32\Tasks\HPCeeScheduleForWilli
2013-10-30 21:20 - 2010-08-26 17:17 - 00000334 _____ C:\Windows\Tasks\HPCeeScheduleForWilli.job
2013-10-28 17:32 - 2012-07-12 20:42 - 00000000 ____D C:\Users\Willi\AppData\Local\CrashDumps
2013-10-23 08:42 - 2013-10-23 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 15:10 - 2013-10-20 15:10 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 15:10 - 2013-10-20 15:09 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-20 15:10 - 2013-06-22 08:38 - 00000000 ____D C:\Program Files (x86)\Java

Some content of TEMP:
====================
C:\Users\Willi\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-10 19:16

==================== End Of Log ============================

--- --- ---

aharonov · 18.11.2013, 23:00

Hi,

wie läuft der Rechner jetzt?

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

AppInit_DLLs-x32: c:\progra~3\browse~1\23796~1.11\{16cdf~1\browse~1.dll [ ] ()
CHR Extension: (Browse2save) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbofdekhceiophbojfilglehgciieapk\1
CHR Extension: (saVenashare ) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibimjopifbpdgllmenfbedjhifpbfbij\5.10
CHR Extension: (SearchNewTab) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\legepjmdalkoddjgaplaipoclplbhbcl\1.0

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

Öffne das Programm Malwarebytes Anti-Malware.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke auf Aktualisierung --> Suche nach Aktualisierung.
Wenn das Update beendet wurde, aktiviere im Reiter Suchlauf die Option Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan fertig ist, klicke auf Ergebnisse anzeigen.
Versichere dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter dem Reiter Logdateien finden.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

aharonov · 07.01.2014, 15:06

Fehlende Rückmeldung
Dieses Thema wurde aus meinen Abos gelöscht. Somit bekomme ich keine Benachrichtigung mehr über neue Antworten.
Schreib mir eine PM, falls du das Thema doch wieder fortsetzen möchtest. Dann machen wir hier weiter.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.

BKA-Trojaner, fährt bei abgesichertem Modus runter

Log-Analyse und Auswertung: BKA-Trojaner, fährt bei abgesichertem Modus runter