Potentiell gefährdeter Laptop (zahlreiche PUP entfernt) - nun sauber?

waldiphil · 30.01.2014, 21:44

Hallo

ich habe hier einen Laptop, der von einer (potentiellen) Rogue Security Software (Advanced System Protector) befallen war.
Außerdem waren mehrere Antivirenprogramme gleichzeitig installiert (wahrscheinlich in Panik über Viren-Meldungen, ausgelöst von mehreren ebenfalls vorhandenen harmlosen Adwares).

Ich habe nun zunächst alle Virenprogramme deinstalliert und überlasse es der Besitzerin, eines ihrer Wahl auszusuchen und nur das zu nutzen.

Der Scan mit ESET ergab dann folgende PUP (eben die Adwares und die Rogue Security Software):

Code:

ATTFilter

C:\$Recycle.Bin\S-1-5-21-535545297-3433116171-3722734622-1001\$RJYMLI3.exe	Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\$Recycle.Bin\S-1-5-21-535545297-3433116171-3722734622-1001\$RNMTNH2.exe	Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\OEM\Preload\Autorun\APP\Nero 10 Essentials Packard Bell Edition\ISSetupPrerequisites\{BF80A1C0-C3FF-4B1C-ABEF-22CD4F97A0AB}\Toolbar.exe	Variante von Win32/Bundled.Toolbar.Ask.A Anwendung
C:\Program Files\Uninstaller\Uninstall.exe	Variante von MSIL/DomaIQ.A Anwendung
C:\Program Files (x86)\WBDesktop.Updater.exe	MSIL/WebCake.A Anwendung
C:\Program Files (x86)\WDesktop.Updater.exe	Variante von MSIL/WebCake.A Anwendung
C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe	Variante von MSIL/AdvancedSystemProtector.B Anwendung
C:\Program Files (x86)\Advanced System Protector\AspManager.exe	Variante von MSIL/AdvancedSystemProtector.B Anwendung
C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe	Variante von MSIL/AdvancedSystemProtector.B Anwendung
C:\Program Files (x86)\Advanced System Protector\scandll.dll	Variante von MSIL/AdvancedSystemProtector.B Anwendung
C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe	Variante von Win32/Bundled.Toolbar.Ask.D Anwendung
C:\Program Files (x86)\Betcat\WBDesktop.Updater.1.0.0.16.exe	Variante von MSIL/WebCake.A Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaApp.dll	Variante von Win32/Toolbar.Montiera.A Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaEng.dll	möglicherweise Variante von Win32/Toolbar.Montiera.A Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltasrv.exe	Variante von Win32/Toolbar.Montiera.A Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll	Win32/Toolbar.Babylon.G Anwendung
C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll	Win32/Toolbar.Escort.A Anwendung
C:\Program Files (x86)\Driver Pro\DPSmartScan.exe	Win32/Adware.SpeedingUpMyPC.C Anwendung
C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll	Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 1.5\Feven 1.5-buttonutil64.dll	möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 1.5\Feven 1.5-buttonutil64.exe	Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 1.5\utils.exe	Mehrere Bedrohungen
C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll	Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 2.5\Feven 2.5-buttonutil64.dll	möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Feven 2.5\Feven 2.5-buttonutil64.exe	Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Mobogenie\nengine.dll	Win32/NextLive.A Anwendung
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe	Variante von Win32/SpeedingUpMyPC Anwendung
C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll	Variante von Win32/SProtector.D Anwendung
C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe	Variante von Win32/AdWare.SpeedingUpMyPC.D Anwendung
C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe	Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung
C:\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe	Variante von Win32/SpeedingUpMyPC Anwendung
C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll	Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil64.dll	möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil64.exe	Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-1.2\utils.exe	Mehrere Bedrohungen
C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll	Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-buttonutil64.dll	möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-buttonutil64.exe	Variante von Win64/Toolbar.Crossrider.B Anwendung
C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup.exe	Win32/MyPCBackup.A Anwendung
C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup_Intl.exe	Win32/MyPCBackup.A Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe	Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll	Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1390923785118	Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1390923785376	Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe	Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe	Variante von Win64/Conduit.SearchProtect.A Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll	Variante von Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll	Win32/Conduit.SearchProtect.H Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll	Variante von Win64/Conduit.SearchProtect.A Anwendung
C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll	Variante von Win64/Conduit.SearchProtect.A Anwendung
C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe	Win32/AdWare.Yontoo.E Anwendung
C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe	Variante von Win32/bProtector.A Anwendung
C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe	Variante von Win32/bProtector.A Anwendung
C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js	Win32/bProtector.F Anwendung
C:\ProgramData\downloadiotKeep\gpM.exe	Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\ProgramData\downloadiotKeep\gpM.x64.dll	Variante von Win64/Adware.MultiPlug.A Anwendung
C:\ProgramData\ssavernet\Omblf.exe	Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\ProgramData\ssavernet\Omblf.x64.dll	Variante von Win64/Adware.MultiPlug.A Anwendung
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll	möglicherweise Variante von Win32/Adware.Yontoo.B Anwendung
C:\ProgramData\WPM\wprotectmanager.exe	Win32/ELEX.Y Anwendung
C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe	Variante von Win32/bProtector.A Anwendung
C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe	Variante von Win32/bProtector.A Anwendung
C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js	Win32/bProtector.F Anwendung
C:\Users\All Users\downloadiotKeep\gpM.exe	Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\Users\All Users\downloadiotKeep\gpM.x64.dll	Variante von Win64/Adware.MultiPlug.A Anwendung
C:\Users\All Users\ssavernet\Omblf.exe	Variante von Win32/AdWare.MultiPlug.K.gen Anwendung
C:\Users\All Users\ssavernet\Omblf.x64.dll	Variante von Win64/Adware.MultiPlug.A Anwendung
C:\Users\All Users\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll	möglicherweise Variante von Win32/Adware.Yontoo.B Anwendung
C:\Users\All Users\WPM\wprotectmanager.exe	Win32/ELEX.Y Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\plugin@getwebcake.com\content\overlay.js	JS/Adware.Yontoo.C Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_20.dll	Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_21.dll	Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_22.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_23.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_24.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_25.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_26.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_20.dll	Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_21.dll	Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_22.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_23.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_24.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_25.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_26.dll	Variante von Win32/Toolbar.Linkury.D Anwendung
C:\Users\*********\AppData\Roaming\newnext.me\nengine.dll	Win32/NextLive.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\WebCakeDesktop.exe	MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\dat\Desktop.OS.dll	Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\dat\Dora.dat	Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\dat\Maintain.dat	Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\Web Cake\dat\Paladin.dat	Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\WebCake\WebCakeDesktop.exe	MSIL/WebCake.B Anwendung
C:\Users\*********\AppData\Roaming\WebCake\dat\Desktop.OS.dll	Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\WebCake\dat\Maintain.dat	Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Roaming\WebCake\dat\Phoenix.dat	Variante von MSIL/WebCake.A Anwendung
C:\Users\*********\AppData\Local\Google\Chrome\User Data\Default\Cache\f_019e36	Win32/Systweak.B Anwendung
C:\Users\*********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\288QFQVY\ApnIC[1].0	Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Users\*********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40E9TS8T\ApnIC[2].0	Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Users\*********\AppData\Local\Temp\AskSLib.dll	Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Users\*********\AppData\Local\Temp\SPSetup.exe	Mehrere Bedrohungen
C:\Users\*********\Desktop\*********\*********\Documents\SoftonicDownloader_fuer_photoscape.exe	Win32/SoftonicDownloader.A Anwendung
C:\Users\*********\Downloads\FlashPlayersetup__5047_i259476686_il3.exe	Variante von Win32/Amonetize.AA Anwendung
C:\Users\*********\Downloads\Java (1).exe	Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\Java (2).exe	Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\Java.exe	Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\rcpsetupapnnew_apnnew2_1637942_de_bp.exe	Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\rcpsetupmapp1_mapp12133923 (1).exe	Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\rcpsetupmapp1_mapp12133923.exe	Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\rcpsetup_apptvlatest_apptvlatest (1).exe	Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\rcpsetup_apptvlatest_apptvlatest.exe	Win32/Systweak.B Anwendung
C:\Users\*********\Downloads\Setup (1).exe	Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\Setup (2).exe	Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\Setup (3).exe	MSIL/DomaIQ.Q Anwendung
C:\Users\*********\Downloads\setup (4).exe	Variante von Win32/Bundlore.B Anwendung
C:\Users\*********\Downloads\Setup (5).exe	Variante von Win32/DomaIQ.AV Anwendung
C:\Users\*********\Downloads\Setup.exe	Variante von Win32/DomaIQ.AU Anwendung
C:\Users\*********\Downloads\speedupmypc_747063_.exe	Win32/SpeedUpMyPC.A Anwendung
C:\Windows\Installer\1e989b.msi	Mehrere Bedrohungen
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[1].0	Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[1].0	Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Windows\Temp\2570bd6c.ftf.ftf	Variante von Win32/SProtector.D Anwendung
C:\Windows\Temp\AskSLib.dll	Variante von Win32/Bundled.Toolbar.Ask Anwendung
C:\Windows\Temp\avnwldrtemp\setup\Offercast_AVIRAV7_.exe	Variante von Win32/Bundled.Toolbar.Ask.D Anwendung

(leider nur ein Ausschnitt des Logs, da ich den Rest gelöscht und nur den Teil hier zum Ausdrucken in eine Textdatei gespeichert habe).

Nun habe ich per Malwarebytes einen genauen Scan durchgeführt und die gefundenen (~150) Bedrohungen entfernen lassen.

Ein anschließender Quick-Scan ergab folgendes Log:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.30.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
******** :: ********-PC [Administrator]

30.01.2014 20:58:01
mbam-log-2014-01-30 (20-58-01).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 247729
Laufzeit: 8 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

GMER lieferte folgende Resulte:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-01-30 20:57:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\*******~1\AppData\Local\Temp\pgdoqpow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[2268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                    00000000770f1465 2 bytes [0F, 77]
.text  C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[2268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                   00000000770f14bb 2 bytes [0F, 77]
.text  ...                                                                                                                            * 2
.text  C:\Program Files (x86)\Mobogenie\DaemonProcess.exe[3160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               00000000770f1465 2 bytes [0F, 77]
.text  C:\Program Files (x86)\Mobogenie\DaemonProcess.exe[3160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000770f14bb 2 bytes [0F, 77]
.text  ...                                                                                                                            * 2
.text  C:\Program Files (x86)\Launch Manager\LManager.exe[3216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               00000000770f1465 2 bytes [0F, 77]
.text  C:\Program Files (x86)\Launch Manager\LManager.exe[3216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000770f14bb 2 bytes [0F, 77]
.text  ...                                                                                                                            * 2
.text  C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[3224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                    00000000770f1465 2 bytes [0F, 77]
.text  C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[3224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                   00000000770f14bb 2 bytes [0F, 77]
.text  ...                                                                                                                            * 2
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000770f1465 2 bytes [0F, 77]
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000770f14bb 2 bytes [0F, 77]
.text  ...                                                                                                                            * 2

---- EOF - GMER 2.1 ----

und FRST zu guter Letzt Folgendes:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by ******** (administrator) on ********-PC on 30-01-2014 20:39:34
Running from C:\Users\**********\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.EXE
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
() C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [761536 2013-12-26] ()
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM-x32\...\Run: [ApnUpdater] - "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
MountPoints2: {b4b792a0-7837-11e2-959f-b870f4df384e} - E:\Startme.exe
HKU\********\...\Run: [WebCake Desktop] - C:\Users\********\AppData\Roaming\Betcat\WebCakeDesktop.exe
HKU\********\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\********\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\********\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
HKU\********\...\Run: [Browser Infrastructure Helper] - C:\Users\********\AppData\Local\Smartbar\Application\SnapDo.exe startup
HKU\********\...\Run: [Driver Pro] - C:\Program Files (x86)\Driver Pro\DPLauncher.exe
HKU\********\...\Run: [PC Speed Maximizer] - C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe [135792 2013-12-19] (Smart PC Solutions)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => File Not Found
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-03-30] (NVIDIA Corporation)
AppInit_DLLs: c:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => File Not Found
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll => File Not Found
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [193128 2011-03-30] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=5e8cfb7c-9571-40c6-593c-72d5d5000fbd&searchtype=ds&q={searchTerms}&installDate=31/12/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=5e8cfb7c-9571-40c6-593c-72d5d5000fbd&searchtype=ds&q={searchTerms}&installDate=31/12/2013
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=5e8cfb7c-9571-40c6-593c-72d5d5000fbd&searchtype=ds&q={searchTerms}&installDate=31/12/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=5e8cfb7c-9571-40c6-593c-72d5d5000fbd&searchtype=ds&q={searchTerms}&installDate=31/12/2013
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll No File
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO: Feven 2.5 - {11111111-1111-1111-1111-110411901108} - C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll No File
BHO: Plus-HD-5.5 - {11111111-1111-1111-1111-110411901160} - C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll No File
BHO: Snap.DoEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: downloadiotKeep - {A8A56ADD-A5ED-734F-1D22-0949078095CF} - C:\ProgramData\downloadiotKeep\gpM.x64.dll No File
BHO: ssavernet - {B53AE25A-08F3-320F-8293-BAD1C3FF3B2C} - C:\ProgramData\ssavernet\Omblf.x64.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: ICQ Sparberater - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
BHO-x32: No Name - {EF7BD87A-8024-11E2-F316-F3E56188709B} -  No File
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8773_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Norton Confidential) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.6.10_0\npcoplgn.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-21]
CHR Extension: (Plus-HD-5.5) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoilcbjfkbdplcfglkiedhefcomondlk [2014-01-05]
CHR Extension: (Google Drive) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-21]
CHR Extension: (Feven 1.5) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-12-31]
CHR Extension: (YouTube) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-21]
CHR Extension: (downloadiotKeep) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfaknkffffmbadnnkpoimdkaaahgflcg [2014-01-29]
CHR Extension: (Google-Suche) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-21]
CHR Extension: (Re-markit) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel [2013-12-30]
CHR Extension: (Skype Click to Call) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-01-21]
CHR Extension: (Norton Identity Protection) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-01-21]
CHR Extension: (Google Wallet) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (ICQ Sparberater) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo [2013-01-21]
CHR Extension: (Google Mail) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-21]
CHR Extension: (Feven 2.5) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbhkhbgdaamliaimlpdlhokkecoibka [2014-01-12]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-11-14]
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.3.671.crx [2011-12-28]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-05-10] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [39528 2011-01-18] (Acer Incorporated)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
R2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247872 2011-08-17] ()
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S3 lxcg_device; C:\Windows\system32\lxcgcoms.exe [451584 2005-07-25] ( )
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\progra~2\optimi~1\OptProCrashSvc.dll",ServiceMain
S2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [x]

==================== Drivers (Whitelisted) ====================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\**********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 19:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:03 - 2014-01-30 20:39 - 00019468 _____ C:\Users\**********\Desktop\FRST.txt
2014-01-30 18:03 - 2014-01-30 20:39 - 00000000 ____D C:\FRST
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\**********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\**********\defogger_reenable
2014-01-30 18:01 - 2014-01-30 17:59 - 00380416 _____ C:\Users\**********\Desktop\Gmer-19357.exe
2014-01-30 18:01 - 2014-01-30 17:58 - 02079744 _____ (Farbar) C:\Users\**********\Desktop\FRST64.exe
2014-01-30 18:01 - 2014-01-30 17:56 - 00050477 _____ C:\Users\**********\Desktop\Defogger.exe
2014-01-30 18:01 - 2014-01-30 17:52 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\**********\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-30 15:19 - 2014-01-30 15:28 - 00000000 ____D C:\Windows\pss
2014-01-30 15:15 - 2014-01-30 18:16 - 00001426 _____ C:\Users\**********\Desktop\Registry kostenlos entrümpeln!.lnk
2014-01-29 10:00 - 2014-01-30 20:36 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\**********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-28 16:43 - 2014-01-28 16:43 - 00000000 ____D C:\Windows\SysWOW64\SearchProtect
2014-01-15 10:23 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:23 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:23 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\**********\Desktop\**********
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Program Files (x86)\PC Speed Maximizer
2014-01-12 16:23 - 2014-01-30 20:37 - 00000000 ____D C:\Users\**********\AppData\Roaming\Systweak
2014-01-12 15:57 - 2014-01-30 18:17 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-01-12 15:56 - 2014-01-30 20:37 - 00000000 ____D C:\ProgramData\Systweak
2014-01-12 15:56 - 2014-01-12 15:56 - 00003320 _____ C:\Windows\System32\Tasks\Advanced System Protector
2014-01-12 15:56 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2014-01-12 15:55 - 2014-01-30 18:18 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2014-01-12 15:54 - 2014-01-30 20:37 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-12 15:54 - 2014-01-12 15:54 - 00001062 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2014-01-12 15:54 - 2013-12-27 18:10 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\**********\Downloads\setup (4).exe
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\**********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\**********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\**********\Documents\ADOLF.xps
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log
2014-01-05 10:16 - 2014-01-30 20:36 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2014-01-05 10:16 - 2014-01-05 10:20 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2014-01-05 10:16 - 2014-01-05 10:16 - 00000000 ____D C:\Users\**********\AppData\Local\SearchProtect
2013-12-31 09:36 - 2014-01-30 20:37 - 00002425 _____ C:\Users\**********\daemonprocess.txt

==================== One Month Modified Files and Folders =======

2014-01-30 20:39 - 2014-01-30 18:03 - 00019468 _____ C:\Users\**********\Desktop\FRST.txt
2014-01-30 20:39 - 2014-01-30 18:03 - 00000000 ____D C:\FRST
2014-01-30 20:39 - 2013-01-21 11:30 - 00000000 ____D C:\Users\**********\AppData\Local\CrashDumps
2014-01-30 20:38 - 2012-06-25 10:20 - 00000000 ____D C:\Users\Public\Documents\phase6_19_Daten
2014-01-30 20:38 - 2011-11-19 12:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-30 20:38 - 2010-11-21 04:47 - 00652296 _____ C:\Windows\PFRO.log
2014-01-30 20:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-30 20:38 - 2009-07-14 05:51 - 00180615 _____ C:\Windows\setupact.log
2014-01-30 20:37 - 2014-01-12 16:23 - 00000000 ____D C:\Users\**********\AppData\Roaming\Systweak
2014-01-30 20:37 - 2014-01-12 15:56 - 00000000 ____D C:\ProgramData\Systweak
2014-01-30 20:37 - 2014-01-12 15:54 - 00000000 ____D C:\Users\**********\AppData\Roaming\systweak
2014-01-30 20:37 - 2013-12-31 09:36 - 00002425 _____ C:\Users\**********\daemonprocess.txt
2014-01-30 20:37 - 2013-06-13 20:23 - 00000000 ____D C:\ProgramData\BrowserDefender
2014-01-30 20:37 - 2011-08-16 03:33 - 01569465 _____ C:\Windows\WindowsUpdate.log
2014-01-30 20:36 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-30 20:36 - 2014-01-05 10:16 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2014-01-30 20:36 - 2013-07-29 13:47 - 00000000 ____D C:\Users\********\AppData\Roaming\Web Cake
2014-01-30 20:22 - 2013-06-13 20:22 - 00000286 _____ C:\Windows\Tasks\DSite.job
2014-01-30 20:13 - 2011-11-19 12:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-30 20:08 - 2012-06-16 12:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\**********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 18:24 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-30 18:24 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-30 18:18 - 2014-01-12 15:55 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2014-01-30 18:17 - 2014-01-12 15:57 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-01-30 18:16 - 2014-01-30 15:15 - 00001426 _____ C:\Users\**********\Desktop\Registry kostenlos entrümpeln!.lnk
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:15 - 2011-12-31 17:43 - 00000000 ____D C:\Windows\Minidump
2014-01-30 18:14 - 2011-12-31 17:43 - 901918507 _____ C:\Windows\MEMORY.DMP
2014-01-30 18:14 - 2011-07-20 15:06 - 00000000 ____D C:\ProgramData\Norton
2014-01-30 18:04 - 2011-08-16 13:23 - 00716782 _____ C:\Windows\system32\perfh007.dat
2014-01-30 18:04 - 2011-08-16 13:23 - 00155688 _____ C:\Windows\system32\perfc007.dat
2014-01-30 18:04 - 2009-07-14 06:13 - 01656284 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\**********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\**********\defogger_reenable
2014-01-30 18:02 - 2013-01-17 17:32 - 00000000 ____D C:\Users\**********
2014-01-30 17:59 - 2014-01-30 18:01 - 00380416 _____ C:\Users\**********\Desktop\Gmer-19357.exe
2014-01-30 17:58 - 2014-01-30 18:01 - 02079744 _____ (Farbar) C:\Users\**********\Desktop\FRST64.exe
2014-01-30 17:56 - 2014-01-30 18:01 - 00050477 _____ C:\Users\**********\Desktop\Defogger.exe
2014-01-30 17:52 - 2014-01-30 18:01 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\**********\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-30 17:41 - 2011-11-02 17:08 - 00000000 ____D C:\ProgramData\Avira
2014-01-30 17:21 - 2013-08-16 15:22 - 00000000 ____D C:\Program Files (x86)\Betcat
2014-01-30 15:28 - 2014-01-30 15:19 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\**********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-28 16:43 - 2014-01-28 16:43 - 00000000 ____D C:\Windows\SysWOW64\SearchProtect
2014-01-28 16:34 - 2009-07-14 05:45 - 00314984 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-28 16:32 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-16 09:59 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-15 11:10 - 2011-10-15 19:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-14 13:12 - 2011-10-15 19:00 - 00000000 ____D C:\Users\**********\AppData\Roaming\Mozilla
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\**********\Desktop\**********
2014-01-14 13:11 - 2011-10-16 00:49 - 00000000 ____D C:\Users\**********
2014-01-14 13:06 - 2013-12-30 19:45 - 00000276 _____ C:\Users\**********\daemonprocess.txt
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\**********\AppData\Roaming\PC Speed Maximizer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Program Files (x86)\PC Speed Maximizer
2014-01-12 15:56 - 2014-01-12 15:56 - 00003320 _____ C:\Windows\System32\Tasks\Advanced System Protector
2014-01-12 15:55 - 2013-12-30 19:46 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2014-01-12 15:54 - 2014-01-12 15:54 - 00001062 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\**********\Downloads\setup (4).exe
2014-01-08 17:22 - 2013-07-27 11:22 - 00000118 _____ C:\Users\**********\AppData\Roaming\WB.CFG
2014-01-08 17:18 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-08 16:12 - 2012-03-07 07:49 - 01634178 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\**********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\**********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\**********\Documents\ADOLF.xps
2014-01-05 19:14 - 2013-09-15 16:32 - 00000000 ____D C:\ProgramData\EPSON
2014-01-05 19:09 - 2013-09-15 16:34 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2014-01-05 19:02 - 2013-09-15 16:36 - 00000942 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:20 - 2014-01-05 10:16 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log
2014-01-05 10:16 - 2014-01-05 10:16 - 00000000 ____D C:\Users\**********\AppData\Local\SearchProtect

Some content of TEMP:
====================
C:\Users\**********\AppData\Local\Temp\AskSLib.dll
C:\Users\**********\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-05 13:33

==================== End Of Log ============================

--- --- ---

Da ich nicht weiß, wie schädlich dieser SystemProtector nun war (dazu gibt es unterschiedliche Aussagen im Internet), wäre ich dankbar, wenn sich jemand die Mühe machen könnte, die Logs durchzugehen und mir zu sagen, ob die Bedrohung eliminiert und der PC sicher als virenfrei bezeichnet werden kann.

Vielen Dank schonmal
Echt eine tolle Sache, dass es solche Foren hier mit derart engagierten Usern gibt!

EDIT: Arrrg, der Threadname ist vielleicht etwas zu allgemein gewählt... kann man leider nachträglich nicht mehr ändern?
"Advanced System Protector per Malwarebytes entfernt - System nun sauber?" wäre intuitiver

schrauber · 30.01.2014, 22:33

hi,

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

waldiphil · 30.01.2014, 23:36

Danke für Deine Antwort!

AdWareCleaner:

Code:

ATTFilter

# AdwCleaner v3.018 - Bericht erstellt am 30/01/2014 um 22:44:52
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : ******** & Bartl - ********-PC
# Gestartet von : C:\Users\********\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : BackupStack
[#] Dienst Gelöscht : BrowserDefendert
Dienst Gelöscht : ICQ Service

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BrowserDefender
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Systweak
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Maximizer
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
Ordner Gelöscht : C:\Program Files (x86)\Betcat
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup 
Ordner Gelöscht : C:\Program Files (x86)\PC Speed Maximizer
Ordner Gelöscht : C:\Program Files (x86)\Searchprotect
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Windows\SysWOW64\Searchprotect
Ordner Gelöscht : C:\Users\********\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\********\AppData\Local\Searchprotect
Ordner Gelöscht : C:\Users\********\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\********\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\********\AppData\Roaming\Systweak
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Datei Gelöscht : C:\Users\Public\Desktop\RegClean Pro.lnk
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Windows\System32\Tasks\Advanced System Protector
Datei Gelöscht : C:\Windows\System32\Tasks\Advanced System Protector_startup
Datei Gelöscht : C:\Windows\System32\Tasks\BrowserDefendert
Datei Gelöscht : C:\Windows\System32\Tasks\Dealply
Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyUpdate
Datei Gelöscht : C:\Windows\Tasks\DSite.job
Datei Gelöscht : C:\Windows\System32\Tasks\DSite
Datei Gelöscht : C:\Windows\System32\Tasks\EPUpdater
Datei Gelöscht : C:\Windows\System32\Tasks\QtraxPlayer
Datei Gelöscht : C:\Windows\System32\Tasks\RegClean Pro
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\52558c8ae63be547
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366126655}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366856632}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466906608}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466906660}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF7BD87A-8024-11E2-F316-F3E56188709B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366126655}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366856632}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466906608}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466906660}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DomaIQ
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Google Chrome v31.0.1650.63

[ Datei : C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [16144 octets] - [30/01/2014 22:42:04]
AdwCleaner[S0].txt - [15246 octets] - [30/01/2014 22:44:52]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15307 octets] ##########

neues FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by ******** (administrator) on ********-PC on 30-01-2014 23:23:08
Running from C:\Users\********\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.EXE


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [761536 2013-12-26] ()
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
MountPoints2: {b4b792a0-7837-11e2-959f-b870f4df384e} - E:\Startme.exe
HKU\********\...\Run: [WebCake Desktop] - C:\Users\********\AppData\Roaming\Betcat\WebCakeDesktop.exe
HKU\********\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\********\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\********\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
HKU\********\...\Run: [Browser Infrastructure Helper] - C:\Users\********\AppData\Local\Smartbar\Application\SnapDo.exe startup
HKU\********\...\Run: [Driver Pro] - C:\Program Files (x86)\Driver Pro\DPLauncher.exe
HKU\********\...\Run: [PC Speed Maximizer] - C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-03-30] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [193128 2011-03-30] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll No File
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO: Feven 2.5 - {11111111-1111-1111-1111-110411901108} - C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll No File
BHO: Plus-HD-5.5 - {11111111-1111-1111-1111-110411901160} - C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: downloadiotKeep - {A8A56ADD-A5ED-734F-1D22-0949078095CF} - C:\ProgramData\downloadiotKeep\gpM.x64.dll No File
BHO: ssavernet - {B53AE25A-08F3-320F-8293-BAD1C3FF3B2C} - C:\ProgramData\ssavernet\Omblf.x64.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: ICQ Sparberater - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8773_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Norton Confidential) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.6.10_0\npcoplgn.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-21]
CHR Extension: (Plus-HD-5.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoilcbjfkbdplcfglkiedhefcomondlk [2014-01-05]
CHR Extension: (Google Drive) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-21]
CHR Extension: (Feven 1.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-12-31]
CHR Extension: (YouTube) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-21]
CHR Extension: (downloadiotKeep) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfaknkffffmbadnnkpoimdkaaahgflcg [2014-01-29]
CHR Extension: (Google-Suche) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-21]
CHR Extension: (Re-markit) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel [2013-12-30]
CHR Extension: (Skype Click to Call) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-01-21]
CHR Extension: (Norton Identity Protection) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-01-21]
CHR Extension: (Google Wallet) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (ICQ Sparberater) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo [2013-01-21]
CHR Extension: (Google Mail) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-21]
CHR Extension: (Feven 2.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbhkhbgdaamliaimlpdlhokkecoibka [2014-01-12]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-11-14]
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.3.671.crx [2011-12-28]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-05-10] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [39528 2011-01-18] (Acer Incorporated)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
S2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S3 lxcg_device; C:\Windows\system32\lxcgcoms.exe [451584 2005-07-25] ( )
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:41 - 2014-01-30 22:45 - 00000000 ____D C:\AdwCleaner
2014-01-30 22:40 - 2014-01-30 22:38 - 01166132 _____ C:\Users\********\Desktop\adwcleaner.exe
2014-01-30 22:40 - 2014-01-30 22:38 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:52 - 2014-01-30 21:52 - 00000000 ____D C:\Windows\system32\MRT
2014-01-30 21:52 - 2014-01-06 16:20 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ C:\Users\********\Desktop\GMER.log
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 19:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:03 - 2014-01-30 23:23 - 00016045 _____ C:\Users\********\Desktop\FRST.txt
2014-01-30 18:03 - 2014-01-30 23:23 - 00000000 ____D C:\FRST
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\********\defogger_reenable
2014-01-30 18:01 - 2014-01-30 17:59 - 00380416 _____ C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 18:01 - 2014-01-30 17:58 - 02079744 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 18:01 - 2014-01-30 17:56 - 00050477 _____ C:\Users\********\Desktop\Defogger.exe
2014-01-30 15:19 - 2014-01-30 15:28 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-30 20:36 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-15 10:23 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:23 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:23 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\********\Desktop\********
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-12 15:56 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2014-01-12 15:54 - 2014-01-30 20:37 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\********\Downloads\setup (4).exe
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\********\Documents\ADOLF.xps
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log
2014-01-05 10:16 - 2014-01-05 10:20 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2013-12-31 09:36 - 2014-01-30 21:26 - 00002567 _____ C:\Users\********\daemonprocess.txt

==================== One Month Modified Files and Folders =======

2014-01-30 23:23 - 2014-01-30 18:03 - 00016045 _____ C:\Users\********\Desktop\FRST.txt
2014-01-30 23:23 - 2014-01-30 18:03 - 00000000 ____D C:\FRST
2014-01-30 23:13 - 2011-11-19 12:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-30 23:08 - 2012-06-16 12:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-30 22:58 - 2013-12-31 09:36 - 00002567 _____ C:\Users\********\daemonprocess.txt
2014-01-30 22:55 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-30 22:55 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-30 22:51 - 2011-08-16 03:33 - 01639344 _____ C:\Windows\WindowsUpdate.log
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:48 - 2013-01-21 11:30 - 00000000 ____D C:\Users\********\AppData\Local\CrashDumps
2014-01-30 22:48 - 2012-06-25 10:20 - 00000000 ____D C:\Users\Public\Documents\phase6_19_Daten
2014-01-30 22:48 - 2011-11-19 12:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-30 22:47 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-30 22:47 - 2009-07-14 05:51 - 00180671 _____ C:\Windows\setupact.log
2014-01-30 22:45 - 2014-01-30 22:41 - 00000000 ____D C:\AdwCleaner
2014-01-30 22:44 - 2011-08-16 13:23 - 00716782 _____ C:\Windows\system32\perfh007.dat
2014-01-30 22:44 - 2011-08-16 13:23 - 00155688 _____ C:\Windows\system32\perfc007.dat
2014-01-30 22:44 - 2009-07-14 06:13 - 01656284 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-30 22:38 - 2014-01-30 22:40 - 01166132 _____ C:\Users\********\Desktop\adwcleaner.exe
2014-01-30 22:38 - 2014-01-30 22:40 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:55 - 2014-01-30 21:52 - 00000000 ____D C:\Windows\system32\MRT
2014-01-30 21:55 - 2011-08-16 03:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ C:\Users\********\Desktop\GMER.log
2014-01-30 20:38 - 2013-12-30 19:45 - 00000000 ____D C:\ProgramData\WPM
2014-01-30 20:38 - 2010-11-21 04:47 - 00652296 _____ C:\Windows\PFRO.log
2014-01-30 20:37 - 2014-01-12 15:54 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-30 20:36 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-30 20:36 - 2013-07-29 13:47 - 00000000 ____D C:\Users\********\AppData\Roaming\Web Cake
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:15 - 2011-12-31 17:43 - 00000000 ____D C:\Windows\Minidump
2014-01-30 18:14 - 2011-12-31 17:43 - 901918507 _____ C:\Windows\MEMORY.DMP
2014-01-30 18:14 - 2011-07-20 15:06 - 00000000 ____D C:\ProgramData\Norton
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\********\defogger_reenable
2014-01-30 18:02 - 2013-01-17 17:32 - 00000000 ____D C:\Users\********
2014-01-30 17:59 - 2014-01-30 18:01 - 00380416 _____ C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 17:58 - 2014-01-30 18:01 - 02079744 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 17:56 - 2014-01-30 18:01 - 00050477 _____ C:\Users\********\Desktop\Defogger.exe
2014-01-30 17:41 - 2011-11-02 17:08 - 00000000 ____D C:\ProgramData\Avira
2014-01-30 15:28 - 2014-01-30 15:19 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-28 16:34 - 2009-07-14 05:45 - 00314984 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-28 16:32 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-16 09:59 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-15 11:10 - 2011-10-15 19:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-14 13:12 - 2011-10-15 19:00 - 00000000 ____D C:\Users\********\AppData\Roaming\Mozilla
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\********\Desktop\********
2014-01-14 13:11 - 2011-10-16 00:49 - 00000000 ____D C:\Users\********
2014-01-14 13:06 - 2013-12-30 19:45 - 00000276 _____ C:\Users\********\daemonprocess.txt
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\********\Downloads\setup (4).exe
2014-01-08 17:22 - 2013-07-27 11:22 - 00000118 _____ C:\Users\********\AppData\Roaming\WB.CFG
2014-01-08 17:18 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-08 16:12 - 2012-03-07 07:49 - 01634178 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\********\Documents\ADOLF.xps
2014-01-06 16:20 - 2014-01-30 21:52 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-05 19:14 - 2013-09-15 16:32 - 00000000 ____D C:\ProgramData\EPSON
2014-01-05 19:09 - 2013-09-15 16:34 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2014-01-05 19:02 - 2013-09-15 16:36 - 00000942 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:20 - 2014-01-05 10:16 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log

Some content of TEMP:
====================
C:\Users\********\AppData\Local\Temp\AskSLib.dll
C:\Users\********\AppData\Local\Temp\avgnt.exe
C:\Users\********\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-05 13:33

==================== End Of Log ============================

--- --- ---

Das JRT funktioniert leider nicht richtig:
Wenige Sekunden nach diesem Zustand schließt sich die Konsole, es wird kein Logfile gespeichert:

Leider konnte ich die letzten Output-Zeilen nicht mehr erkennen.
Das Tool wurde explizit als Administrator ausgeführt (Windows 7).

Viele Grüße
Philipp

schrauber · 31.01.2014, 17:01

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

waldiphil · 31.01.2014, 21:01

Hallo

ESET (der obere Teil stammt von einem Scan vor der Säuberung des Systems mit MalwareBytes):

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=72bd3805521f1c42a32331b62f430605
# engine=16841
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-01-29 03:13:49
# local_time=2014-01-29 04:13:49 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 23699 161676134 81097 0
# compatibility_mode=3591 16777213 100 95 30682050 153605014 0 0
# compatibility_mode=5893 16776573 100 94 1307426 142638279 0 0
# scanned=274544
# found=122
# cleaned=0
# scan_time=22921
sh=9ED22B17AF956934B73F176C0AEB87AFA2F2B5B3 ft=1 fh=f57fa58ae860c262 vn="Variante von Win32/Bundled.Toolbar.Ask Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-535545297-3433116171-3722734622-1001\$RJYMLI3.exe"
sh=52773D9B2F9413F2B08C5A2F6A83BEFB4DD9EA2E ft=1 fh=8f7eedf1f4070b69 vn="Variante von Win32/Bundled.Toolbar.Ask Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-535545297-3433116171-3722734622-1001\$RNMTNH2.exe"
sh=5E6A03871B397414C36AF1E1359FE014C7761B74 ft=1 fh=ee8c5e224a6823f5 vn="Variante von Win32/Bundled.Toolbar.Ask.A Anwendung" ac=I fn="C:\OEM\Preload\Autorun\APP\Nero 10 Essentials Packard Bell Edition\ISSetupPrerequisites\{BF80A1C0-C3FF-4B1C-ABEF-22CD4F97A0AB}\Toolbar.exe"
sh=741518CA17409E0C108EA202464829E6C664ED1E ft=1 fh=52477f93f91d8732 vn="Variante von MSIL/DomaIQ.A Anwendung" ac=I fn="C:\Program Files\Uninstaller\Uninstall.exe"
sh=EA8ADA75B6A0DBE8157470D7CCE54ADCF33C3F3E ft=1 fh=b9212dfc755e05d1 vn="MSIL/WebCake.A Anwendung" ac=I fn="C:\Program Files (x86)\WBDesktop.Updater.exe"
sh=5FECED14BEB27EE323DD4F161917A72A54F92422 ft=1 fh=e19c1e3a606d2037 vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Program Files (x86)\WDesktop.Updater.exe"
sh=A39C55E362199542330244B280735468B730D9E2 ft=1 fh=349dd8a04a8f8b58 vn="Variante von MSIL/AdvancedSystemProtector.B Anwendung" ac=I fn="C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe"
sh=22D2DDD066089C7CE3D77251A17EE75198A1342B ft=1 fh=da73685930070287 vn="Variante von MSIL/AdvancedSystemProtector.B Anwendung" ac=I fn="C:\Program Files (x86)\Advanced System Protector\AspManager.exe"
sh=866698A8AC36996FDF5AB67F502FEA5955C7C450 ft=1 fh=181b648461105be7 vn="Variante von MSIL/AdvancedSystemProtector.B Anwendung" ac=I fn="C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe"
sh=70F105875DE6420CEDC5674F3F3C0ED9D4BE5728 ft=1 fh=43fda2c9df0909f5 vn="Variante von MSIL/AdvancedSystemProtector.B Anwendung" ac=I fn="C:\Program Files (x86)\Advanced System Protector\scandll.dll"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=7A23C5E970C7A167EBF32191FFC66303E5A28A2A ft=1 fh=d0bcae82f257aedc vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Program Files (x86)\Betcat\WBDesktop.Updater.1.0.0.16.exe"
sh=A58FE6880A76C1364B17A235951ABE9C95FC7299 ft=1 fh=1ab78df13745b7f5 vn="Variante von Win32/Toolbar.Montiera.A Anwendung" ac=I fn="C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaApp.dll"
sh=D987048C3FF42F81F39E3B15E57F32AF7AA0BD00 ft=1 fh=47df87911e710cf9 vn="möglicherweise Variante von Win32/Toolbar.Montiera.A Anwendung" ac=I fn="C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaEng.dll"
sh=781F353EA130DCB9C496D35204CB5AB96C4DCCBF ft=1 fh=7e2601b6c3711131 vn="Variante von Win32/Toolbar.Montiera.A Anwendung" ac=I fn="C:\Program Files (x86)\Delta\delta\1.8.21.5\deltasrv.exe"
sh=02515F710B884FF8B426B43DF8C9B05E943B6AED ft=1 fh=d9df6fa40224409d vn="Win32/Toolbar.Babylon.G Anwendung" ac=I fn="C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll"
sh=DFB461F520B77E9CF268FDFBFFBBB624C7EA5064 ft=1 fh=0fb3be40d7aae6ee vn="Win32/Toolbar.Escort.A Anwendung" ac=I fn="C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll"
sh=D4BD507F917917B829EB9FCE79A29047635E3668 ft=1 fh=6a4bd6f73db15183 vn="Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\Program Files (x86)\Driver Pro\DPSmartScan.exe"
sh=981E3BED34EE33F1E9E7680B84188AE7E9F5D985 ft=1 fh=8c61e48ddda3e654 vn="Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll"
sh=801227B2287B0B4B814C8E6B894D538CF9245AC0 ft=1 fh=ccb4c4d1a5e788c8 vn="möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Feven 1.5\Feven 1.5-buttonutil64.dll"
sh=07005CC07DD28894BEBD668AC05B1811FF6AB1BE ft=1 fh=2fdfa3c388578c6f vn="Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Feven 1.5\Feven 1.5-buttonutil64.exe"
sh=8EC6137D1A7E340081F505A04D8ADF471FE0AD20 ft=1 fh=2dc92d65a22afcdc vn="Mehrere Bedrohungen" ac=I fn="C:\Program Files (x86)\Feven 1.5\utils.exe"
sh=301D8FBC9345BD24D2C3EC37246CE21AF298C7F5 ft=1 fh=e973c85d0c631798 vn="Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll"
sh=182F426FFF5734D5DDB9E9B3E5F5FA3B19CBCB6E ft=1 fh=c71c00113096d58d vn="möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Feven 2.5\Feven 2.5-buttonutil64.dll"
sh=68FA758AA64AE1EF2B30AF621E50DBF29B950E70 ft=1 fh=3d74ec299e67ffa8 vn="Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Feven 2.5\Feven 2.5-buttonutil64.exe"
sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A Anwendung" ac=I fn="C:\Program Files (x86)\Mobogenie\nengine.dll"
sh=E726D8BAED9714F2CCF9E8EE01DA76F32716870A ft=1 fh=3a4d9e1ea77ed494 vn="Variante von Win32/SpeedingUpMyPC Anwendung" ac=I fn="C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe"
sh=6C24897BCABE6DEFC5C247B77AA19E9DD5214BC2 ft=1 fh=2900c2c2b254b4d8 vn="Variante von Win32/SProtector.D Anwendung" ac=I fn="C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll"
sh=C5828B700B9EF61FA1534D5D18482BF12F591CBF ft=1 fh=0404da55e35b3671 vn="Variante von Win32/AdWare.SpeedingUpMyPC.D Anwendung" ac=I fn="C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe"
sh=DDD2974F59F7DBB2C99557C05FB33787C7B27748 ft=1 fh=b62022df389e395a vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe"
sh=92340259E280930948E65E7580F7CA3FE5E0ED78 ft=1 fh=73e5c66e71fb7aeb vn="Variante von Win32/SpeedingUpMyPC Anwendung" ac=I fn="C:\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe"
sh=5864F10DD2FC601ABD1B903A19CEE506E2730962 ft=1 fh=c6b3589f0bb814cf vn="Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll"
sh=BDDF91C56422A8233469EB6D47D70D51E077DBE4 ft=1 fh=1e500fc445d6ed40 vn="möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil64.dll"
sh=E9AEE98FB0BEF83BCE366F9BD828E4E82722C7C1 ft=1 fh=8f1d76bfd46bc0af vn="Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil64.exe"
sh=9AB54ADC258F89B5F760116DB85E45748B6A07AD ft=1 fh=02d8c4c1f8d04b33 vn="Mehrere Bedrohungen" ac=I fn="C:\Program Files (x86)\Plus-HD-1.2\utils.exe"
sh=8C6C5A05E6178631081221F7255EF7B16413A491 ft=1 fh=eff2dd2b8c8aa5ae vn="Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll"
sh=2F35DC8FA0BCDD0F63B3DB0D56761D857DCD4F6C ft=1 fh=fce415159ec96148 vn="möglicherweise Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-buttonutil64.dll"
sh=0F67A64C5CEEE4D63D0DD4633AE7E8DF84C53EA7 ft=1 fh=107467f9a54705a0 vn="Variante von Win64/Toolbar.Crossrider.B Anwendung" ac=I fn="C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-buttonutil64.exe"
sh=29537B5D9E0B9006067890E1D21D0CE6F22E8A99 ft=1 fh=6e7ef67f604e413f vn="Win32/MyPCBackup.A Anwendung" ac=I fn="C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup.exe"
sh=EE0DBC090D6FC9DA0D0A84516D8D34BF1F96E196 ft=1 fh=44b5db033c27eea0 vn="Win32/MyPCBackup.A Anwendung" ac=I fn="C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup_Intl.exe"
sh=2BAE275502BB9E38A765AA4B54C0558EEEC5A012 ft=1 fh=495be46644247fc7 vn="Variante von Win32/Conduit.SearchProtect.H Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe"
sh=C8F8049916B0E5C1953670DB20F04E87791681F2 ft=1 fh=5f5f86e71335fd15 vn="Variante von Win32/Conduit.SearchProtect.H Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll"
sh=126B22D7B2FE0FC571E6D6D0098B0E0D053C0BCC ft=1 fh=89dba07409c55d47 vn="Variante von Win32/Conduit.SearchProtect.H Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1390923785118"
sh=126B22D7B2FE0FC571E6D6D0098B0E0D053C0BCC ft=1 fh=89dba07409c55d47 vn="Variante von Win32/Conduit.SearchProtect.H Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1390923785376"
sh=2481024FCCC6413F0F160C5D9376DD41FC911103 ft=1 fh=7bf0b42b611d1c72 vn="Variante von Win32/Conduit.SearchProtect.H Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe"
sh=8F9E4C025E1658C4C21F4C7144FF52C026CBC7C1 ft=1 fh=ce792d954eaea4a5 vn="Variante von Win64/Conduit.SearchProtect.A Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe"
sh=C17AB59BC38CE88B19C980C8B96CD9A4E115B0D5 ft=1 fh=f24dc374a6f559f2 vn="Variante von Win32/Conduit.SearchProtect.H Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll"
sh=2C01404FAF356585FF3C6DDAB3F636D535FE6996 ft=1 fh=74dc62d260d6be11 vn="Win32/Conduit.SearchProtect.H Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll"
sh=A9E8001B13EF4359084CBE5CB293B5BC6ABBA5E5 ft=1 fh=c63082020c9fe963 vn="Variante von Win64/Conduit.SearchProtect.A Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll"
sh=ABCB625E0BD3411C63048D9E0A6F53887E4C928B ft=1 fh=3f55fc963c003215 vn="Variante von Win64/Conduit.SearchProtect.A Anwendung" ac=I fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll"
sh=5576FAF2DB1B0B1D7F395BBC7DC61BF70430E2F8 ft=1 fh=5ee69de9dd0b2c20 vn="Win32/AdWare.Yontoo.E Anwendung" ac=I fn="C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe"
sh=286ABF963E4932A0AA39AFEAC731DB4F9653E687 ft=1 fh=08e2d7213a015099 vn="Variante von Win32/bProtector.A Anwendung" ac=I fn="C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe"
sh=286ABF963E4932A0AA39AFEAC731DB4F9653E687 ft=1 fh=08e2d7213a015099 vn="Variante von Win32/bProtector.A Anwendung" ac=I fn="C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe"
sh=83862B51062A3A5F521BCE6AFB8228AF44B87BA1 ft=0 fh=0000000000000000 vn="Win32/bProtector.F Anwendung" ac=I fn="C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js"
sh=3B4651AE7C08CAFE072B187C279832831915AAC9 ft=1 fh=c71c00119908f0bf vn="Variante von Win32/AdWare.MultiPlug.K.gen Anwendung" ac=I fn="C:\ProgramData\downloadiotKeep\gpM.exe"
sh=746018B783B9E3B2087BA4427A3B789AD0813DCB ft=1 fh=c71c0011c6c5437f vn="Variante von Win64/Adware.MultiPlug.A Anwendung" ac=I fn="C:\ProgramData\downloadiotKeep\gpM.x64.dll"
sh=3B4651AE7C08CAFE072B187C279832831915AAC9 ft=1 fh=c71c00119908f0bf vn="Variante von Win32/AdWare.MultiPlug.K.gen Anwendung" ac=I fn="C:\ProgramData\ssavernet\Omblf.exe"
sh=746018B783B9E3B2087BA4427A3B789AD0813DCB ft=1 fh=c71c0011c6c5437f vn="Variante von Win64/Adware.MultiPlug.A Anwendung" ac=I fn="C:\ProgramData\ssavernet\Omblf.x64.dll"
sh=529F1CB730B133C2264E3451DCCC7DEEB179C135 ft=1 fh=2c963b952ca2f278 vn="möglicherweise Variante von Win32/Adware.Yontoo.B Anwendung" ac=I fn="C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll"
sh=0C9A08B5ADD21D4140312B82FB77DA525540781F ft=1 fh=c85f1c8d2521187b vn="Win32/ELEX.Y Anwendung" ac=I fn="C:\ProgramData\WPM\wprotectmanager.exe"
sh=286ABF963E4932A0AA39AFEAC731DB4F9653E687 ft=1 fh=08e2d7213a015099 vn="Variante von Win32/bProtector.A Anwendung" ac=I fn="C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe"
sh=286ABF963E4932A0AA39AFEAC731DB4F9653E687 ft=1 fh=08e2d7213a015099 vn="Variante von Win32/bProtector.A Anwendung" ac=I fn="C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe"
sh=83862B51062A3A5F521BCE6AFB8228AF44B87BA1 ft=0 fh=0000000000000000 vn="Win32/bProtector.F Anwendung" ac=I fn="C:\Users\All Users\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js"
sh=3B4651AE7C08CAFE072B187C279832831915AAC9 ft=1 fh=c71c00119908f0bf vn="Variante von Win32/AdWare.MultiPlug.K.gen Anwendung" ac=I fn="C:\Users\All Users\downloadiotKeep\gpM.exe"
sh=746018B783B9E3B2087BA4427A3B789AD0813DCB ft=1 fh=c71c0011c6c5437f vn="Variante von Win64/Adware.MultiPlug.A Anwendung" ac=I fn="C:\Users\All Users\downloadiotKeep\gpM.x64.dll"
sh=3B4651AE7C08CAFE072B187C279832831915AAC9 ft=1 fh=c71c00119908f0bf vn="Variante von Win32/AdWare.MultiPlug.K.gen Anwendung" ac=I fn="C:\Users\All Users\ssavernet\Omblf.exe"
sh=746018B783B9E3B2087BA4427A3B789AD0813DCB ft=1 fh=c71c0011c6c5437f vn="Variante von Win64/Adware.MultiPlug.A Anwendung" ac=I fn="C:\Users\All Users\ssavernet\Omblf.x64.dll"
sh=529F1CB730B133C2264E3451DCCC7DEEB179C135 ft=1 fh=2c963b952ca2f278 vn="möglicherweise Variante von Win32/Adware.Yontoo.B Anwendung" ac=I fn="C:\Users\All Users\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll"
sh=0C9A08B5ADD21D4140312B82FB77DA525540781F ft=1 fh=c85f1c8d2521187b vn="Win32/ELEX.Y Anwendung" ac=I fn="C:\Users\All Users\WPM\wprotectmanager.exe"
sh=9B7AFC05F48AE3F56DBE1A2114F8FDF50067A187 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.C Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\plugin@getwebcake.com\content\overlay.js"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_20.dll"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_21.dll"
sh=7C15DA5A80F24F0383C992CFB03CF68E95A464B1 ft=1 fh=be427aaf403ae2ff vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_22.dll"
sh=95544372D9D68E8AFAE5E9DA8B07C14CE5406ABB ft=1 fh=dd489ec711c15129 vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_23.dll"
sh=BA8871127FB23B24A8963B6A5992DED58259E590 ft=1 fh=65df87dcc97c6ea8 vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_24.dll"
sh=C88DAF3FB5D3FEC090233FF251F7F0CFC73EF4CD ft=1 fh=b74c7f4df627386b vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_25.dll"
sh=4B9D59EFA89F628628CE74083961743D56E460C7 ft=1 fh=8e9074b2b2075a48 vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\staged\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_26.dll"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_20.dll"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_21.dll"
sh=7C15DA5A80F24F0383C992CFB03CF68E95A464B1 ft=1 fh=be427aaf403ae2ff vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_22.dll"
sh=95544372D9D68E8AFAE5E9DA8B07C14CE5406ABB ft=1 fh=dd489ec711c15129 vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_23.dll"
sh=BA8871127FB23B24A8963B6A5992DED58259E590 ft=1 fh=65df87dcc97c6ea8 vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_24.dll"
sh=C88DAF3FB5D3FEC090233FF251F7F0CFC73EF4CD ft=1 fh=b74c7f4df627386b vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_25.dll"
sh=4B9D59EFA89F628628CE74083961743D56E460C7 ft=1 fh=8e9074b2b2075a48 vn="Variante von Win32/Toolbar.Linkury.D Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\{5e8cfb7c-9571-40c6-593c-72d5d5000fbd}\components\SmartbarFireFoxRemotePlugin_26.dll"
sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\newnext.me\nengine.dll"
sh=C7759E1F0D3AD2530280372D806703390469B07C ft=1 fh=930db3a9eb64adf6 vn="MSIL/WebCake.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Web Cake\WebCakeDesktop.exe"
sh=083578D20F8CC3E69880AFE4FB7DA7A914749F7F ft=1 fh=c4e2fe7cd871b525 vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Web Cake\dat\Desktop.OS.dll"
sh=769727FD17408B4FB051A5062DAE6C45EFDE7288 ft=1 fh=f7eaf69907b5b1c6 vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Web Cake\dat\Dora.dat"
sh=D3DDE80F947D835ECA1E4000BB6CC5647BE1E930 ft=1 fh=22ccd58d510d52b3 vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Web Cake\dat\Maintain.dat"
sh=1CD330953E443B78B91ED9F5FD3E5A4A2016ACEF ft=1 fh=a77d7df660e618ca vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Web Cake\dat\Paladin.dat"
sh=3974AF6435D0019AA8C84BE925611F9287976CC4 ft=1 fh=8821c6c28bcd590e vn="MSIL/WebCake.B Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\WebCake\WebCakeDesktop.exe"
sh=42E379BFED20E064EBBC9E6531D66AEC786A5EAF ft=1 fh=a202d4e343e2b6bc vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\WebCake\dat\Desktop.OS.dll"
sh=40BF3E2590407AAA3C6F64D95897AFDAC0714415 ft=1 fh=9f2ca99ed7c42045 vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\WebCake\dat\Maintain.dat"
sh=73CA8D583BE312B86714AB1C0062F8C6310552D0 ft=1 fh=7c8304ecb2bb93d2 vn="Variante von MSIL/WebCake.A Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\WebCake\dat\Phoenix.dat"
sh=63715B98C088697D5377512465ECD15C3A28D555 ft=1 fh=8c56694c19d19ac2 vn="Win32/Systweak.B Anwendung" ac=I fn="C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Cache\f_019e36"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask Anwendung" ac=I fn="C:\Users\********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\288QFQVY\ApnIC[1].0"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask Anwendung" ac=I fn="C:\Users\********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40E9TS8T\ApnIC[2].0"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask Anwendung" ac=I fn="C:\Users\********\AppData\Local\Temp\AskSLib.dll"
sh=D134620909646C026597EDAED6C66D3330121B23 ft=1 fh=ae250d5f9fbfd3d7 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\********\AppData\Local\Temp\SPSetup.exe"
sh=D20EFF4727F4C62E0A1DA72A33A15141D14C7B00 ft=1 fh=6a829f2f06893100 vn="Win32/SoftonicDownloader.A Anwendung" ac=I fn="C:\Users\********\Desktop\********\********\Documents\SoftonicDownloader_fuer_photoscape.exe"
sh=98E7840FB4DE98754E4FF3AFB070BB8DA674E559 ft=1 fh=290f66374ee3609e vn="Variante von Win32/Amonetize.AA Anwendung" ac=I fn="C:\Users\********\Downloads\FlashPlayersetup__5047_i259476686_il3.exe"
sh=32AB8402C00133BA185701AD5757FFF5C8F4113D ft=1 fh=443e49c17f7dce6a vn="Variante von Win32/DomaIQ.AU Anwendung" ac=I fn="C:\Users\********\Downloads\Java (1).exe"
sh=ACE2DF3C7FE6789D6A048F61BA4402C59C96BF49 ft=1 fh=b5a7263a2d443da4 vn="Variante von Win32/DomaIQ.AU Anwendung" ac=I fn="C:\Users\********\Downloads\Java (2).exe"
sh=7EDAA44ADE988BF3D5B2AEB67597A2E372B1D7E7 ft=1 fh=bfe34dea7f7dce6a vn="Variante von Win32/DomaIQ.AU Anwendung" ac=I fn="C:\Users\********\Downloads\Java.exe"
sh=2B2583156E081741934E9597BAE94A6A31AEC0EE ft=1 fh=66fd71310b33436c vn="Win32/Systweak.B Anwendung" ac=I fn="C:\Users\********\Downloads\rcpsetupapnnew_apnnew2_1637942_de_bp.exe"
sh=63715B98C088697D5377512465ECD15C3A28D555 ft=1 fh=8c56694c19d19ac2 vn="Win32/Systweak.B Anwendung" ac=I fn="C:\Users\********\Downloads\rcpsetupmapp1_mapp12133923 (1).exe"
sh=63715B98C088697D5377512465ECD15C3A28D555 ft=1 fh=8c56694c19d19ac2 vn="Win32/Systweak.B Anwendung" ac=I fn="C:\Users\********\Downloads\rcpsetupmapp1_mapp12133923.exe"
sh=7939E9B0D322B707F2C275F43F9D859F86AECD9A ft=1 fh=c37ca0261b980431 vn="Win32/Systweak.B Anwendung" ac=I fn="C:\Users\********\Downloads\rcpsetup_apptvlatest_apptvlatest (1).exe"
sh=7939E9B0D322B707F2C275F43F9D859F86AECD9A ft=1 fh=c37ca0261b980431 vn="Win32/Systweak.B Anwendung" ac=I fn="C:\Users\********\Downloads\rcpsetup_apptvlatest_apptvlatest.exe"
sh=7AAA501C0FCB5E132477DB2AB697D203A906ED25 ft=1 fh=7c42570759e2973f vn="Variante von Win32/DomaIQ.AU Anwendung" ac=I fn="C:\Users\********\Downloads\Setup (1).exe"
sh=D791771F436A607BA455015101DBD24325A6A507 ft=1 fh=c0fd1133e1b10f71 vn="Variante von Win32/DomaIQ.AU Anwendung" ac=I fn="C:\Users\********\Downloads\Setup (2).exe"
sh=AFB540CC537C125711A10462FB82E04E7DEC3A29 ft=1 fh=c3206156d7d51dc2 vn="MSIL/DomaIQ.Q Anwendung" ac=I fn="C:\Users\********\Downloads\Setup (3).exe"
sh=3CCF9E203120AB98BC5A2673FBE1671C0021F66E ft=1 fh=989b260ee54ecc6a vn="Variante von Win32/Bundlore.B Anwendung" ac=I fn="C:\Users\********\Downloads\setup (4).exe"
sh=1B4E77AC779188B16D5520098D7E28045FA91E93 ft=1 fh=d39babe41518a237 vn="Variante von Win32/DomaIQ.AV Anwendung" ac=I fn="C:\Users\********\Downloads\Setup (5).exe"
sh=B89804DF9CFED73A41827DD814E8FE1D6F6D5046 ft=1 fh=863ae77c3a7b53cc vn="Variante von Win32/DomaIQ.AU Anwendung" ac=I fn="C:\Users\********\Downloads\Setup.exe"
sh=F48616709AE69F6EBACFB8E6F1A9CB5A38141071 ft=1 fh=d1a4ad2182de81b5 vn="Win32/SpeedUpMyPC.A Anwendung" ac=I fn="C:\Users\********\Downloads\speedupmypc_747063_.exe"
sh=4AA106F12DFEF9C4314AF80050710C2B6813B5F9 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Windows\Installer\1e989b.msi"
sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[1].0"
sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[1].0"
sh=6C24897BCABE6DEFC5C247B77AA19E9DD5214BC2 ft=1 fh=2900c2c2b254b4d8 vn="Variante von Win32/SProtector.D Anwendung" ac=I fn="C:\Windows\Temp\2570bd6c.ftf.ftf"
sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask Anwendung" ac=I fn="C:\Windows\Temp\AskSLib.dll"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D Anwendung" ac=I fn="C:\Windows\Temp\avnwldrtemp\setup\Offercast_AVIRAV7_.exe"

# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=72bd3805521f1c42a32331b62f430605
# engine=16886
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-31 06:55:48
# local_time=2014-01-31 07:55:48 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 75297 142824398 0 0
# scanned=336759
# found=2
# cleaned=0
# scan_time=9854
sh=92340259E280930948E65E7580F7CA3FE5E0ED78 ft=1 fh=73e5c66e71fb7aeb vn="Variante von Win32/SpeedingUpMyPC Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe.vir"
sh=9B7AFC05F48AE3F56DBE1A2114F8FDF50067A187 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.C Anwendung" ac=I fn="C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\nnvudcmo.default\extensions\plugin@getwebcake.com\content\overlay.js"

FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by ******** (administrator) on ********-PC on 31-01-2014 20:37:12
Running from C:\Users\********\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.EXE
() C:\Users\********\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corp.) C:\Windows\System32\Defrag.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [761536 2013-12-26] ()
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
MountPoints2: {b4b792a0-7837-11e2-959f-b870f4df384e} - E:\Startme.exe
HKU\********\...\Run: [WebCake Desktop] - C:\Users\********\AppData\Roaming\Betcat\WebCakeDesktop.exe
HKU\********\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\********\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\********\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
HKU\********\...\Run: [Browser Infrastructure Helper] - C:\Users\********\AppData\Local\Smartbar\Application\SnapDo.exe startup
HKU\********\...\Run: [Driver Pro] - C:\Program Files (x86)\Driver Pro\DPLauncher.exe
HKU\********\...\Run: [PC Speed Maximizer] - C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-03-30] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [193128 2011-03-30] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll No File
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO: Feven 2.5 - {11111111-1111-1111-1111-110411901108} - C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll No File
BHO: Plus-HD-5.5 - {11111111-1111-1111-1111-110411901160} - C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: downloadiotKeep - {A8A56ADD-A5ED-734F-1D22-0949078095CF} - C:\ProgramData\downloadiotKeep\gpM.x64.dll No File
BHO: ssavernet - {B53AE25A-08F3-320F-8293-BAD1C3FF3B2C} - C:\ProgramData\ssavernet\Omblf.x64.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: ICQ Sparberater - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8773_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Norton Confidential) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.6.10_0\npcoplgn.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-21]
CHR Extension: (Plus-HD-5.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoilcbjfkbdplcfglkiedhefcomondlk [2014-01-05]
CHR Extension: (Google Drive) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-21]
CHR Extension: (Feven 1.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-12-31]
CHR Extension: (YouTube) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-21]
CHR Extension: (downloadiotKeep) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfaknkffffmbadnnkpoimdkaaahgflcg [2014-01-29]
CHR Extension: (Google-Suche) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-21]
CHR Extension: (Re-markit) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel [2013-12-30]
CHR Extension: (Skype Click to Call) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-01-21]
CHR Extension: (Norton Identity Protection) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-01-21]
CHR Extension: (Google Wallet) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (ICQ Sparberater) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo [2013-01-21]
CHR Extension: (Google Mail) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-21]
CHR Extension: (Feven 2.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbhkhbgdaamliaimlpdlhokkecoibka [2014-01-12]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-11-14]
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.3.671.crx [2011-12-28]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-05-10] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [39528 2011-01-18] (Acer Incorporated)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S3 lxcg_device; C:\Windows\system32\lxcgcoms.exe [451584 2005-07-25] ( )
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-31 19:57 - 2014-01-31 19:57 - 00000291 _____ C:\Users\********\Desktop\ESET.txt
2014-01-31 17:07 - 2014-01-31 17:03 - 00987425 _____ C:\Users\********\Desktop\SecurityCheck.exe
2014-01-31 17:07 - 2014-01-30 21:30 - 02347384 _____ (ESET) C:\Users\********\Desktop\esetsmartinstaller_deu.exe
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:41 - 2014-01-30 22:45 - 00000000 ____D C:\AdwCleaner
2014-01-30 22:40 - 2014-01-30 22:38 - 01166132 _____ C:\Users\********\Desktop\adwcleaner.exe
2014-01-30 22:40 - 2014-01-30 22:38 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:52 - 2014-01-30 21:55 - 00000000 ____D C:\Windows\system32\MRT
2014-01-30 21:52 - 2014-01-06 16:20 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ C:\Users\********\Desktop\GMER.log
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 19:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:03 - 2014-01-31 20:37 - 00016384 _____ C:\Users\********\Desktop\FRST.txt
2014-01-30 18:03 - 2014-01-31 20:37 - 00000000 ____D C:\FRST
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\********\defogger_reenable
2014-01-30 18:01 - 2014-01-30 17:59 - 00380416 _____ C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 18:01 - 2014-01-30 17:58 - 02079744 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 18:01 - 2014-01-30 17:56 - 00050477 _____ C:\Users\********\Desktop\Defogger.exe
2014-01-30 15:19 - 2014-01-30 15:28 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-30 20:36 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-15 10:23 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:23 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:23 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\********\Desktop\********
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-12 15:56 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2014-01-12 15:54 - 2014-01-30 20:37 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\********\Downloads\setup (4).exe
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\********\Documents\ADOLF.xps
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log
2014-01-05 10:16 - 2014-01-05 10:20 - 00000000 ____D C:\Program Files (x86)\VideoPlayer

==================== One Month Modified Files and Folders =======

2014-01-31 20:37 - 2014-01-30 18:03 - 00016384 _____ C:\Users\********\Desktop\FRST.txt
2014-01-31 20:37 - 2014-01-30 18:03 - 00000000 ____D C:\FRST
2014-01-31 20:13 - 2011-11-19 12:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-31 20:08 - 2012-06-16 12:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-31 19:57 - 2014-01-31 19:57 - 00000291 _____ C:\Users\********\Desktop\ESET.txt
2014-01-31 19:08 - 2011-08-16 03:33 - 01684730 _____ C:\Windows\WindowsUpdate.log
2014-01-31 17:13 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-31 17:13 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-31 17:06 - 2013-01-21 11:30 - 00000000 ____D C:\Users\********\AppData\Local\CrashDumps
2014-01-31 17:06 - 2012-06-25 10:20 - 00000000 ____D C:\Users\Public\Documents\phase6_19_Daten
2014-01-31 17:06 - 2011-11-19 12:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-31 17:06 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-31 17:06 - 2009-07-14 05:51 - 00180727 _____ C:\Windows\setupact.log
2014-01-31 17:03 - 2014-01-31 17:07 - 00987425 _____ C:\Users\********\Desktop\SecurityCheck.exe
2014-01-31 07:31 - 2013-12-31 09:36 - 00002775 _____ C:\Users\********\daemonprocess.txt
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:45 - 2014-01-30 22:41 - 00000000 ____D C:\AdwCleaner
2014-01-30 22:45 - 2012-01-01 17:02 - 00000000 ____D C:\ProgramData\ICQ
2014-01-30 22:44 - 2011-08-16 13:23 - 00716782 _____ C:\Windows\system32\perfh007.dat
2014-01-30 22:44 - 2011-08-16 13:23 - 00155688 _____ C:\Windows\system32\perfc007.dat
2014-01-30 22:44 - 2009-07-14 06:13 - 01656284 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-30 22:38 - 2014-01-30 22:40 - 01166132 _____ C:\Users\********\Desktop\adwcleaner.exe
2014-01-30 22:38 - 2014-01-30 22:40 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:55 - 2014-01-30 21:52 - 00000000 ____D C:\Windows\system32\MRT
2014-01-30 21:55 - 2011-08-16 03:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2014-01-30 21:30 - 2014-01-31 17:07 - 02347384 _____ (ESET) C:\Users\********\Desktop\esetsmartinstaller_deu.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ C:\Users\********\Desktop\GMER.log
2014-01-30 20:38 - 2013-12-30 19:45 - 00000000 ____D C:\ProgramData\WPM
2014-01-30 20:38 - 2010-11-21 04:47 - 00652296 _____ C:\Windows\PFRO.log
2014-01-30 20:37 - 2014-01-12 15:54 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-30 20:36 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-30 20:36 - 2013-07-29 13:47 - 00000000 ____D C:\Users\********\AppData\Roaming\Web Cake
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:15 - 2011-12-31 17:43 - 00000000 ____D C:\Windows\Minidump
2014-01-30 18:14 - 2011-12-31 17:43 - 901918507 _____ C:\Windows\MEMORY.DMP
2014-01-30 18:14 - 2011-07-20 15:06 - 00000000 ____D C:\ProgramData\Norton
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\********\defogger_reenable
2014-01-30 18:02 - 2013-01-17 17:32 - 00000000 ____D C:\Users\********
2014-01-30 17:59 - 2014-01-30 18:01 - 00380416 _____ C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 17:58 - 2014-01-30 18:01 - 02079744 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 17:56 - 2014-01-30 18:01 - 00050477 _____ C:\Users\********\Desktop\Defogger.exe
2014-01-30 17:41 - 2011-11-02 17:08 - 00000000 ____D C:\ProgramData\Avira
2014-01-30 15:28 - 2014-01-30 15:19 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-28 16:34 - 2009-07-14 05:45 - 00314984 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-28 16:32 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-16 09:59 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-15 11:10 - 2011-10-15 19:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-14 13:12 - 2011-10-15 19:00 - 00000000 ____D C:\Users\********\AppData\Roaming\Mozilla
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\********\Desktop\********
2014-01-14 13:11 - 2011-10-16 00:49 - 00000000 ____D C:\Users\********
2014-01-14 13:06 - 2013-12-30 19:45 - 00000276 _____ C:\Users\********\daemonprocess.txt
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\********\Downloads\setup (4).exe
2014-01-08 17:22 - 2013-07-27 11:22 - 00000118 _____ C:\Users\********\AppData\Roaming\WB.CFG
2014-01-08 17:18 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-08 16:12 - 2012-03-07 07:49 - 01634178 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\********\Documents\ADOLF.xps
2014-01-06 16:20 - 2014-01-30 21:52 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-05 19:14 - 2013-09-15 16:32 - 00000000 ____D C:\ProgramData\EPSON
2014-01-05 19:09 - 2013-09-15 16:34 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2014-01-05 19:02 - 2013-09-15 16:36 - 00000942 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:20 - 2014-01-05 10:16 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log

Some content of TEMP:
====================
C:\Users\********\AppData\Local\Temp\AskSLib.dll
C:\Users\********\AppData\Local\Temp\avgnt.exe
C:\Users\********\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-05 13:33

==================== End Of Log ============================

--- --- ---

--- --- ---

Die von SecurityCheck geöffnete Textdatei (checkup.txt) ist leider komplett leer.
Während der Ausführung kommt mehrmals die Output-Line "Das System kann den angegebenen Pfad nicht finden", ganz am Anfang vorm Start z.B.

Code:

ATTFilter

Das System kann den angegebenen Pfad nicht finden
Der Befehl "B~1\AppData\Local\Temp\RarSFX0\SecurityCheck" ist entweder falsch geschrieben oder konnte nicht gefunden werden

Meinst Du mit der Frage, ob ich noch Probleme habe, inwiefern noch Symptome vorhanden sind?
Die Symptome die anfangs auftraten waren:

Amok laufende AntivirenProgramme (mehrere installiert)
AdvancedSystemProtector am mehrere hundert Probleme melden
Leistungstechnisch stark eingeschränktes System

Nach den von mir oben beschriebenen Aktionen (kollidierende Virenprogramme alle deinstallieren, MalwareBytes alle Adware/Rogue Security Software löschen lassen) sind die ersten beiden Punkte nun verständlicherweise gelöst.

Ob das System leistungstechnisch noch eingeschränkt ist kann ich nicht sagen da der Laptop einer Bekannten gehört und ich deswegen nicht wirklich einschätzen kann, ob die Systemleistung so normal oder ungewöhnlich langsam ist.
In Betracht der verbauten Komponenten scheint mir die Geschwindigkeit z.B. beim Öffnen von Anwendungen durchaus plausibel.

Direkt sind also keine Sympthome mehr erkennbar - aber das waren Sie schon nicht mehr, als ich diesen Thread eröffnet habe

Weisen die Logs denn auf eine nach wie vor vorhandene Beeinträchtigung hin?
Die nicht gefundenen Pfade, sind diese ein Problem oder "normal", wenn keine Schadsoftware mehr ausgeführt wird?

Vielen Dank
Philipp

schrauber · 01.02.2014, 17:27

Securitycheck hat nen Macken. Den Großteil haben wir, da ist aber noch was:

FRST bitte öffnen, setz nen Haken bei Additional und scanne, poste beide Logfiles.

waldiphil · 01.02.2014, 19:24

Hallo,

FRST.txt

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by ******** (administrator) on ********-PC on 01-02-2014 19:13:32
Running from C:\Users\********\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.EXE
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Windows\System32\userinit.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [761536 2013-12-26] ()
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
MountPoints2: {b4b792a0-7837-11e2-959f-b870f4df384e} - E:\Startme.exe
HKU\********\...\Run: [WebCake Desktop] - C:\Users\********\AppData\Roaming\Betcat\WebCakeDesktop.exe
HKU\********\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\********\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\********\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
HKU\********\...\Run: [Browser Infrastructure Helper] - C:\Users\********\AppData\Local\Smartbar\Application\SnapDo.exe startup
HKU\********\...\Run: [Driver Pro] - C:\Program Files (x86)\Driver Pro\DPLauncher.exe
HKU\********\...\Run: [PC Speed Maximizer] - C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-03-30] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [193128 2011-03-30] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll No File
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO: Feven 2.5 - {11111111-1111-1111-1111-110411901108} - C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll No File
BHO: Plus-HD-5.5 - {11111111-1111-1111-1111-110411901160} - C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: downloadiotKeep - {A8A56ADD-A5ED-734F-1D22-0949078095CF} - C:\ProgramData\downloadiotKeep\gpM.x64.dll No File
BHO: ssavernet - {B53AE25A-08F3-320F-8293-BAD1C3FF3B2C} - C:\ProgramData\ssavernet\Omblf.x64.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: ICQ Sparberater - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8773_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Norton Confidential) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.6.10_0\npcoplgn.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-21]
CHR Extension: (Plus-HD-5.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoilcbjfkbdplcfglkiedhefcomondlk [2014-01-05]
CHR Extension: (Google Drive) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-21]
CHR Extension: (Feven 1.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-12-31]
CHR Extension: (YouTube) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-21]
CHR Extension: (downloadiotKeep) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfaknkffffmbadnnkpoimdkaaahgflcg [2014-01-29]
CHR Extension: (Google-Suche) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-21]
CHR Extension: (Re-markit) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel [2013-12-30]
CHR Extension: (Skype Click to Call) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-01-21]
CHR Extension: (Norton Identity Protection) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-01-21]
CHR Extension: (Google Wallet) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (ICQ Sparberater) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo [2013-01-21]
CHR Extension: (Google Mail) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-21]
CHR Extension: (Feven 2.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbhkhbgdaamliaimlpdlhokkecoibka [2014-01-12]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-11-14]
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.3.671.crx [2011-12-28]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-05-10] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [39528 2011-01-18] (Acer Incorporated)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S3 lxcg_device; C:\Windows\system32\lxcgcoms.exe [451584 2005-07-25] ( )
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-01 19:13 - 2014-02-01 19:14 - 00016035 _____ C:\Users\********\Desktop\FRST.txt
2014-01-31 17:07 - 2014-01-31 17:03 - 00987425 _____ C:\Users\********\Desktop\SecurityCheck.exe
2014-01-31 17:07 - 2014-01-30 21:30 - 02347384 _____ (ESET) C:\Users\********\Desktop\esetsmartinstaller_deu.exe
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:41 - 2014-01-30 22:45 - 00000000 ____D C:\AdwCleaner
2014-01-30 22:40 - 2014-01-30 22:38 - 01166132 _____ C:\Users\********\Desktop\adwcleaner.exe
2014-01-30 22:40 - 2014-01-30 22:38 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:52 - 2014-01-30 21:55 - 00000000 ____D C:\Windows\system32\MRT
2014-01-30 21:52 - 2014-01-06 16:20 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ C:\Users\********\Desktop\GMER.log
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 19:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:03 - 2014-02-01 19:13 - 00000000 ____D C:\FRST
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\********\defogger_reenable
2014-01-30 18:01 - 2014-01-30 17:59 - 00380416 _____ C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 18:01 - 2014-01-30 17:58 - 02079744 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 18:01 - 2014-01-30 17:56 - 00050477 _____ C:\Users\********\Desktop\Defogger.exe
2014-01-30 15:19 - 2014-01-30 15:28 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-30 20:36 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-15 10:23 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:23 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:23 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\********\Desktop\********
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-12 15:56 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2014-01-12 15:54 - 2014-01-30 20:37 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\********\Downloads\setup (4).exe
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\********\Documents\ADOLF.xps
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log
2014-01-05 10:16 - 2014-01-05 10:20 - 00000000 ____D C:\Program Files (x86)\VideoPlayer

==================== One Month Modified Files and Folders =======

2014-02-01 19:14 - 2014-02-01 19:13 - 00016035 _____ C:\Users\********\Desktop\FRST.txt
2014-02-01 19:13 - 2014-01-30 18:03 - 00000000 ____D C:\FRST
2014-02-01 19:13 - 2013-01-21 11:30 - 00000000 ____D C:\Users\********\AppData\Local\CrashDumps
2014-02-01 19:13 - 2012-06-25 10:20 - 00000000 ____D C:\Users\Public\Documents\phase6_19_Daten
2014-02-01 19:13 - 2011-11-19 12:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-01 19:13 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-02-01 19:13 - 2009-07-14 05:51 - 00180783 _____ C:\Windows\setupact.log
2014-01-31 21:52 - 2013-12-31 09:36 - 00003051 _____ C:\Users\********\daemonprocess.txt
2014-01-31 21:52 - 2011-08-16 03:33 - 01695446 _____ C:\Windows\WindowsUpdate.log
2014-01-31 21:13 - 2011-11-19 12:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-31 21:08 - 2012-06-16 12:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-31 17:13 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-31 17:13 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-31 17:03 - 2014-01-31 17:07 - 00987425 _____ C:\Users\********\Desktop\SecurityCheck.exe
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:45 - 2014-01-30 22:41 - 00000000 ____D C:\AdwCleaner
2014-01-30 22:45 - 2012-01-01 17:02 - 00000000 ____D C:\ProgramData\ICQ
2014-01-30 22:44 - 2011-08-16 13:23 - 00716782 _____ C:\Windows\system32\perfh007.dat
2014-01-30 22:44 - 2011-08-16 13:23 - 00155688 _____ C:\Windows\system32\perfc007.dat
2014-01-30 22:44 - 2009-07-14 06:13 - 01656284 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-30 22:38 - 2014-01-30 22:40 - 01166132 _____ C:\Users\********\Desktop\adwcleaner.exe
2014-01-30 22:38 - 2014-01-30 22:40 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:55 - 2014-01-30 21:52 - 00000000 ____D C:\Windows\system32\MRT
2014-01-30 21:55 - 2011-08-16 03:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2014-01-30 21:30 - 2014-01-31 17:07 - 02347384 _____ (ESET) C:\Users\********\Desktop\esetsmartinstaller_deu.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ C:\Users\********\Desktop\GMER.log
2014-01-30 20:38 - 2013-12-30 19:45 - 00000000 ____D C:\ProgramData\WPM
2014-01-30 20:38 - 2010-11-21 04:47 - 00652296 _____ C:\Windows\PFRO.log
2014-01-30 20:37 - 2014-01-12 15:54 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-30 20:36 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-30 20:36 - 2013-07-29 13:47 - 00000000 ____D C:\Users\********\AppData\Roaming\Web Cake
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:15 - 2011-12-31 17:43 - 00000000 ____D C:\Windows\Minidump
2014-01-30 18:14 - 2011-12-31 17:43 - 901918507 _____ C:\Windows\MEMORY.DMP
2014-01-30 18:14 - 2011-07-20 15:06 - 00000000 ____D C:\ProgramData\Norton
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\********\defogger_reenable
2014-01-30 18:02 - 2013-01-17 17:32 - 00000000 ____D C:\Users\********
2014-01-30 17:59 - 2014-01-30 18:01 - 00380416 _____ C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 17:58 - 2014-01-30 18:01 - 02079744 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 17:56 - 2014-01-30 18:01 - 00050477 _____ C:\Users\********\Desktop\Defogger.exe
2014-01-30 17:41 - 2011-11-02 17:08 - 00000000 ____D C:\ProgramData\Avira
2014-01-30 15:28 - 2014-01-30 15:19 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-28 16:34 - 2009-07-14 05:45 - 00314984 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-28 16:32 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-16 09:59 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-15 11:10 - 2011-10-15 19:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-14 13:12 - 2011-10-15 19:00 - 00000000 ____D C:\Users\********\AppData\Roaming\Mozilla
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\********\Desktop\********
2014-01-14 13:11 - 2011-10-16 00:49 - 00000000 ____D C:\Users\********
2014-01-14 13:06 - 2013-12-30 19:45 - 00000276 _____ C:\Users\********\daemonprocess.txt
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\********\Downloads\setup (4).exe
2014-01-08 17:22 - 2013-07-27 11:22 - 00000118 _____ C:\Users\********\AppData\Roaming\WB.CFG
2014-01-08 17:18 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-08 16:12 - 2012-03-07 07:49 - 01634178 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\********\Documents\ADOLF.xps
2014-01-06 16:20 - 2014-01-30 21:52 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-05 19:14 - 2013-09-15 16:32 - 00000000 ____D C:\ProgramData\EPSON
2014-01-05 19:09 - 2013-09-15 16:34 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2014-01-05 19:02 - 2013-09-15 16:36 - 00000942 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:20 - 2014-01-05 10:16 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log

Some content of TEMP:
====================
C:\Users\********\AppData\Local\Temp\AskSLib.dll
C:\Users\********\AppData\Local\Temp\avgnt.exe
C:\Users\********\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-05 13:33

==================== End Of Log ============================

--- --- ---

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014 01
Ran by ******** at 2014-02-01 19:14:49
Running from C:\Users\********\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (x32 Version:  - Microsoft)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.631.5823 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.631.5823 - ABBYY) Hidden
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.) Hidden
Adobe Community Help (x32 Version: 3.2.1 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.2.1.650 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Photoshop Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Premiere Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated)
Adobe Premiere Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.3) - Deutsch (x32 Version: 10.1.3 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
ALDI Bestellsoftware 4.12.1 (x32 Version: 4.12.1 - ORWO Net)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Benutzerhandbuch - Grundlagen EPSON XP-302 303 305 306 Series (x32 Version:  - )
Benutzerhandbuch EPSON XP-302 303 305 306 Series (x32 Version:  - )
Bing Bar (x32 Version: 7.3.124.0 - Microsoft Corporation)
Broadcom Card Reader Driver Installer (Version: 14.8.2.2 - Broadcom Corporation)
Broadcom NetLink Controller (Version: 14.8.4.1 - Broadcom Corporation)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Crazy Chicken Kart 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.)
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DMUninstaller (x32 Version:  - )
downloadiotKeep (x32 Version:  - daowNloadietkeepp)
E.M. Free Photo Collage 1.30 (x32 Version:  - EffectMatrix, Inc.)
E.M. Multilayer Image Processing SDK 1.30 (x32 Version:  - EffectMatrix, Inc.)
eBay Worldwide (x32 Version: 2.2.0409 - OEM)
Elements 9 Organizer (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Elements STI Installer (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
ElsterFormular (x32 Version: 12.4.0.7094u - Landesfinanzdirektion Thüringen)
ElsterFormular (x32 Version: 13.0.0.8086k - Landesfinanzdirektion Thüringen)
Epson Connect Printer Setup (x32 Version: 1.1.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print 2 (x32 Version: 2.4.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (x32 Version: 3.01.0000 - Seiko Epson Corporation)
Epson Netzwerkhandbuch EPSON XP-302 303 305 306 Series (x32 Version:  - )
EPSON Scan (x32 Version:  - Seiko Epson Corporation)
EPSON XP-302 303 305 306 Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (x32 Version: 2.6.0 - SEIKO EPSON CORPORATION)
ESET Online Scanner v3 (x32 Version:  - )
ETDWare PS/2-X64 8.0.6.3_WHQL (Version: 8.0.6.3 - ELAN Microelectronic Corp.)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Guard.ICQ (x32 Version:  - Mail.ru)
HomeMedia (x32 Version: 2.0.8920 - CyberLink Corporation)
ICQ Sparberater (x32 Version: 1.3.671 - solute gmbh)
ICQ7.7 (x32 Version: 7.7 - ICQ)
Identity Card (x32 Version: 1.00.3501 - Packard Bell)
Image Converter (x32 Version: 1.0.0 - Image Converter)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2418 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 10.5.0.1026 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (x32 Version: 5.1.7 - Packard Bell)
Lexmark 2300 Series (Version:  - )
Lexmark Fax-Lösungen (Version:  - Lexmark International, Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Mobogenie (x32 Version:  - Mobogenie.com) <==== ATTENTION
Mozilla Firefox 12.0 (x86 de) (x32 Version: 12.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 12.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Nero BackItUp 10 (x32 Version: 5.8.11000.8.100 - Nero AG)
Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.6.12700.0.7 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.19900.9.11 - Nero AG) Hidden
Nero DiscSpeed 10 (x32 Version: 6.2.10500.2.100 - Nero AG)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Express 10 (x32 Version: 10.6.10700.5.100 - Nero AG)
Nero Express 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Multimedia Suite 10 Essentials (x32 Version: 10.5.10300 - Nero AG)
Nero Multimedia Suite 10 Essentials (x32 Version: 10.6.10300 - Nero AG)
Nero RescueAgent 10 (x32 Version: 3.6.10500.3.100 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero StartSmart 10 (x32 Version: 10.2.11600.14.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Update (x32 Version: 1.0.10900.31.0 - Nero AG)
NewPlayer (x32 Version: v2.1.1.0 - TUGUU SL)
Norton Online Backup (x32 Version: 2.1.17869 - Symantec Corporation)
NVIDIA Grafiktreiber 268.00 (Version: 268.00 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.39.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.0.21 (Version: 1.0.21 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Systemsteuerung 268.00 (Version: 268.00 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.0.21 - NVIDIA Corporation) Hidden
Packard Bell Games (x32 Version: 1.0.2.5 - WildTangent)
Packard Bell Power Management (x32 Version: 6.00.3007 - Packard Bell)
Packard Bell Recovery Management (x32 Version: 5.00.3502 - Packard Bell)
Packard Bell Registration (x32 Version: 1.04.3502 - Packard Bell)
Packard Bell ScreenSaver (x32 Version: 1.1.0811.2010 - Packard Bell )
Packard Bell Social Networks (x32 Version: 3.0.3106 - CyberLink Corp.)
Packard Bell Social Networks (x32 Version: 3.0.3106 - CyberLink Corp.) Hidden
Packard Bell Updater (x32 Version: 1.02.3500 - Packard Bell)
PC Speed Maximizer v3.2 (x32 Version: 3.2 - Smart PC Solutions)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
phase6_19 (x32 Version: 1.90.0000 - phase6)
PhotoScape (x32 Version:  - )
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6329 - Realtek Semiconductor Corp.)
Shape Collage (x32 Version:  - Shape Collage Inc.)
Skype Click to Call (x32 Version: 5.7.8773 - Skype Technologies S.A.)
Skype™ 5.10 (x32 Version: 5.10.116 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Snap.Do (x32 Version: 10.239.1.14117 - ReSoft Ltd.) <==== ATTENTION
Software Updater (x32 Version: 4.1.7 - SEIKO EPSON CORPORATION)
Torchlight (x32 Version: 2.2.0.97 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (x32 Version:  - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32 Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (x32 Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Video Web Camera (x32 Version: 1.0.1904 - CyberLink Corp.)
Video Web Camera (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden
VideoPlayer v2.0.6 (x32 Version: v2.0.6 - TUGUU SL)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (x32 Version: 1.02.3503 - Packard Bell)
WildTangent Games App (x32 Version: 4.0.10.17 - WildTangent) Hidden
Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

30-01-2014 20:52:25 Windows Update
30-01-2014 20:56:15 Windows-Sicherung
31-01-2014 20:52:11 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0064E14E-7D5C-487D-9C59-3BB86755F46D} - \Advanced System Protector No Task File
Task: {10CC0A8E-F1CC-4F1A-BA9B-DE0CE3F097AF} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {1478FF5A-7B87-475B-B554-506F547D0B0A} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-05-20] (CyberLink)
Task: {2CF0C97B-3642-4392-AA05-629759941371} - \Advanced System Protector_startup No Task File
Task: {3C35EBC1-1E2C-442A-B154-C2F0EF7217B6} - System32\Tasks\Adobe ARM => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {50AD98E7-C74D-4CE1-94C3-A7BF226985B0} - \DealPly No Task File
Task: {596274CB-F41D-4451-9AED-58B7F4CC835B} - System32\Tasks\NBAgent => C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2011-07-05] (Nero AG)
Task: {6417E783-9AA3-4666-AAC9-FE2ECF301096} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {81DE42FC-1CD9-4330-821F-23696E4E9194} - \Scheduled Update for Ask Toolbar No Task File
Task: {95B96EB5-CE94-47D2-AF32-90E60D57C1AC} - \EPUpdater No Task File
Task: {B71A07DD-050E-42E3-8645-433D275393F1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-13] (Adobe Systems Incorporated)
Task: {BDC660F8-997E-48FF-9FD3-5C5C6C4C1F21} - System32\Tasks\AdobeAAMUpdater-1.0-********-PC-******** => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)
Task: {C49D2CCE-D7B1-4F8A-B26C-F26A688B6126} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {CC9CD2D7-9BF8-4C98-8706-AE28BE7C27A2} - \DSite No Task File
Task: {DA68870B-F7F6-4016-82F4-625FBA2A8FBD} - \QtraxPlayer No Task File
Task: {E3AD84E9-5C14-4C38-A0D8-4A0CC6AD5306} - System32\Tasks\Adobe Reader Speed Launcher => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {FBDFCAF5-DAD1-4EFE-8170-71EFE525C035} - \RegClean Pro No Task File
Task: {FF2007C3-FD0B-47F7-859B-BEA666BDDB9E} - \DealPlyUpdate No Task File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-07-20 15:04 - 2011-06-10 18:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/01/2014 07:13:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0xcf8
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3

Error: (02/01/2014 07:13:11 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/31/2014 08:32:36 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/31/2014 05:07:22 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/31/2014 05:07:17 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/31/2014 05:07:07 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/31/2014 05:06:59 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/31/2014 05:06:36 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0xca4
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3

Error: (01/31/2014 05:06:35 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/30/2014 10:48:13 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0x908
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3


System errors:
=============
Error: (01/31/2014 08:38:36 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/30/2014 10:58:47 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/30/2014 10:53:42 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Live Updater Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/30/2014 10:48:08 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (01/30/2014 08:38:48 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/30/2014 08:38:47 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (01/30/2014 06:16:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/30/2014 06:15:43 PM) (Source: BugCheck) (User: )
Description: 0x00000109 (0xa3a039d897cf4574, 0xb3b7465eea4d80ae, 0xfffff880009f55c0, 0x0000000000000002)C:\Windows\MEMORY.DMP013014-57018-01

Error: (01/30/2014 06:15:25 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎30.‎01.‎2014 um 18:12:47 unerwartet heruntergefahren.

Error: (01/30/2014 05:43:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 20%
Total physical RAM: 5995.86 MB
Available physical RAM: 4764.65 MB
Total Pagefile: 11989.9 MB
Available Pagefile: 10676.71 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:445.66 GB) (Free:357.47 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: BEC6DCFE)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=446 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Viele Grüße
Philipp

schrauber · 02.02.2014, 07:21

Revo Uninstaller - Download - Filepony

Damit
Mobogenie (x32 Version: - Mobogenie.com) <==== ATTENTION
Snap.Do (x32 Version: 10.239.1.14117 - ReSoft Ltd.) <==== ATTENTION

Deinstallieren.

MBAM updaten, scannen und löschen lassen. AdwCleaner löschen, neu laden, nochmal suchen und löschen lassen.

Frisches FRST log bitte.

waldiphil · 02.02.2014, 14:46

Hallo,

alles gemacht, hier die Logs:

MBAM:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.02.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
******** :: ********-PC [Administrator]

02.02.2014 12:33:07
mbam-log-2014-02-02 (12-33-07).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 478375
Laufzeit: 59 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

AdwareCleaner:

Code:

ATTFilter

# AdwCleaner v3.018 - Bericht erstellt am 02/02/2014 um 14:18:57
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : ******** - ********-PC
# Gestartet von : C:\Users\********\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Google Chrome v31.0.1650.63

[ Datei : C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [16144 octets] - [30/01/2014 22:42:04]
AdwCleaner[R1].txt - [933 octets] - [02/02/2014 14:18:18]
AdwCleaner[S0].txt - [15536 octets] - [30/01/2014 22:44:52]
AdwCleaner[S1].txt - [855 octets] - [02/02/2014 14:18:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [914 octets] ##########

FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by ******** (administrator) on ********-PC on 02-02-2014 14:20:50
Running from C:\Users\********\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.EXE
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
MountPoints2: {b4b792a0-7837-11e2-959f-b870f4df384e} - E:\Startme.exe
HKU\********\...\Run: [WebCake Desktop] - C:\Users\********\AppData\Roaming\Betcat\WebCakeDesktop.exe
HKU\********\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\********\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\********\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\********\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
HKU\********\...\Run: [Browser Infrastructure Helper] - C:\Users\********\AppData\Local\Smartbar\Application\SnapDo.exe startup
HKU\********\...\Run: [Driver Pro] - C:\Program Files (x86)\Driver Pro\DPLauncher.exe
HKU\********\...\Run: [PC Speed Maximizer] - C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-03-30] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [193128 2011-03-30] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll No File
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO: Feven 2.5 - {11111111-1111-1111-1111-110411901108} - C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll No File
BHO: Plus-HD-5.5 - {11111111-1111-1111-1111-110411901160} - C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: downloadiotKeep - {A8A56ADD-A5ED-734F-1D22-0949078095CF} - C:\ProgramData\downloadiotKeep\gpM.x64.dll No File
BHO: ssavernet - {B53AE25A-08F3-320F-8293-BAD1C3FF3B2C} - C:\ProgramData\ssavernet\Omblf.x64.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: ICQ Sparberater - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8773_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Norton Confidential) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.6.10_0\npcoplgn.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-21]
CHR Extension: (Plus-HD-5.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoilcbjfkbdplcfglkiedhefcomondlk [2014-01-05]
CHR Extension: (Google Drive) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-21]
CHR Extension: (Feven 1.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-12-31]
CHR Extension: (YouTube) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-21]
CHR Extension: (downloadiotKeep) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfaknkffffmbadnnkpoimdkaaahgflcg [2014-01-29]
CHR Extension: (Google-Suche) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-21]
CHR Extension: (Skype Click to Call) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-01-21]
CHR Extension: (Google Wallet) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (ICQ Sparberater) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo [2013-01-21]
CHR Extension: (Google Mail) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-21]
CHR Extension: (Feven 2.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbhkhbgdaamliaimlpdlhokkecoibka [2014-01-12]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-11-14]
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.3.671.crx [2011-12-28]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-05-10] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [39528 2011-01-18] (Acer Incorporated)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S3 lxcg_device; C:\Windows\system32\lxcgcoms.exe [451584 2005-07-25] ( )
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-02 14:20 - 2014-02-02 14:20 - 00000993 _____ C:\Users\********\Desktop\AdwCleaner[S1].txt
2014-02-02 14:17 - 2014-02-02 14:17 - 01166132 _____ C:\Users\********\Desktop\adwcleaner.exe
2014-02-02 12:11 - 2014-02-02 12:11 - 00001276 _____ C:\Users\********\Desktop\Revo Uninstaller.lnk
2014-02-02 12:11 - 2014-02-02 12:11 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2014-02-02 12:11 - 2014-02-02 12:10 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\********\Desktop\revosetup95.exe
2014-02-01 19:14 - 2014-02-01 19:15 - 00033664 _____ C:\Users\********\Desktop\Addition.txt
2014-02-01 19:13 - 2014-02-02 14:21 - 00015480 _____ C:\Users\********\Desktop\FRST.txt
2014-01-31 17:07 - 2014-01-31 17:03 - 00987425 _____ C:\Users\********\Desktop\SecurityCheck.exe
2014-01-31 17:07 - 2014-01-30 21:30 - 02347384 _____ (ESET) C:\Users\********\Desktop\esetsmartinstaller_deu.exe
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:41 - 2014-02-02 14:19 - 00000000 ____D C:\AdwCleaner
2014-01-30 22:40 - 2014-01-30 22:38 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:52 - 2014-01-30 21:55 - 00000000 ____D C:\Windows\system32\MRT
2014-01-30 21:52 - 2014-01-06 16:20 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ C:\Users\********\Desktop\GMER.log
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 19:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:03 - 2014-02-02 14:20 - 00000000 ____D C:\FRST
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\********\defogger_reenable
2014-01-30 18:01 - 2014-01-30 17:59 - 00380416 _____ C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 18:01 - 2014-01-30 17:58 - 02079744 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 18:01 - 2014-01-30 17:56 - 00050477 _____ C:\Users\********\Desktop\Defogger.exe
2014-01-30 15:19 - 2014-01-30 15:28 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-30 20:36 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-15 10:23 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:23 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:23 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\********\Desktop\********
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-12 15:56 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2014-01-12 15:54 - 2014-01-30 20:37 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\********\Downloads\setup (4).exe
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\********\Documents\ADOLF.xps
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log
2014-01-05 10:16 - 2014-01-05 10:20 - 00000000 ____D C:\Program Files (x86)\VideoPlayer

==================== One Month Modified Files and Folders =======

2014-02-02 14:21 - 2014-02-01 19:13 - 00015480 _____ C:\Users\********\Desktop\FRST.txt
2014-02-02 14:20 - 2014-02-02 14:20 - 00000993 _____ C:\Users\********\Desktop\AdwCleaner[S1].txt
2014-02-02 14:20 - 2014-01-30 18:03 - 00000000 ____D C:\FRST
2014-02-02 14:20 - 2013-01-21 11:30 - 00000000 ____D C:\Users\********\AppData\Local\CrashDumps
2014-02-02 14:20 - 2012-06-25 10:20 - 00000000 ____D C:\Users\Public\Documents\phase6_19_Daten
2014-02-02 14:20 - 2011-11-19 12:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-02 14:20 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-02-02 14:19 - 2014-01-30 22:41 - 00000000 ____D C:\AdwCleaner
2014-02-02 14:19 - 2011-08-16 03:33 - 01729494 _____ C:\Windows\WindowsUpdate.log
2014-02-02 14:19 - 2009-07-14 05:51 - 00180895 _____ C:\Windows\setupact.log
2014-02-02 14:17 - 2014-02-02 14:17 - 01166132 _____ C:\Users\********\Desktop\adwcleaner.exe
2014-02-02 14:13 - 2011-11-19 12:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-02 14:08 - 2012-06-16 12:24 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-02 14:02 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2014-02-02 12:17 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-02 12:17 - 2009-07-14 05:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-02 12:11 - 2014-02-02 12:11 - 00001276 _____ C:\Users\********\Desktop\Revo Uninstaller.lnk
2014-02-02 12:11 - 2014-02-02 12:11 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2014-02-02 12:10 - 2014-02-02 12:11 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\********\Desktop\revosetup95.exe
2014-02-01 20:27 - 2013-12-31 09:36 - 00003189 _____ C:\Users\********\daemonprocess.txt
2014-02-01 19:15 - 2014-02-01 19:14 - 00033664 _____ C:\Users\********\Desktop\Addition.txt
2014-01-31 17:03 - 2014-01-31 17:07 - 00987425 _____ C:\Users\********\Desktop\SecurityCheck.exe
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:45 - 2012-01-01 17:02 - 00000000 ____D C:\ProgramData\ICQ
2014-01-30 22:44 - 2011-08-16 13:23 - 00716782 _____ C:\Windows\system32\perfh007.dat
2014-01-30 22:44 - 2011-08-16 13:23 - 00155688 _____ C:\Windows\system32\perfc007.dat
2014-01-30 22:44 - 2009-07-14 06:13 - 01656284 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-30 22:38 - 2014-01-30 22:40 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:55 - 2014-01-30 21:52 - 00000000 ____D C:\Windows\system32\MRT
2014-01-30 21:55 - 2011-08-16 03:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2014-01-30 21:30 - 2014-01-31 17:07 - 02347384 _____ (ESET) C:\Users\********\Desktop\esetsmartinstaller_deu.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ C:\Users\********\Desktop\GMER.log
2014-01-30 20:38 - 2013-12-30 19:45 - 00000000 ____D C:\ProgramData\WPM
2014-01-30 20:38 - 2010-11-21 04:47 - 00652296 _____ C:\Windows\PFRO.log
2014-01-30 20:37 - 2014-01-12 15:54 - 00000000 ____D C:\Users\********\AppData\Roaming\systweak
2014-01-30 20:36 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ssavernet
2014-01-30 20:36 - 2013-07-29 13:47 - 00000000 ____D C:\Users\********\AppData\Roaming\Web Cake
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:15 - 2011-12-31 17:43 - 00000000 ____D C:\Windows\Minidump
2014-01-30 18:14 - 2011-12-31 17:43 - 901918507 _____ C:\Windows\MEMORY.DMP
2014-01-30 18:14 - 2011-07-20 15:06 - 00000000 ____D C:\ProgramData\Norton
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ C:\Users\********\defogger_reenable
2014-01-30 18:02 - 2013-01-17 17:32 - 00000000 ____D C:\Users\********
2014-01-30 17:59 - 2014-01-30 18:01 - 00380416 _____ C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 17:58 - 2014-01-30 18:01 - 02079744 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 17:56 - 2014-01-30 18:01 - 00050477 _____ C:\Users\********\Desktop\Defogger.exe
2014-01-30 17:41 - 2011-11-02 17:08 - 00000000 ____D C:\ProgramData\Avira
2014-01-30 15:28 - 2014-01-30 15:19 - 00000000 ____D C:\Windows\pss
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-28 16:34 - 2009-07-14 05:45 - 00314984 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-28 16:32 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-16 09:59 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-15 11:10 - 2011-10-15 19:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-14 13:12 - 2011-10-15 19:00 - 00000000 ____D C:\Users\********\AppData\Roaming\Mozilla
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D C:\Users\********\Desktop\********
2014-01-14 13:11 - 2011-10-16 00:49 - 00000000 ____D C:\Users\********
2014-01-14 13:06 - 2013-12-30 19:45 - 00000276 _____ C:\Users\********\daemonprocess.txt
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D C:\Program Files (x86)\NewPlayer
2014-01-12 17:04 - 2014-01-12 17:04 - 00000000 ____D C:\Users\********\AppData\Roaming\PC Speed Maximizer
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ C:\Users\********\Downloads\setup (4).exe
2014-01-08 17:22 - 2013-07-27 11:22 - 00000118 _____ C:\Users\********\AppData\Roaming\WB.CFG
2014-01-08 17:18 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-08 16:12 - 2012-03-07 07:49 - 01634178 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ C:\Users\********\Documents\ADOLF.xps
2014-01-06 16:20 - 2014-01-30 21:52 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-05 19:14 - 2013-09-15 16:32 - 00000000 ____D C:\ProgramData\EPSON
2014-01-05 19:09 - 2013-09-15 16:34 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2014-01-05 19:02 - 2013-09-15 16:36 - 00000942 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2014-01-05 10:20 - 2014-01-05 10:20 - 00001045 _____ C:\Users\Public\Desktop\VideoPlayer.lnk
2014-01-05 10:20 - 2014-01-05 10:16 - 00000000 ____D C:\Program Files (x86)\VideoPlayer
2014-01-05 10:17 - 2014-01-05 10:17 - 00000546 _____ C:\Windows\KB893803v2.log

Some content of TEMP:
====================
C:\Users\********\AppData\Local\Temp\AskSLib.dll
C:\Users\********\AppData\Local\Temp\avgnt.exe
C:\Users\********\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-02 13:54

==================== End Of Log ============================

--- --- ---

Addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014 01
Ran by ******** at 2014-02-02 14:21:30
Running from C:\Users\********\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (x32 Version:  - Microsoft)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.631.5823 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.631.5823 - ABBYY) Hidden
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.) Hidden
Adobe Community Help (x32 Version: 3.2.1 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.2.1.650 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Photoshop Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Premiere Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated)
Adobe Premiere Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.3) - Deutsch (x32 Version: 10.1.3 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
ALDI Bestellsoftware 4.12.1 (x32 Version: 4.12.1 - ORWO Net)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Benutzerhandbuch - Grundlagen EPSON XP-302 303 305 306 Series (x32 Version:  - )
Benutzerhandbuch EPSON XP-302 303 305 306 Series (x32 Version:  - )
Bing Bar (x32 Version: 7.3.124.0 - Microsoft Corporation)
Broadcom Card Reader Driver Installer (Version: 14.8.2.2 - Broadcom Corporation)
Broadcom NetLink Controller (Version: 14.8.4.1 - Broadcom Corporation)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Crazy Chicken Kart 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.)
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DMUninstaller (x32 Version:  - )
downloadiotKeep (x32 Version:  - daowNloadietkeepp)
E.M. Free Photo Collage 1.30 (x32 Version:  - EffectMatrix, Inc.)
E.M. Multilayer Image Processing SDK 1.30 (x32 Version:  - EffectMatrix, Inc.)
eBay Worldwide (x32 Version: 2.2.0409 - OEM)
Elements 9 Organizer (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Elements STI Installer (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
ElsterFormular (x32 Version: 12.4.0.7094u - Landesfinanzdirektion Thüringen)
ElsterFormular (x32 Version: 13.0.0.8086k - Landesfinanzdirektion Thüringen)
Epson Connect Printer Setup (x32 Version: 1.1.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print 2 (x32 Version: 2.4.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (x32 Version: 3.01.0000 - Seiko Epson Corporation)
Epson Netzwerkhandbuch EPSON XP-302 303 305 306 Series (x32 Version:  - )
EPSON Scan (x32 Version:  - Seiko Epson Corporation)
EPSON XP-302 303 305 306 Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (x32 Version: 2.6.0 - SEIKO EPSON CORPORATION)
ESET Online Scanner v3 (x32 Version:  - )
ETDWare PS/2-X64 8.0.6.3_WHQL (Version: 8.0.6.3 - ELAN Microelectronic Corp.)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Guard.ICQ (x32 Version:  - Mail.ru)
HomeMedia (x32 Version: 2.0.8920 - CyberLink Corporation)
ICQ Sparberater (x32 Version: 1.3.671 - solute gmbh)
ICQ7.7 (x32 Version: 7.7 - ICQ)
Identity Card (x32 Version: 1.00.3501 - Packard Bell)
Image Converter (x32 Version: 1.0.0 - Image Converter)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2418 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 10.5.0.1026 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (x32 Version: 5.1.7 - Packard Bell)
Lexmark 2300 Series (Version:  - )
Lexmark Fax-Lösungen (Version:  - Lexmark International, Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Mozilla Firefox 12.0 (x86 de) (x32 Version: 12.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 12.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Nero BackItUp 10 (x32 Version: 5.8.11000.8.100 - Nero AG)
Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.6.12700.0.7 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.19900.9.11 - Nero AG) Hidden
Nero DiscSpeed 10 (x32 Version: 6.2.10500.2.100 - Nero AG)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Express 10 (x32 Version: 10.6.10700.5.100 - Nero AG)
Nero Express 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Multimedia Suite 10 Essentials (x32 Version: 10.5.10300 - Nero AG)
Nero Multimedia Suite 10 Essentials (x32 Version: 10.6.10300 - Nero AG)
Nero RescueAgent 10 (x32 Version: 3.6.10500.3.100 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero StartSmart 10 (x32 Version: 10.2.11600.14.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Update (x32 Version: 1.0.10900.31.0 - Nero AG)
NewPlayer (x32 Version: v2.1.1.0 - TUGUU SL)
Norton Online Backup (x32 Version: 2.1.17869 - Symantec Corporation)
NVIDIA Grafiktreiber 268.00 (Version: 268.00 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.39.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.0.21 (Version: 1.0.21 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Systemsteuerung 268.00 (Version: 268.00 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.0.21 - NVIDIA Corporation) Hidden
Packard Bell Games (x32 Version: 1.0.2.5 - WildTangent)
Packard Bell Power Management (x32 Version: 6.00.3007 - Packard Bell)
Packard Bell Recovery Management (x32 Version: 5.00.3502 - Packard Bell)
Packard Bell Registration (x32 Version: 1.04.3502 - Packard Bell)
Packard Bell ScreenSaver (x32 Version: 1.1.0811.2010 - Packard Bell )
Packard Bell Social Networks (x32 Version: 3.0.3106 - CyberLink Corp.)
Packard Bell Social Networks (x32 Version: 3.0.3106 - CyberLink Corp.) Hidden
Packard Bell Updater (x32 Version: 1.02.3500 - Packard Bell)
PC Speed Maximizer v3.2 (x32 Version: 3.2 - Smart PC Solutions)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
phase6_19 (x32 Version: 1.90.0000 - phase6)
PhotoScape (x32 Version:  - )
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6329 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (x32 Version: 1.95 - VS Revo Group)
Shape Collage (x32 Version:  - Shape Collage Inc.)
Skype Click to Call (x32 Version: 5.7.8773 - Skype Technologies S.A.)
Skype™ 5.10 (x32 Version: 5.10.116 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Software Updater (x32 Version: 4.1.7 - SEIKO EPSON CORPORATION)
Torchlight (x32 Version: 2.2.0.97 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (x32 Version:  - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32 Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (x32 Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Video Web Camera (x32 Version: 1.0.1904 - CyberLink Corp.)
Video Web Camera (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden
VideoPlayer v2.0.6 (x32 Version: v2.0.6 - TUGUU SL)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (x32 Version: 1.02.3503 - Packard Bell)
WildTangent Games App (x32 Version: 4.0.10.17 - WildTangent) Hidden
Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

30-01-2014 20:52:25 Windows Update
30-01-2014 20:56:15 Windows-Sicherung
31-01-2014 20:52:11 Windows Update
02-02-2014 11:26:51 Revo Uninstaller's restore point - Mobogenie
02-02-2014 11:29:21 Revo Uninstaller's restore point - Snap.Do

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0064E14E-7D5C-487D-9C59-3BB86755F46D} - \Advanced System Protector No Task File
Task: {10CC0A8E-F1CC-4F1A-BA9B-DE0CE3F097AF} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {1478FF5A-7B87-475B-B554-506F547D0B0A} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-05-20] (CyberLink)
Task: {2CF0C97B-3642-4392-AA05-629759941371} - \Advanced System Protector_startup No Task File
Task: {3C35EBC1-1E2C-442A-B154-C2F0EF7217B6} - System32\Tasks\Adobe ARM => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {50AD98E7-C74D-4CE1-94C3-A7BF226985B0} - \DealPly No Task File
Task: {596274CB-F41D-4451-9AED-58B7F4CC835B} - System32\Tasks\NBAgent => C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2011-07-05] (Nero AG)
Task: {6417E783-9AA3-4666-AAC9-FE2ECF301096} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {81DE42FC-1CD9-4330-821F-23696E4E9194} - \Scheduled Update for Ask Toolbar No Task File
Task: {95B96EB5-CE94-47D2-AF32-90E60D57C1AC} - \EPUpdater No Task File
Task: {B71A07DD-050E-42E3-8645-433D275393F1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-13] (Adobe Systems Incorporated)
Task: {BDC660F8-997E-48FF-9FD3-5C5C6C4C1F21} - System32\Tasks\AdobeAAMUpdater-1.0-********-PC-******** => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)
Task: {C49D2CCE-D7B1-4F8A-B26C-F26A688B6126} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {CC9CD2D7-9BF8-4C98-8706-AE28BE7C27A2} - \DSite No Task File
Task: {DA68870B-F7F6-4016-82F4-625FBA2A8FBD} - \QtraxPlayer No Task File
Task: {E3AD84E9-5C14-4C38-A0D8-4A0CC6AD5306} - System32\Tasks\Adobe Reader Speed Launcher => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {FBDFCAF5-DAD1-4EFE-8170-71EFE525C035} - \RegClean Pro No Task File
Task: {FF2007C3-FD0B-47F7-859B-BEA666BDDB9E} - \DealPlyUpdate No Task File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-07-20 15:04 - 2011-06-10 18:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/02/2014 02:20:16 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/02/2014 02:20:16 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0xce4
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3

Error: (02/02/2014 01:58:49 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/02/2014 01:55:39 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/02/2014 01:55:21 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (02/02/2014 00:10:14 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/02/2014 00:10:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0xc94
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3

Error: (02/01/2014 07:13:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0xcf8
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3

Error: (02/01/2014 07:13:11 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/31/2014 08:32:36 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (01/31/2014 08:38:36 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/30/2014 10:58:47 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/30/2014 10:53:42 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Live Updater Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/30/2014 10:48:08 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (01/30/2014 08:38:48 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/30/2014 08:38:47 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (01/30/2014 06:16:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/30/2014 06:15:43 PM) (Source: BugCheck) (User: )
Description: 0x00000109 (0xa3a039d897cf4574, 0xb3b7465eea4d80ae, 0xfffff880009f55c0, 0x0000000000000002)C:\Windows\MEMORY.DMP013014-57018-01

Error: (01/30/2014 06:15:25 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎30.‎01.‎2014 um 18:12:47 unerwartet heruntergefahren.

Error: (01/30/2014 05:43:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 19%
Total physical RAM: 5995.86 MB
Available physical RAM: 4801.7 MB
Total Pagefile: 11989.9 MB
Available Pagefile: 10713.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:445.66 GB) (Free:356.64 GB) NTFS
Drive f: (USB DISK) (Removable) (Total:1.86 GB) (Free:1.76 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: BEC6DCFE)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=446 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 2 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=2 GB) - (Type=06)

==================== End Of Log ============================

Viele Grüße
Philipp

schrauber · 03.02.2014, 13:32

Zitat:

HKU\********\...\

Du hast da einen Nutzer unkenntlich gemacht. Bitte MBAM und AdwCleaner in diesem Acount laufen lassen.

waldiphil · 03.02.2014, 15:23

Hallo,

dieses Benutzerkonto scheint nicht (mehr) zu existieren:
Aktiv ist zur Zeit nur ein Konto.
Das Konto von dem aus diese Aufrufe ausgehen kann weder über den Anmeldescreen noch über die Benutzerverwaltung der Systemsteuerung gefunden werden.

Im Benutzer-Ordner der Festplatte ist (neben dem Hauptkonto, dem öffentlichen Ordner und dem "UpdateusUser"-Order) auch für dieses Konto ein Ordner vorhanden, der jedoch nicht die normale Ordnerstruktur der "Eigenen Dateien" der Nutzer (Desktop, Eigene Bilder, ... ), sondern nur einige davon (Kontakte, Links) enthält. Kann dies daher kommen, dass hier ein Nutzerkonto mit der Einstellung "Daten behalten" gelöscht wurde?

Im TaskManager lassen sich weder Prozesse dieses Nutzers, noch der Nutzer selber ausmachen.

Ich könnte die Ordnerstruktur des Nutzers auch einfach komplett aus C:/Benutzer löschen?

Viele Grüße
Philipp

schrauber · 04.02.2014, 10:05

Ja lösch es raus, poste dann ein frisches FRST log, und falls es wieder auftaucht den Namen bitte nicht unkenntlich machen.

waldiphil · 05.02.2014, 12:34

Hallo,

nach dem Löschen des Ordners kommt der Name des Kontos in den Logs nicht mehr vor.
Alle * stehen nun für das selber Benutzerkonto, von dem auch alle Reparaturmaßnahmen durchgeführt wurden.

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014
Ran by ******** (administrator) on ********-PC on 05-02-2014 09:34:22
Running from C:\Users\********\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.EXE
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-535545297-3433116171-3722734622-1000\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [154144 2010-07-29] ()
HKU\S-1-5-21-535545297-3433116171-3722734622-1004\...\MountPoints2: {b4b792a0-7837-11e2-959f-b870f4df384e} - E:\Startme.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-03-30] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [193128 2011-03-30] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll No File
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO: Feven 2.5 - {11111111-1111-1111-1111-110411901108} - C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll No File
BHO: Plus-HD-5.5 - {11111111-1111-1111-1111-110411901160} - C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: downloadiotKeep - {A8A56ADD-A5ED-734F-1D22-0949078095CF} - C:\ProgramData\downloadiotKeep\gpM.x64.dll No File
BHO: ssavernet - {B53AE25A-08F3-320F-8293-BAD1C3FF3B2C} - C:\ProgramData\ssavernet\Omblf.x64.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: ICQ Sparberater - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.7.0.8773_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Norton Confidential) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.6.10_0\npcoplgn.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-21]
CHR Extension: (Plus-HD-5.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoilcbjfkbdplcfglkiedhefcomondlk [2014-01-05]
CHR Extension: (Google Drive) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-21]
CHR Extension: (Feven 1.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-12-31]
CHR Extension: (YouTube) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-21]
CHR Extension: (downloadiotKeep) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfaknkffffmbadnnkpoimdkaaahgflcg [2014-01-29]
CHR Extension: (Google-Suche) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-21]
CHR Extension: (Skype Click to Call) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-01-21]
CHR Extension: (Google Wallet) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (ICQ Sparberater) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo [2013-01-21]
CHR Extension: (Google Mail) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-21]
CHR Extension: (Feven 2.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbhkhbgdaamliaimlpdlhokkecoibka [2014-01-12]
CHR Extension: (ssavernet) - C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep [2014-01-29]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-11-14]
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.3.671.crx [2011-12-28]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-05-10] (Acer Incorporated)
S2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [39528 2011-01-18] (Acer Incorporated)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-01-01] ()
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S3 lxcg_device; C:\Windows\system32\lxcgcoms.exe [451584 2005-07-25] ( )
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-05 09:34 - 2014-02-05 09:34 - 00014756 _____ () C:\Users\********\Desktop\FRST.txt
2014-02-02 14:17 - 2014-02-02 14:17 - 01166132 _____ () C:\Users\********\Desktop\adwcleaner.exe
2014-02-02 12:11 - 2014-02-02 12:11 - 00001276 _____ () C:\Users\********\Desktop\Revo Uninstaller.lnk
2014-02-02 12:11 - 2014-02-02 12:11 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-02-02 12:11 - 2014-02-02 12:10 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\********\Desktop\revosetup95.exe
2014-01-31 17:07 - 2014-01-31 17:03 - 00987425 _____ () C:\Users\********\Desktop\SecurityCheck.exe
2014-01-31 17:07 - 2014-01-30 21:30 - 02347384 _____ (ESET) C:\Users\********\Desktop\esetsmartinstaller_deu.exe
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D () C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ () C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:41 - 2014-02-02 14:19 - 00000000 ____D () C:\AdwCleaner
2014-01-30 22:40 - 2014-01-30 22:38 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:52 - 2014-01-30 21:55 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-30 21:52 - 2014-01-06 16:20 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ () C:\Users\********\Desktop\GMER.log
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D () C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 19:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ () C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:03 - 2014-02-05 09:34 - 00000000 ____D () C:\FRST
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ () C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ () C:\Users\********\defogger_reenable
2014-01-30 18:01 - 2014-02-05 09:32 - 02080256 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-01-30 18:01 - 2014-01-30 17:59 - 00380416 _____ () C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 18:01 - 2014-01-30 17:56 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe
2014-01-30 15:19 - 2014-01-30 15:28 - 00000000 ____D () C:\Windows\pss
2014-01-29 10:00 - 2014-01-30 20:36 - 00000000 ____D () C:\ProgramData\ssavernet
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D () C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D () C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-01-15 10:23 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:23 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:23 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:23 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D () C:\Users\********\Desktop\********
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ () C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D () C:\Program Files (x86)\NewPlayer
2014-01-12 15:56 - 2012-07-25 12:03 - 00016896 _____ () C:\Windows\system32\sasnative64.exe
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ () C:\Users\********\Downloads\setup (4).exe
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ () C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ () C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ () C:\Users\********\Documents\ADOLF.xps

==================== One Month Modified Files and Folders =======

2014-02-05 09:34 - 2014-02-05 09:34 - 00014756 _____ () C:\Users\********\Desktop\FRST.txt
2014-02-05 09:34 - 2014-01-30 18:03 - 00000000 ____D () C:\FRST
2014-02-05 09:32 - 2014-01-30 18:01 - 02080256 _____ (Farbar) C:\Users\********\Desktop\FRST64.exe
2014-02-05 09:29 - 2011-08-16 03:33 - 01763896 _____ () C:\Windows\WindowsUpdate.log
2014-02-05 09:28 - 2012-06-16 12:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-05 09:28 - 2011-11-19 12:58 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-04 14:18 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-04 14:18 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-04 14:16 - 2013-01-21 11:30 - 00000000 ____D () C:\Users\********\AppData\Local\CrashDumps
2014-02-04 14:16 - 2012-06-25 10:20 - 00000000 ____D () C:\Users\Public\Documents\phase6_19_Daten
2014-02-04 14:16 - 2011-11-19 12:58 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-04 14:11 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-04 14:11 - 2009-07-14 05:51 - 00181063 _____ () C:\Windows\setupact.log
2014-02-02 14:19 - 2014-01-30 22:41 - 00000000 ____D () C:\AdwCleaner
2014-02-02 14:17 - 2014-02-02 14:17 - 01166132 _____ () C:\Users\********\Desktop\adwcleaner.exe
2014-02-02 14:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-02 12:11 - 2014-02-02 12:11 - 00001276 _____ () C:\Users\********\Desktop\Revo Uninstaller.lnk
2014-02-02 12:11 - 2014-02-02 12:11 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-02-02 12:10 - 2014-02-02 12:11 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\********\Desktop\revosetup95.exe
2014-02-01 20:27 - 2013-12-31 09:36 - 00003189 _____ () C:\Users\********\daemonprocess.txt
2014-01-31 17:03 - 2014-01-31 17:07 - 00987425 _____ () C:\Users\********\Desktop\SecurityCheck.exe
2014-01-30 22:49 - 2014-01-30 22:49 - 00000000 ____D () C:\Windows\ERUNT
2014-01-30 22:48 - 2014-01-30 22:48 - 00015536 _____ () C:\Users\********\Desktop\AdwCleaner[S0].txt
2014-01-30 22:45 - 2012-01-01 17:02 - 00000000 ____D () C:\ProgramData\ICQ
2014-01-30 22:44 - 2011-08-16 13:23 - 00716782 _____ () C:\Windows\system32\perfh007.dat
2014-01-30 22:44 - 2011-08-16 13:23 - 00155688 _____ () C:\Windows\system32\perfc007.dat
2014-01-30 22:44 - 2009-07-14 06:13 - 01656284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-30 22:38 - 2014-01-30 22:40 - 01037068 _____ (Thisisu) C:\Users\********\Desktop\JRT.exe
2014-01-30 21:55 - 2014-01-30 21:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-30 21:55 - 2011-08-16 03:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-01-30 21:30 - 2014-01-31 17:07 - 02347384 _____ (ESET) C:\Users\********\Desktop\esetsmartinstaller_deu.exe
2014-01-30 20:57 - 2014-01-30 20:57 - 00002736 _____ () C:\Users\********\Desktop\GMER.log
2014-01-30 20:38 - 2013-12-30 19:45 - 00000000 ____D () C:\ProgramData\WPM
2014-01-30 20:38 - 2010-11-21 04:47 - 00652296 _____ () C:\Windows\PFRO.log
2014-01-30 20:36 - 2014-01-29 10:00 - 00000000 ____D () C:\ProgramData\ssavernet
2014-01-30 19:02 - 2014-01-30 19:02 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D () C:\Users\********\AppData\Roaming\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-01-30 19:02 - 2014-01-30 19:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 18:15 - 2014-01-30 18:15 - 00262144 _____ () C:\Windows\Minidump\013014-57018-01.dmp
2014-01-30 18:15 - 2011-12-31 17:43 - 00000000 ____D () C:\Windows\Minidump
2014-01-30 18:14 - 2011-12-31 17:43 - 901918507 _____ () C:\Windows\MEMORY.DMP
2014-01-30 18:14 - 2011-07-20 15:06 - 00000000 ____D () C:\ProgramData\Norton
2014-01-30 18:02 - 2014-01-30 18:02 - 00000486 _____ () C:\Users\********\Desktop\defogger_disable.log
2014-01-30 18:02 - 2014-01-30 18:02 - 00000000 _____ () C:\Users\********\defogger_reenable
2014-01-30 18:02 - 2013-01-17 17:32 - 00000000 ____D () C:\Users\********
2014-01-30 17:59 - 2014-01-30 18:01 - 00380416 _____ () C:\Users\********\Desktop\Gmer-19357.exe
2014-01-30 17:56 - 2014-01-30 18:01 - 00050477 _____ () C:\Users\********\Desktop\Defogger.exe
2014-01-30 17:41 - 2011-11-02 17:08 - 00000000 ____D () C:\ProgramData\Avira
2014-01-30 15:28 - 2014-01-30 15:19 - 00000000 ____D () C:\Windows\pss
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D () C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D () C:\ProgramData\8817108a53eb8930
2014-01-29 09:47 - 2014-01-29 09:47 - 02347384 _____ (ESET) C:\Users\********\Downloads\esetsmartinstaller_deu.exe
2014-01-29 09:47 - 2014-01-29 09:47 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-01-28 16:34 - 2009-07-14 05:45 - 00314984 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-28 16:32 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-16 09:59 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-15 11:10 - 2011-10-15 19:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-14 13:11 - 2014-01-14 13:11 - 00000000 ____D () C:\Users\********\Desktop\********
2014-01-12 17:05 - 2014-01-12 17:05 - 00001125 _____ () C:\Users\Public\Desktop\NewPlayer.lnk
2014-01-12 17:05 - 2014-01-12 17:05 - 00000000 ____D () C:\Program Files (x86)\NewPlayer
2014-01-10 10:18 - 2014-01-10 10:18 - 00138616 _____ () C:\Users\********\Downloads\setup (4).exe
2014-01-08 17:18 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-01-08 16:12 - 2012-03-07 07:49 - 01634178 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 16:00 - 2014-01-08 16:00 - 01289264 _____ () C:\Users\********\Downloads\Gutes neues Jahr (1).mp4
2014-01-08 15:59 - 2014-01-08 15:59 - 01289264 _____ () C:\Users\********\Downloads\Gutes neues Jahr.mp4
2014-01-07 10:32 - 2014-01-07 10:32 - 00185750 _____ () C:\Users\********\Documents\ADOLF.xps
2014-01-06 16:20 - 2014-01-30 21:52 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\********\AppData\Local\Temp\AskSLib.dll
C:\Users\********\AppData\Local\Temp\avgnt.exe
C:\Users\********\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-02 13:54

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2014
Ran by ******** at 2014-02-05 09:34:45
Running from C:\Users\********\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (x32 Version:  - Microsoft)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.631.5823 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.631.5823 - ABBYY) Hidden
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.) Hidden
Adobe Community Help (x32 Version: 3.2.1 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.2.1.650 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Photoshop Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Premiere Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated)
Adobe Premiere Elements 9 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.3) - Deutsch (x32 Version: 10.1.3 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
ALDI Bestellsoftware 4.12.1 (x32 Version: 4.12.1 - ORWO Net)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Benutzerhandbuch - Grundlagen EPSON XP-302 303 305 306 Series (x32 Version:  - )
Benutzerhandbuch EPSON XP-302 303 305 306 Series (x32 Version:  - )
Bing Bar (x32 Version: 7.3.124.0 - Microsoft Corporation)
Broadcom Card Reader Driver Installer (Version: 14.8.2.2 - Broadcom Corporation)
Broadcom NetLink Controller (Version: 14.8.4.1 - Broadcom Corporation)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Crazy Chicken Kart 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.)
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DMUninstaller (x32 Version:  - )
downloadiotKeep (x32 Version:  - daowNloadietkeepp)
E.M. Free Photo Collage 1.30 (x32 Version:  - EffectMatrix, Inc.)
E.M. Multilayer Image Processing SDK 1.30 (x32 Version:  - EffectMatrix, Inc.)
eBay Worldwide (x32 Version: 2.2.0409 - OEM)
Elements 9 Organizer (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Elements STI Installer (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
ElsterFormular (x32 Version: 12.4.0.7094u - Landesfinanzdirektion Thüringen)
ElsterFormular (x32 Version: 13.0.0.8086k - Landesfinanzdirektion Thüringen)
Epson Connect Printer Setup (x32 Version: 1.1.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print 2 (x32 Version: 2.4.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (x32 Version: 3.01.0000 - Seiko Epson Corporation)
Epson Netzwerkhandbuch EPSON XP-302 303 305 306 Series (x32 Version:  - )
EPSON Scan (x32 Version:  - Seiko Epson Corporation)
EPSON XP-302 303 305 306 Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (x32 Version: 2.6.0 - SEIKO EPSON CORPORATION)
ESET Online Scanner v3 (x32 Version:  - )
ETDWare PS/2-X64 8.0.6.3_WHQL (Version: 8.0.6.3 - ELAN Microelectronic Corp.)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Guard.ICQ (x32 Version:  - Mail.ru)
HomeMedia (x32 Version: 2.0.8920 - CyberLink Corporation)
ICQ Sparberater (x32 Version: 1.3.671 - solute gmbh)
ICQ7.7 (x32 Version: 7.7 - ICQ)
Identity Card (x32 Version: 1.00.3501 - Packard Bell)
Image Converter (x32 Version: 1.0.0 - Image Converter)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2418 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 10.5.0.1026 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (x32 Version: 5.1.7 - Packard Bell)
Lexmark 2300 Series (Version:  - )
Lexmark Fax-Lösungen (Version:  - Lexmark International, Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Mozilla Firefox 12.0 (x86 de) (x32 Version: 12.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 12.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Nero BackItUp 10 (x32 Version: 5.8.11000.8.100 - Nero AG)
Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.6.12700.0.7 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.19900.9.11 - Nero AG) Hidden
Nero DiscSpeed 10 (x32 Version: 6.2.10500.2.100 - Nero AG)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Express 10 (x32 Version: 10.6.10700.5.100 - Nero AG)
Nero Express 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Multimedia Suite 10 Essentials (x32 Version: 10.5.10300 - Nero AG)
Nero Multimedia Suite 10 Essentials (x32 Version: 10.6.10300 - Nero AG)
Nero RescueAgent 10 (x32 Version: 3.6.10500.3.100 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero StartSmart 10 (x32 Version: 10.2.11600.14.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Update (x32 Version: 1.0.10900.31.0 - Nero AG)
NewPlayer (x32 Version: v2.1.1.0 - TUGUU SL)
Norton Online Backup (x32 Version: 2.1.17869 - Symantec Corporation)
NVIDIA Grafiktreiber 268.00 (Version: 268.00 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.39.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.0.21 (Version: 1.0.21 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Systemsteuerung 268.00 (Version: 268.00 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.0.21 - NVIDIA Corporation) Hidden
Packard Bell Games (x32 Version: 1.0.2.5 - WildTangent)
Packard Bell Power Management (x32 Version: 6.00.3007 - Packard Bell)
Packard Bell Recovery Management (x32 Version: 5.00.3502 - Packard Bell)
Packard Bell Registration (x32 Version: 1.04.3502 - Packard Bell)
Packard Bell ScreenSaver (x32 Version: 1.1.0811.2010 - Packard Bell )
Packard Bell Social Networks (x32 Version: 3.0.3106 - CyberLink Corp.)
Packard Bell Social Networks (x32 Version: 3.0.3106 - CyberLink Corp.) Hidden
Packard Bell Updater (x32 Version: 1.02.3500 - Packard Bell)
PC Speed Maximizer v3.2 (x32 Version: 3.2 - Smart PC Solutions)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
phase6_19 (x32 Version: 1.90.0000 - phase6)
PhotoScape (x32 Version:  - )
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6329 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (x32 Version: 1.95 - VS Revo Group)
Shape Collage (x32 Version:  - Shape Collage Inc.)
Skype Click to Call (x32 Version: 5.7.8773 - Skype Technologies S.A.)
Skype™ 5.10 (x32 Version: 5.10.116 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Software Updater (x32 Version: 4.1.7 - SEIKO EPSON CORPORATION)
Torchlight (x32 Version: 2.2.0.97 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (x32 Version:  - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32 Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (x32 Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Video Web Camera (x32 Version: 1.0.1904 - CyberLink Corp.)
Video Web Camera (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden
VideoPlayer v2.0.6 (x32 Version: v2.0.6 - TUGUU SL)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (x32 Version: 1.02.3503 - Packard Bell)
WildTangent Games App (x32 Version: 4.0.10.17 - WildTangent) Hidden
Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

30-01-2014 20:52:25 Windows Update
30-01-2014 20:56:15 Windows-Sicherung
31-01-2014 20:52:11 Windows Update
02-02-2014 11:26:51 Revo Uninstaller's restore point - Mobogenie
02-02-2014 11:29:21 Revo Uninstaller's restore point - Snap.Do

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0064E14E-7D5C-487D-9C59-3BB86755F46D} - \Advanced System Protector No Task File
Task: {10CC0A8E-F1CC-4F1A-BA9B-DE0CE3F097AF} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {1478FF5A-7B87-475B-B554-506F547D0B0A} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-05-20] (CyberLink)
Task: {2CF0C97B-3642-4392-AA05-629759941371} - \Advanced System Protector_startup No Task File
Task: {3C35EBC1-1E2C-442A-B154-C2F0EF7217B6} - System32\Tasks\Adobe ARM => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {50AD98E7-C74D-4CE1-94C3-A7BF226985B0} - \DealPly No Task File
Task: {596274CB-F41D-4451-9AED-58B7F4CC835B} - System32\Tasks\NBAgent => C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2011-07-05] (Nero AG)
Task: {6417E783-9AA3-4666-AAC9-FE2ECF301096} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {81DE42FC-1CD9-4330-821F-23696E4E9194} - \Scheduled Update for Ask Toolbar No Task File
Task: {95B96EB5-CE94-47D2-AF32-90E60D57C1AC} - \EPUpdater No Task File
Task: {B71A07DD-050E-42E3-8645-433D275393F1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-13] (Adobe Systems Incorporated)
Task: {BDC660F8-997E-48FF-9FD3-5C5C6C4C1F21} - System32\Tasks\AdobeAAMUpdater-1.0-********-PC-******** => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)
Task: {C49D2CCE-D7B1-4F8A-B26C-F26A688B6126} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {CC9CD2D7-9BF8-4C98-8706-AE28BE7C27A2} - \DSite No Task File
Task: {DA68870B-F7F6-4016-82F4-625FBA2A8FBD} - \QtraxPlayer No Task File
Task: {E3AD84E9-5C14-4C38-A0D8-4A0CC6AD5306} - System32\Tasks\Adobe Reader Speed Launcher => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {FBDFCAF5-DAD1-4EFE-8170-71EFE525C035} - \RegClean Pro No Task File
Task: {FF2007C3-FD0B-47F7-859B-BEA666BDDB9E} - \DealPlyUpdate No Task File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-07-20 15:04 - 2011-06-10 18:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-29 10:50 - 2014-01-29 10:50 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\f60b3ee2de3f41a024920486d46d49f2\IsdiInterop.ni.dll
2011-07-20 14:35 - 2011-04-30 08:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/04/2014 03:00:19 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/04/2014 02:59:57 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (02/04/2014 02:16:17 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0xff4
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3

Error: (02/04/2014 02:12:08 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/03/2014 03:53:19 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/03/2014 03:53:00 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (02/03/2014 03:34:27 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0xc90
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3

Error: (02/03/2014 03:34:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/03/2014 03:17:53 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "E:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (02/03/2014 03:08:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: EEventManager.exe, Version: 3.0.0.1, Zeitstempel: 0x4eae30bd
Name des fehlerhaften Moduls: lxcgtwds.ds, Version: 2.6.62.20, Zeitstempel: 0x42df3acb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00004d32
ID des fehlerhaften Prozesses: 0xe40
Startzeit der fehlerhaften Anwendung: 0xEEventManager.exe0
Pfad der fehlerhaften Anwendung: EEventManager.exe1
Pfad des fehlerhaften Moduls: EEventManager.exe2
Berichtskennung: EEventManager.exe3


System errors:
=============
Error: (01/31/2014 08:38:36 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/30/2014 10:58:47 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/30/2014 10:53:42 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Live Updater Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/30/2014 10:48:08 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (01/30/2014 08:38:48 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/30/2014 08:38:47 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (01/30/2014 06:16:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/30/2014 06:15:43 PM) (Source: BugCheck) (User: )
Description: 0x00000109 (0xa3a039d897cf4574, 0xb3b7465eea4d80ae, 0xfffff880009f55c0, 0x0000000000000002)C:\Windows\MEMORY.DMP013014-57018-01

Error: (01/30/2014 06:15:25 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎30.‎01.‎2014 um 18:12:47 unerwartet heruntergefahren.

Error: (01/30/2014 05:43:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 26%
Total physical RAM: 5995.86 MB
Available physical RAM: 4436.87 MB
Total Pagefile: 11989.9 MB
Available Pagefile: 10363.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:445.66 GB) (Free:357.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: BEC6DCFE)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=446 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Viele Grüße
Philipp

schrauber · 06.02.2014, 09:44

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll No File
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO: Feven 2.5 - {11111111-1111-1111-1111-110411901108} - C:\Program Files (x86)\Feven 2.5\Feven 2.5-bho64.dll No File
BHO: Plus-HD-5.5 - {11111111-1111-1111-1111-110411901160} - C:\Program Files (x86)\Plus-HD-5.5\Plus-HD-5.5-bho64.dll No File
CHR Extension: (Plus-HD-5.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoilcbjfkbdplcfglkiedhefcomondlk [2014-01-05]
CHR Extension: (Feven 1.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg [2013-12-31]
CHR Extension: (Feven 2.5) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbhkhbgdaamliaimlpdlhokkecoibka [2014-01-12]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388429095&from=tugs&uid=WDCXWD5000BPVT-22HXZT3_WD-WXJ1A61N8749N8749
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
2014-01-29 10:00 - 2014-01-30 20:36 - 00000000 ____D () C:\ProgramData\ssavernet
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D () C:\ProgramData\ldkiphmeoipnafigkjjgddpkgakabiep
2014-01-29 10:00 - 2014-01-29 10:00 - 00000000 ____D () C:\ProgramData\8817108a53eb8930

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

waldiphil · 09.02.2014, 16:26

Hallo,

danke dir, das Problem ist gelöst

Leider habe ich das Fixlog nicht gesichert, bevor ich das Delete-Tool gestartet habe

Stand aber überall, dass alles erfolgreich war.

Vielen Dank und viele Grüße
Philipp

01.02.2014, 17:27	#6
schrauber /// the machine /// TB-Ausbilder	Potentiell gefährdeter Laptop (zahlreiche PUP entfernt) - nun sauber? Securitycheck hat nen Macken. Den Großteil haben wir, da ist aber noch was: FRST bitte öffnen, setz nen Haken bei Additional und scanne, poste beide Logfiles. __________________ --> Potentiell gefährdeter Laptop (zahlreiche PUP entfernt) - nun sauber?

04.02.2014, 10:05	#12
schrauber /// the machine /// TB-Ausbilder	Potentiell gefährdeter Laptop (zahlreiche PUP entfernt) - nun sauber? Ja lösch es raus, poste dann ein frisches FRST log, und falls es wieder auftaucht den Namen bitte nicht unkenntlich machen. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Potentiell gefährdeter Laptop (zahlreiche PUP entfernt) - nun sauber?

Log-Analyse und Auswertung: Potentiell gefährdeter Laptop (zahlreiche PUP entfernt) - nun sauber?