Guten Tag allerseits

Wir hatten heute eine Zwischenfall: Einer unsrer Benutzer hat an ca. 120 Kontakte aus Outlook ein Email versendet mit Anhang - alles automatisch. Trendmicro hat den Anhang entfernt da dieser vermutlich einen Virus enthält. Am entsprechenden PC hat unser Virenscanner beim automatischen Scan folgende Viren entdeckt:

"";"C:\Users\...\AppData\Local\Temp\Temp1_Invoice.zip\Sigure.exe";"Trojaner: Generic36.BJLS";"In Virenquarantäne verschoben"
"";"C:\Users\...\AppData\Local\Temp\5596.tmp";"Trojaner: Agent5.WWL";"In Virenquarantäne verschoben"

Wir verwenden AVG. Dabei wurden diese Gemäss AVG entfernt um 12:26. Allerdings ging die Massenmail um 13:03 raus... Können diese beiden Viren Die Ursache für die Emailflut sein bzw. wie wahrscheinlich ist es?

Achja; OS Win 7 Prof x64

Freundliche Grüsse und besten Dank für jegliche Hilfe

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hallo Schrauber und danke für deine Hilfe!


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2015
Ran by tamara (ATTENTION: The logged in user is not administrator) on LAYLA on 27-04-2015 16:04:29
Running from N:\
Loaded Profiles: tamara (Available profiles: tamara & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> avgrsa.exe
Failed to access process -> avgcsrva.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> csrss.exe
Failed to access process -> services.exe
Failed to access process -> lsass.exe
Failed to access process -> lsm.exe
Failed to access process -> svchost.exe
Failed to access process -> winlogon.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> spoolsv.exe
Failed to access process -> svchost.exe
Failed to access process -> armsvc.exe
Failed to access process -> avgwdsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> LMS.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> USBDLM.exe
Failed to access process -> winvnc.exe
Failed to access process -> winvnc.exe
Failed to access process -> svchost.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files (x86)\USBDLM\USBDLM_usr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
Failed to access process -> svchost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
Failed to access process -> SearchIndexer.exe
() \\spsrv110\swing$\SWING32\Swing.exe
Failed to access process -> IAStorDataMgrSvc.exe
(Dropbox, Inc.) C:\Users\tamara\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
Failed to access process -> OSPPSVC.EXE
(LaCie) C:\Users\tamara\AppData\Roaming\Wuala\Wuala.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_17_0_0_169_ActiveX.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgui.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
Failed to access process -> taskeng.exe
Failed to access process -> WUDFHost.exe
Failed to access process -> svchost.exe
Failed to access process -> SearchFilterHost.exe
Failed to access process -> WMIADAP.exe
Failed to access process -> WmiPrvSE.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-12] (Realtek Semiconductor)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [462848 2012-10-30] (Greenshot)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVG_TRAY] => C:\Program Files (x86)\AVG\AVG2012\avgtray.exe [2598520 2012-11-19] (AVG Technologies CZ, s.r.o.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoPublishingWizard] 1
HKLM\...\Policies\Explorer: [NoWebServices] 1
HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\Run: [HPADVISOR] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\Policies\system: [RunLogonScriptSync] 1
HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\Policies\Explorer: [AlwaysShowClassicMenu] 1
HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\Policies\Explorer: [RestrictWelcomeCenter] 1
HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\Policies\Explorer: [NoUserFolderInStartMenu] 1
HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\Policies\Explorer: [NoDesktopCleanupWizard] 1
Startup: C:\Users\tamara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-04-04]
ShortcutTarget: Dropbox.lnk -> C:\Users\tamara\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [0WualaOverlayIcon1] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Wuala OverlayIcons\OverlayIcon.dll [2012-05-02] (LaCie AG)
ShellIconOverlayIdentifiers: [0WualaOverlayIcon2] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Wuala OverlayIcons\OverlayIcon.dll [2012-05-02] (LaCie AG)
ShellIconOverlayIdentifiers: [0WualaOverlayIcon3] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files (x86)\Wuala OverlayIcons\OverlayIcon.dll [2012-05-02] (LaCie AG)
ShellIconOverlayIdentifiers: [0WualaOverlayIcon4] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files (x86)\Wuala OverlayIcons\OverlayIcon.dll [2012-05-02] (LaCie AG)
ShellIconOverlayIdentifiers: [1EldosIconOverlay] -> {452E5419-313B-44A1-9EF0-10FC4469EA51} => C:\Windows\System32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\tamara\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\tamara\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\tamara\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\tamara\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\Windows\system32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [1EldosIconOverlay] -> {452E5419-313B-44A1-9EF0-10FC4469EA51} => C:\Windows\SysWow64\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\tamara\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\tamara\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\tamara\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\Windows\SysWOW64\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
BootExecute: autocheck autochk * C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1844237615-963894560-682003330-1295\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1844237615-963894560-682003330-1295\Software\Microsoft\Internet Explorer\Main,Start Page = ZensurStibi
HKU\S-1-5-21-1844237615-963894560-682003330-1295\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ZensurStibi
HKU\S-1-5-21-1844237615-963894560-682003330-1295\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.ch
SearchScopes: HKU\S-1-5-21-1844237615-963894560-682003330-1295 -> DefaultScope {53A2B578-8AF2-4FD2-B4E6-52D800BBBD9E} URL = hxxp://www.google.ch/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1844237615-963894560-682003330-1295 -> {53A2B578-8AF2-4FD2-B4E6-52D800BBBD9E} URL = hxxp://www.google.ch/search?q={searchTerms}
BHO: Virtual Storage Mount Notification -> {5FF49FE8-B332-4CB9-B102-FB6951629E55} -> C:\Windows\system32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Virtual Storage Mount Notification -> {5FF49FE8-B332-4CB9-B102-FB6951629E55} -> C:\Windows\SysWOW64\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-29] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-29] (Oracle Corporation)
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.10.22 192.168.10.21

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-29] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-29] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [193288 2012-02-14] (AVG Technologies CZ, s.r.o.)
S2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S2 lmhosts; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2011-04-13] (Hewlett-Packard) [File not signed]
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2011-04-13] (Hewlett-Packard) [File not signed]
R2 USBDLM; C:\Program Files (x86)\USBDLM\USBDLM.exe [215552 2009-04-30] (Uwe Sieber - www.uwe-sieber.de) [File not signed]
R2 uvnc_service; C:\Program Files\UltraVNC\WinVNC.exe [1793976 2009-12-07] (UltraVNC)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [28480 2012-04-19] (AVG Technologies CZ, s.r.o. )
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [307040 2012-11-08] (AVG Technologies CZ, s.r.o.)
R1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [47696 2011-12-23] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [36944 2012-01-31] (AVG Technologies CZ, s.r.o.)
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2009-12-18] ()
R3 mv2; C:\Windows\System32\DRIVERS\mv2.sys [12096 2011-01-10] (UVNC BVBA)
S3 SRS_PremiumSound_Service; C:\Windows\System32\drivers\srs_PremiumSound_amd64.sys [546080 2011-02-03] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-27 16:04 - 2015-04-27 16:04 - 00000000 ____D () C:\FRST
2015-04-27 15:10 - 2015-04-27 15:10 - 00000698 _____ () C:\Users\tamara\Desktop\avg export.csv
2015-04-24 14:16 - 2015-04-27 15:12 - 00097792 _____ () C:\Users\tamara\AppData\Local\ne9bzef6m8.dll
2015-04-08 17:12 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-04-08 17:12 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-04-07 11:03 - 2015-04-07 16:27 - 00000000 ____D () C:\Users\regula.spuhler

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-27 16:03 - 2009-07-14 06:51 - 00079028 _____ () C:\Windows\setupact.log
2015-04-27 16:00 - 2014-07-14 11:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-27 15:32 - 2011-01-05 16:03 - 01153985 _____ () C:\Windows\WindowsUpdate.log
2015-04-27 15:25 - 2014-09-18 14:29 - 00002073 _____ () C:\Users\tamara\Desktop\Wochenendpikettplan 2015 Juli-Dez.lnk
2015-04-27 15:25 - 2014-09-18 14:29 - 00002067 _____ () C:\Users\tamara\Desktop\Wochenendpikettplan 2015 Jan-Jun.lnk
2015-04-27 15:25 - 2012-05-10 09:35 - 00001088 _____ () C:\Users\tamara\Desktop\Intranet.lnk
2015-04-27 15:25 - 2011-12-12 14:05 - 00001749 _____ () C:\Users\tamara\Desktop\SWING Ambulant.lnk
2015-04-27 15:25 - 2011-08-25 13:01 - 00045650 __RSH () C:\Users\tamara\ntuser.pol
2015-04-27 15:25 - 2011-08-25 13:01 - 00002597 _____ () C:\Users\tamara\Desktop\Telefonverzeichnis.lnk
2015-04-27 15:25 - 2011-08-25 13:01 - 00001546 _____ () C:\Users\tamara\Desktop\TwixTel.lnk
2015-04-27 15:25 - 2011-08-25 13:01 - 00000000 ____D () C:\Users\tamara
2015-04-27 14:46 - 2012-02-08 11:37 - 00000000 ____D () C:\Windows\system32\Drivers\AVG
2015-04-27 14:10 - 2011-08-25 08:35 - 00069862 __RSH () C:\ProgramData\ntuser.pol
2015-04-27 07:10 - 2009-07-14 06:45 - 00028960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-27 07:10 - 2009-07-14 06:45 - 00028960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-27 07:07 - 2009-07-14 19:58 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-04-27 07:07 - 2009-07-14 19:58 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-04-27 07:07 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-27 07:06 - 2014-04-04 09:27 - 00000982 _____ () C:\Users\tamara\Desktop\Dropbox.lnk
2015-04-27 07:06 - 2014-04-04 09:27 - 00000000 ___RD () C:\Users\tamara\Dropbox
2015-04-27 07:06 - 2014-04-04 09:24 - 00000000 ____D () C:\Users\tamara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-27 07:06 - 2014-04-04 09:21 - 00000000 ____D () C:\Users\tamara\AppData\Roaming\Dropbox
2015-04-27 07:03 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-24 14:19 - 2011-08-25 13:01 - 00000736 ___SH () C:\Users\tamara\ntuser.ini
2015-04-20 12:00 - 2014-07-14 11:49 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-20 12:00 - 2014-07-14 11:49 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-16 08:01 - 2011-10-06 12:03 - 00000000 ____D () C:\Users\Barbara

==================== Files in the root of some directories =======

2012-07-06 13:09 - 2012-07-06 13:43 - 0000742 _____ () C:\Users\tamara\AppData\Roaming\CMLS16.tst.txt
2015-04-24 14:16 - 2015-04-27 15:12 - 0097792 _____ () C:\Users\tamara\AppData\Local\ne9bzef6m8.dll

Some content of TEMP:
====================
C:\Users\tamara\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp4qgd38.dll
C:\Users\tamara\AppData\Local\Temp\install_flashplayer11x64ax_gtba_aih[1].exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

--- --- ---


Und Addition:

FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-04-2015
Ran by tamara at 2015-04-27 16:05:01
Running from N:\
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2034041992-2044047822-3026115754-500 - Administrator - Enabled) => C:\Users\Administrator
Gast (S-1-5-21-2034041992-2044047822-3026115754-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG Anti-Virus Business Edition 2012 (Enabled - Up to date) {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AS: AVG Anti-Virus Business Edition 2012 (Enabled - Up to date) {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 8.2.2 - Hewlett-Packard) Hidden
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe PDF iFilter 11 for 64-bit platforms (HKLM\...\{BA5C0CC3-421B-4AE5-9370-1650D1941F30}) (Version: 11.0.00 - Adobe)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Asebis (HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\e94e2bf9505dd541) (Version: 6.0.60.1 - syseca informatik ag)
Asebis Administration (HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\69a2864f8753e3e9) (Version: 6.0.60.1 - syseca informatik ag)
AVG 2012 (HKLM\...\AVG) (Version: 2012.1.2250 - AVG Technologies)
AVG 2012 (Version: 12.0.4311 - AVG Technologies) Hidden
AVG 2012 (Version: 12.1.2250 - AVG Technologies) Hidden
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2474 - CDBurnerXP)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6425.1000 - Microsoft Corporation)
Dropbox (HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
Greenshot 1.0.6.2228 (HKLM\...\Greenshot_is1) (Version: 1.0.6.2228 - Greenshot)
Greenshot 1.0.6.2228 (Wrapped using MSI Wrapper from www.exemsi.com) (HKLM-x32\...\{DE56DC51-45B3-4186-A1D4-E34450D52883}) (Version: 1.0.6.2228 - Greenshot)
HP LaserJet P1500 series (HKLM-x32\...\HP LaserJet P1500 series) (Version:  - )
HP Softpaq SP49160 (HKLM-x32\...\SP44286) (Version:  - )
HP Softpaq SP52247  (HKLM-x32\...\SP46890) (Version:  - )
HPSSupply (HKLM-x32\...\{7902E313-FF0F-4493-ACB1-A8147B78DCD0}) (Version: 2.1.1.0000 - Hewlett Packard Development Company L.P.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections 16.4.69.0 (HKLM\...\PROSetDX) (Version: 16.4.69.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2361 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
MrvlUsgTracking (HKLM-x32\...\{A82D052A-0806-42DF-80CD-1730A1AC0ED3}) (Version: 1.0.7 - Marvell)
MrvlUsgTracking64 (HKLM\...\{42F0FD29-7EB3-4CAA-AF10-BC2619B96D80}) (Version: 1.0.1 - Marvell Semiconductor Pvt Ltd)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5965 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{8A809006-C25A-4A3A-9DAB-94659BCDB107}) (Version: 9.10.0224 - NVIDIA Corporation)
Paint.NET v3.5.6 (HKLM\...\{639673E9-D53F-44F4-A046-485C8A6ADA16}) (Version: 3.56.0 - dotPDN LLC)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.1.0 - Frank Heindörfer, Philip Chinery)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6291 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Syseca Informatik HC Plus 1.20.0 (HKLM-x32\...\Syseca Informatik HC Plus 1.20.0) (Version: HC Plus 1.20.0 - Syseca Informatik AG)
System Requirements Lab for Intel (HKLM-x32\...\{CD41B576-4787-4D5C-95EE-24A4ABD89CD3}) (Version: 4.4.24.0 - Husdawg, LLC)
UltraVNC 1.0.8.2 (HKLM\...\Ultravnc2_is1) (Version: 1.0.8.2 - 1.0.8.2)
Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter: Treiberupdate (HKLM\...\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}) (Version: 6.1.6965.0 - Microsoft Corporation)
Wuala (HKU\S-1-5-21-1844237615-963894560-682003330-1295\...\Wuala) (Version: 1.0.444.0 - LaCie)
Wuala CBFS (HKLM-x32\...\Wuala CBFS) (Version: 3.2.107.0 - LaCie)
Wuala OverlayIcons (HKLM-x32\...\Wuala OverlayIcons) (Version: 1.0.0.2 - LaCie)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => 

==================== Loaded Modules (whitelisted) ==============

2011-01-07 16:57 - 2011-01-07 16:57 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1844237615-963894560-682003330-1295\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: Media is not connected to internet.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Intel(R) PROSet Monitoring Service => 2
MSCONFIG\Services: UNS => 2

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{AB0C9762-99B7-4F5A-BC53-85230C3F6236}] => (Allow) C:\Program Files\UltraVNC\vncviewer.exe
FirewallRules: [{9E015752-EB6B-49CC-9C83-283967855BCB}] => (Allow) C:\Program Files\UltraVNC\vncviewer.exe
FirewallRules: [{AE7BAE9E-8F4D-4D11-89AD-88B50108324B}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
FirewallRules: [{06999EA6-1127-4B6E-91C0-26A2D128B9C2}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
FirewallRules: [{0105C85C-D60A-41F7-9DCD-A5E2512EF5D5}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
FirewallRules: [{3E7078F2-67BA-4F74-880C-7BFA797F68AF}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
FirewallRules: [{655DDFC5-184F-433C-A774-BEEE7192F8C9}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office14\outlook.exe
FirewallRules: [{33C934DB-9040-4E8A-874A-7378528BB342}] => (Allow) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{749CC3B7-4A37-4A71-9181-99D8236E346D}C:\users\tamara\appdata\roaming\wuala\wuala.exe] => (Allow) C:\users\tamara\appdata\roaming\wuala\wuala.exe
FirewallRules: [UDP Query User{2CEB5CC9-4191-4D46-B512-FB3324C0BC62}C:\users\tamara\appdata\roaming\wuala\wuala.exe] => (Allow) C:\users\tamara\appdata\roaming\wuala\wuala.exe
FirewallRules: [TCP Query User{A2885906-FF4A-4C58-A590-D17C273EEA6B}C:\program files (x86)\microsoft office\office14\outlook.exe] => (Block) C:\program files (x86)\microsoft office\office14\outlook.exe
FirewallRules: [UDP Query User{456A0F87-E094-4147-878D-BC92418D337B}C:\program files (x86)\microsoft office\office14\outlook.exe] => (Block) C:\program files (x86)\microsoft office\office14\outlook.exe
FirewallRules: [{9267D745-3511-4C98-970F-3A0788D6D930}] => (Allow) C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe
FirewallRules: [{35826AF1-5F84-4DFE-948B-92E1AA2019A0}] => (Allow) C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe
FirewallRules: [{DD40C9A5-4B1F-4851-8180-D457BE43DF45}] => (Allow) C:\Windows\System32\spool\drivers\x64\3\HP1006MC.EXE
FirewallRules: [{8F55FAA3-1630-43F0-BA53-A4655242CEA9}] => (Allow) C:\Windows\System32\spool\drivers\x64\3\HP1006MC.EXE
FirewallRules: [{5BAD110A-4BAD-4B05-B00A-9F1AD2673E1F}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{7098F67F-4BA2-4B6B-B0B7-A172C2815A6A}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{9F5A216F-2785-4E20-AFE7-FCC12F69724D}] => (Allow) C:\Users\tamara\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{9B488374-EBD7-422B-8937-8CEFAECF52E2}] => (Allow) C:\Users\tamara\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{771A73B8-4AAB-4C27-A577-57E505A4CBCC}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgdiagex.exe
FirewallRules: [{B70894D5-AAF6-4265-8C0C-F49A70CACAEF}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgdiagex.exe
FirewallRules: [{667C6F6E-0CCD-41AF-8384-FA4796CC289E}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
FirewallRules: [{0D8401DA-14B7-42BF-ABF4-300FDF2AFC28}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
FirewallRules: [TCP Query User{2848F47F-A528-41E1-8D45-582C2BD8E206}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [UDP Query User{5A5496A2-BA1D-4BD3-80E3-A6CF7A41552C}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe

==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/27/2015 04:03:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: ce0

Startzeit: 01d080a7a6cf3425

Endzeit: 103

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: 3677b464-ece6-11e4-8b82-78acc0ba6841

Error: (04/01/2015 11:10:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OUTLOOK.EXE, Version: 14.0.7143.5000, Zeitstempel: 0x54b56e39
Name des fehlerhaften Moduls: MSPST32.DLL, Version: 14.0.7143.5000, Zeitstempel: 0x54b56d7b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0004a159
ID des fehlerhaften Prozesses: 0x1150
Startzeit der fehlerhaften Anwendung: 0xOUTLOOK.EXE0
Pfad der fehlerhaften Anwendung: OUTLOOK.EXE1
Pfad des fehlerhaften Moduls: OUTLOOK.EXE2
Berichtskennung: OUTLOOK.EXE3

Error: (02/05/2015 00:52:54 PM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.

Error: (02/04/2015 08:47:57 AM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.

Error: (02/03/2015 01:13:23 PM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.

Error: (02/02/2015 08:47:44 AM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.

Error: (01/30/2015 09:01:52 AM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.

Error: (01/29/2015 08:24:44 AM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.

Error: (11/24/2014 01:52:32 PM) (Source: Group Policy Internet Settings) (EventID: 8194) (User: NT-AUTORITÄT)
Description: Die clientseitige Erweiterung konnte die Richtlinieneinstellungen für "Default Staff Users Windows 7 Policy {DB809BD8-C3DA-4E54-968C-65D766AFF7FE}" nicht  übernehmen Benutzer, da ein Fehler mit Fehlercode "0x80070003 Das System kann den angegebenen Pfad nicht finden."%übernehmen00790275 aufgetreten ist.

Error: (11/18/2014 05:18:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TwixMail.exe, Version: 51.0.0.0, Zeitstempel: 0x545b42fb
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00036b82
ID des fehlerhaften Prozesses: 0x186c
Startzeit der fehlerhaften Anwendung: 0xTwixMail.exe0
Pfad der fehlerhaften Anwendung: TwixMail.exe1
Pfad des fehlerhaften Moduls: TwixMail.exe2
Berichtskennung: TwixMail.exe3


System errors:
=============
Error: (04/27/2015 04:03:13 PM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne ZrnsurStibi aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.

Error: (04/27/2015 03:59:01 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (04/27/2015 07:27:56 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 40.

Error: (04/27/2015 07:27:56 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 40.

Error: (02/25/2015 08:52:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel(R) Rapid Storage Technology" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/25/2015 08:52:13 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Intel(R) Rapid Storage Technology erreicht.

Error: (02/06/2015 10:09:20 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (02/05/2015 04:19:01 PM) (Source: Application Management Group Policy) (EventID: 103) (User: NT-AUTORITÄT)
Description: Das Entfernen der Zuweisung der Anwendung Adobe Flash Player 16 ActiveX von der Richtlinie deploy_AdobeFlash_16_ActiveX ist fehlgeschlagen. Fehler: %%2

Error: (02/05/2015 02:27:58 PM) (Source: Application Management Group Policy) (EventID: 103) (User: NT-AUTORITÄT)
Description: Das Entfernen der Zuweisung der Anwendung Adobe Flash Player 16 ActiveX von der Richtlinie deploy_AdobeFlash_16_ActiveX ist fehlgeschlagen. Fehler: %%2

Error: (02/05/2015 00:52:54 PM) (Source: Application Management Group Policy) (EventID: 108) (User: NT-AUTORITÄT)
Description: Die Änderungen an den Softwareinstallationseinstellungen wurden nicht angewendet. Änderungen an der Software konnten nicht übernommen werden. Ein vorheriger Protokolleintrag mit Einzelheiten sollte vorhanden sein. Fehler: %%1603


Microsoft Office Sessions:
=========================
Error: (04/27/2015 04:03:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.17567ce001d080a7a6cf3425103C:\Windows\Explorer.EXE3677b464-ece6-11e4-8b82-78acc0ba6841

Error: (04/01/2015 11:10:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: OUTLOOK.EXE14.0.7143.500054b56e39MSPST32.DLL14.0.7143.500054b56d7bc00000050004a159115001d06c43b0805089C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXEC:\Program Files (x86)\Microsoft Office\Office14\MSPST32.DLLf58b034d-d84e-11e4-bc7a-78acc0ba6841

Error: (02/05/2015 00:52:54 PM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/04/2015 08:47:57 AM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/03/2015 01:13:23 PM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/02/2015 08:47:44 AM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (01/30/2015 09:01:52 AM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (01/29/2015 08:24:44 AM) (Source: MsiInstaller) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Product: Adobe Flash Player 14 ActiveX -- The version of the Player that you are trying to install is lower than what is currently installed.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (11/24/2014 01:52:32 PM) (Source: Group Policy Internet Settings) (EventID: 8194) (User: NT-AUTORITÄT)
Description: übernehmenBenutzerDefault Staff Users Windows 7 Policy {DB809BD8-C3DA-4E54-968C-65D766AFF7FE}0x80070003 Das System kann den angegebenen Pfad nicht finden.

Error: (11/18/2014 05:18:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TwixMail.exe51.0.0.0545b42fbntdll.dll6.1.7601.18247521ea8e7c000000500036b82186c01d00342e675b4e2\\spsrv103\twixtel$\TwixMail.exeC:\Windows\SysWOW64\ntdll.dll261bbb62-6f36-11e4-b867-78acc0ba6841


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2500 CPU @ 3.30GHz
Percentage of memory in use: 74%
Total physical RAM: 3984.02 MB
Available physical RAM: 1004.34 MB
Total Pagefile: 7966.22 MB
Available Pagefile: 4448.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.71 GB) (Free:375.91 GB) NTFS
Drive n: () (Removable) (Total:28.86 GB) (Free:13.89 GB) FAT32
Drive w: (Wuala) (Network) (Total:5 GB) (Free:5 GB) FAT32

==================== MBR & Partition Table ==================

==================== End Of Log ============================
         

--- --- ---



Liebe Grüsse

Unsere Tools brauchen immer Adminrechte!


Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.