Einen schönen guten Abend.

Nun, mich hat es auf meinem Laptop erwischt mit dem GVU-Trojaner - Trojan.Script.488158

Ich habe Windows 7 Home Premium als System

Ich habe ihn seit Montag Abend auf meinem Rechner und schreibe mal auf, was sich so ergeben hat.

Am Montag Abend war der Trojaner auf dem Lappi. Ich habe diesen dann runter gefahren und bin über das zweite Konto "Gastaccount" wieder reingekommen. Ich habe dann mit meinem Anti-Virus-Programm Bitdefender einen vollständigen Systemscan durchgeführt. Der Trojaner wurde gefunden und gelöscht. Nach einem Neustart und Anmeldung mit dem üblichen Konto war der Trojaner wieder da.
Durch Zufall oder Glück??? und kurzes Antippen des Ein-Ausschalters war der "GVU-Bildschirm" plötzlich weg. Ich hab dann über Google nach Lösungsmöglichkeiten gesucht. Über "CT" habe ich dann das System im abgesicherten Modus gestartet und dann unter Laufwerk C nach "*.exe" gesucht und dann einfach die neuste exe-Datei gelöscht. Der Lappi lief dann wieder ganz normal. Bitdefender meldete einen Trojaner, der direkt in Quaratäne verschoben wurde. Alles lief bestens.
Bis heute Abend. Plötzlich ist der GVU-Trojaner wieder da. Bin nun wieder über das "Gastkonto" angemeldet und mache wieder einen vollständigen Sytemscan. Zur zeit sind 4 Bedrohungen gefunden.

Ich hoffe, dass man mein Geschreibe einigermaßen nachvollziehen kann.

Und jetzt bitte ich um Hilfe!!!!
Sollte es einfacher sein, über das Gastkonto (habe hier mittlerweile auch Adminrechte) die wichtigsten Daten zu sichern und "Recovery" durchzuführen, dann mache ich das.


LG
StefanNRW

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

• Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit
• Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
• Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

• Starte den Rechner neu.
• Während dem Hochfahren drücke mehrmals die F8 Taste
• Wähle nun Computer reparieren.
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

• Lege die Windows CD in dein Laufwerk.
• Starte den Rechner neu und starte von der CD.
• Wähle die Spracheinstellungen und klicke "Weiter".
• Klicke auf Computerreparaturoptionen !
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

• Gib nun bitte notepad ein und drücke Enter.
• Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
  Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
• Schließe Notepad wieder
• Gib nun bitte folgenden Befehl ein.
  e:\frst.exe bzw. e:\frst64.exe
  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
• Akzeptiere den Disclaimer mit Yes und klicke Scan

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-07-2013 02
Ran by SYSTEM on 04-07-2013 06:07:23
Running from G:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10918504 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3  [2092648 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-31] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2028328 2010-01-22] (Synaptics Incorporated)
HKLM\...\Run: [VX3000] C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [BDAgent] "C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe" [1091200 2012-12-18] (Bitdefender)
HKLM-x32\...\Run: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] "C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe" /s [171104 2010-03-02] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-04-30] (Apple Inc.)
HKU\Default\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Default User\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Gast\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-04-21] (Google Inc.)
HKU\Stefan Hambach\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-04-21] (Google Inc.)
HKU\Stefan Hambach\...\Run: [Facebook Update] "C:\Users\Stefan Hambach\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2013-03-25] (Facebook Inc.)
HKU\Stefan Hambach\...\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844144 2013-02-13] (Samsung)
HKU\Stefan Hambach\...\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload [1509232 2013-02-13] (Samsung)
HKU\Stefan Hambach\...\Run: [ctfmon32.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\etozd.dat,XFG00 [x]
HKU\Stefan Hambach\...\Winlogon: [Shell] explorer.exe <==== ATTENTION 
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [112232 2010-09-02] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [100968 2010-09-02] (NVIDIA Corporation)
Startup: C:\Users\Stefan Hambach\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\etozd.dat (No File)

==================== Services (Whitelisted) =================

S2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-18] ()
S2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [159752 2010-04-23] ()
S3 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [75384 2012-09-06] (Bitdefender)
S3 Update Server; C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [466736 2011-10-14] (BitDefender)
S2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe [67904 2012-09-06] (Bitdefender)
S2 vsserv; C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe [1957912 2012-12-18] (Bitdefender)

==================== Drivers (Whitelisted) ====================

S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [705552 2012-12-18] (BitDefender)
S3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-12-18] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [587024 2012-12-18] (BitDefender)
S1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93160 2012-09-06] (BitDefender LLC)
S0 bdfsfltr; C:\Windows\System32\DRIVERS\bdfsfltr.sys [442088 2011-08-16] (BitDefender)
S1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 bdsandbox; C:\Windows\system32\drivers\bdsandbox.sys [79952 2011-11-17] (BitDefender SRL)
S1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [103944 2010-01-19] (BitDefender)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()
S2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [329800 2011-10-27] (BitDefender S.R.L.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-04 06:07 - 2013-07-04 06:07 - 00000000 ____D C:\FRST
2013-07-03 19:52 - 2013-07-03 19:52 - 01934082 ____A (Farbar) C:\Users\Stefan Hambach\Downloads\FRST64.exe
2013-07-03 19:51 - 2013-07-03 19:51 - 01372941 ____A (Farbar) C:\Users\Stefan Hambach\Downloads\FRST.exe
2013-07-03 10:12 - 2013-07-03 10:12 - 00000000 ____D C:\Users\Gast\Documents\ZPS13
2013-07-03 10:08 - 2013-07-03 10:09 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Zoner
2013-07-03 10:08 - 2013-07-03 10:08 - 00000000 ____D C:\Users\Gast\AppData\Local\Zoner
2013-07-03 09:32 - 2013-07-03 09:32 - 00000439 ____A C:\Users\Gast\AppData\Roaminguser_gensett.xml
2013-07-02 08:05 - 2013-07-02 08:05 - 00347424 ____A (Microsoft Corporation) C:\Users\Stefan Hambach\Downloads\MicrosoftFixit.IEPerformance.MATSKB.Run.exe
2013-07-02 07:34 - 2013-07-03 09:28 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-07-01 19:49 - 2013-07-01 19:49 - 00044544 ____A (Microsoft Corporation) C:\ProgramData\rundll32.exe
2013-07-01 10:59 - 2013-07-01 10:59 - 00000000 ____D C:\Users\Gast\AppData\Local\Macromedia
2013-07-01 09:44 - 2013-07-01 09:46 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Games
2013-07-01 09:36 - 2013-07-03 09:29 - 95023320 ___AT C:\ProgramData\dzote.pad
2013-07-01 09:36 - 2013-07-01 09:36 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-07-01 09:36 - 2013-07-01 09:36 - 00000151 ____A C:\ProgramData\dzote.reg
2013-07-01 09:36 - 2013-07-01 09:36 - 00000056 ____A C:\ProgramData\dzote.bat
2013-07-01 07:21 - 2013-07-03 19:40 - 00001176 ____A C:\Windows\setupact.log
2013-07-01 07:21 - 2013-07-01 07:21 - 00000000 ____A C:\Windows\setuperr.log
2013-06-30 09:15 - 2013-06-30 09:15 - 00000000 ____D C:\Users\Stefan Hambach\AppData\Local\{527B8BEB-3355-4C23-A3E3-BB2BF6FE88A6}
2013-06-27 10:38 - 2013-06-27 10:38 - 00000000 ____D C:\Users\Stefan Hambach\AppData\Local\{21743730-57A6-4E50-889D-92BFAB38F8DA}
2013-06-14 13:33 - 2013-06-08 06:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 13:33 - 2013-06-08 06:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 13:33 - 2013-06-08 06:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 13:33 - 2013-06-08 04:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 13:33 - 2013-06-08 03:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-14 13:33 - 2013-06-08 03:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-14 13:33 - 2013-06-08 03:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-14 13:33 - 2013-06-08 03:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-14 13:32 - 2013-06-08 06:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 13:32 - 2013-06-08 06:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 13:32 - 2013-06-08 03:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-14 13:32 - 2013-06-08 03:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-11 19:48 - 2013-05-16 17:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-11 19:48 - 2013-05-16 17:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-11 19:48 - 2013-05-16 17:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-11 19:48 - 2013-05-16 17:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-11 19:48 - 2013-05-16 17:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-11 19:48 - 2013-05-16 17:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-11 19:48 - 2013-05-16 17:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-11 19:48 - 2013-05-16 17:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-11 19:48 - 2013-05-16 16:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-11 19:48 - 2013-05-16 16:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-11 19:48 - 2013-05-16 16:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-11 19:48 - 2013-05-16 16:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-11 19:48 - 2013-05-16 16:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-11 19:48 - 2013-05-16 16:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-11 19:48 - 2013-05-16 16:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-11 19:48 - 2013-05-16 16:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-11 19:48 - 2013-05-16 16:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-11 19:48 - 2013-05-14 04:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-11 19:48 - 2013-05-14 00:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-11 19:39 - 2013-05-12 21:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-11 19:39 - 2013-05-12 21:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-11 19:39 - 2013-05-12 21:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-11 19:39 - 2013-05-12 21:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-11 19:39 - 2013-05-12 20:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-11 19:39 - 2013-05-12 20:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-11 19:39 - 2013-05-12 20:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-11 19:39 - 2013-05-12 19:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-11 19:39 - 2013-05-12 19:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-11 19:39 - 2013-05-12 19:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-11 19:39 - 2013-05-09 21:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-11 19:39 - 2013-05-09 19:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-11 19:39 - 2013-05-07 22:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-11 19:39 - 2013-04-25 21:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-11 19:39 - 2013-04-25 20:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-11 19:39 - 2013-04-25 15:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-11 19:39 - 2013-04-16 23:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-11 19:39 - 2013-04-16 22:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 19:39 - 2013-03-31 14:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll

==================== One Month Modified Files and Folders =======

2013-07-04 06:07 - 2013-07-04 06:07 - 00000000 ____D C:\FRST
2013-07-03 19:57 - 2011-11-20 02:35 - 01868162 ____A C:\Windows\WindowsUpdate.log
2013-07-03 19:54 - 2011-04-21 12:52 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-03 19:52 - 2013-07-03 19:52 - 01934082 ____A (Farbar) C:\Users\Stefan Hambach\Downloads\FRST64.exe
2013-07-03 19:52 - 2010-05-12 00:18 - 00654852 ____A C:\Windows\System32\perfh007.dat
2013-07-03 19:52 - 2010-05-12 00:18 - 00130434 ____A C:\Windows\System32\perfc007.dat
2013-07-03 19:52 - 2009-07-13 21:13 - 01500294 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-03 19:51 - 2013-07-03 19:51 - 01372941 ____A (Farbar) C:\Users\Stefan Hambach\Downloads\FRST.exe
2013-07-03 19:48 - 2009-07-13 20:45 - 00009888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-03 19:48 - 2009-07-13 20:45 - 00009888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-03 19:41 - 2012-03-20 13:53 - 00000964 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001UA.job
2013-07-03 19:40 - 2013-07-01 07:21 - 00001176 ____A C:\Windows\setupact.log
2013-07-03 19:40 - 2011-04-22 03:13 - 00000376 ____A C:\Users\Stefan Hambach\AppData\Roamingprivacy.xml
2013-07-03 19:40 - 2011-04-21 12:52 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-03 19:40 - 2010-12-27 11:38 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-03 19:40 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-03 11:38 - 2011-06-08 06:08 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-03 10:14 - 2012-02-17 15:22 - 00000056 ____A C:\Windows\System32\bdsandbox.txt
2013-07-03 10:12 - 2013-07-03 10:12 - 00000000 ____D C:\Users\Gast\Documents\ZPS13
2013-07-03 10:09 - 2013-07-03 10:08 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Zoner
2013-07-03 10:08 - 2013-07-03 10:08 - 00000000 ____D C:\Users\Gast\AppData\Local\Zoner
2013-07-03 09:58 - 2012-06-27 07:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-03 09:32 - 2013-07-03 09:32 - 00000439 ____A C:\Users\Gast\AppData\Roaminguser_gensett.xml
2013-07-03 09:29 - 2013-07-01 09:36 - 95023320 ___AT C:\ProgramData\dzote.pad
2013-07-03 09:28 - 2013-07-02 07:34 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-07-02 10:41 - 2012-03-20 13:53 - 00000942 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001Core.job
2013-07-02 08:05 - 2013-07-02 08:05 - 00347424 ____A (Microsoft Corporation) C:\Users\Stefan Hambach\Downloads\MicrosoftFixit.IEPerformance.MATSKB.Run.exe
2013-07-01 19:49 - 2013-07-01 19:49 - 00044544 ____A (Microsoft Corporation) C:\ProgramData\rundll32.exe
2013-07-01 19:25 - 2012-11-07 02:11 - 00000000 ____D C:\Users\Gast\AppData\Local\Google
2013-07-01 19:23 - 2011-06-08 06:08 - 00000376 ____A C:\Users\Gast\AppData\Roamingprivacy.xml
2013-07-01 10:59 - 2013-07-01 10:59 - 00000000 ____D C:\Users\Gast\AppData\Local\Macromedia
2013-07-01 09:46 - 2013-07-01 09:44 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Games
2013-07-01 09:36 - 2013-07-01 09:36 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-07-01 09:36 - 2013-07-01 09:36 - 00000151 ____A C:\ProgramData\dzote.reg
2013-07-01 09:36 - 2013-07-01 09:36 - 00000056 ____A C:\ProgramData\dzote.bat
2013-07-01 08:30 - 2013-05-14 09:03 - 00000000 ____D C:\Users\Stefan Hambach\Downloads\Neuer Ordner
2013-07-01 07:21 - 2013-07-01 07:21 - 00000000 ____A C:\Windows\setuperr.log
2013-06-30 09:38 - 2011-04-23 02:24 - 00000000 ____D C:\Users\Stefan Hambach\Tracing
2013-06-30 09:33 - 2013-04-19 10:28 - 00000000 ____D C:\Users\Stefan Hambach\AppData\Roaming\Skype
2013-06-30 09:15 - 2013-06-30 09:15 - 00000000 ____D C:\Users\Stefan Hambach\AppData\Local\{527B8BEB-3355-4C23-A3E3-BB2BF6FE88A6}
2013-06-27 10:38 - 2013-06-27 10:38 - 00000000 ____D C:\Users\Stefan Hambach\AppData\Local\{21743730-57A6-4E50-889D-92BFAB38F8DA}
2013-06-22 01:41 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-06-21 01:56 - 2011-04-21 12:53 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-06-17 08:38 - 2013-04-19 10:28 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-17 08:38 - 2013-04-19 10:28 - 00000000 ____D C:\ProgramData\Skype
2013-06-15 02:40 - 2011-04-21 12:54 - 00000000 ____D C:\users\Stefan Hambach
2013-06-12 08:58 - 2012-06-27 07:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 08:58 - 2012-06-27 07:36 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 19:48 - 2010-12-27 12:40 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-08 06:08 - 2013-06-14 13:33 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 06:07 - 2013-06-14 13:32 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 06:06 - 2013-06-14 13:33 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 06:06 - 2013-06-14 13:33 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 06:06 - 2013-06-14 13:32 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 04:28 - 2013-06-14 13:33 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 03:42 - 2013-06-14 13:33 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 03:40 - 2013-06-14 13:33 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 03:40 - 2013-06-14 13:33 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 03:40 - 2013-06-14 13:32 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 03:40 - 2013-06-14 13:32 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 03:13 - 2013-06-14 13:33 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

Files to move or delete:
====================
C:\ProgramData\rundll32.exe
C:\Users\Stefan Hambach\AppData\Roaming\skype.ini
C:\ProgramData\dzote.bat
C:\ProgramData\dzote.pad
C:\ProgramData\dzote.reg

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-14 13:32:45
Restore point made on: 2013-06-18 02:44:25
Restore point made on: 2013-06-21 04:18:23
Restore point made on: 2013-06-23 01:45:56
Restore point made on: 2013-06-28 10:17:20
Restore point made on: 2013-07-03 09:37:43

==================== Memory info =========================== 

Percentage of memory in use: 16%
Total physical RAM: 3893.07 MB
Available physical RAM: 3258.84 MB
Total Pagefile: 3891.22 MB
Available Pagefile: 3254.22 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:256.99 GB) (Free:109.8 GB) NTFS (Disk=0 Partition=2)
Drive e: (Recover) (Fixed) (Total:40 GB) (Free:20.94 GB) NTFS (Disk=0 Partition=3)
Drive g: (INTENSO) (Removable) (Total:7.43 GB) (Free:4.39 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: () (Fixed) (Total:0.1 GB) (Free:0.04 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 29DD2CD8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=257 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=0C)


LastRegBack: 2013-06-28 23:23

==================== End Of Log ============================
         

--- --- ---

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKU\Stefan Hambach\...\Run: [ctfmon32.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\etozd.dat,XFG00 [x]
HKU\Stefan Hambach\...\Winlogon: [Shell] explorer.exe <==== ATTENTION 
Startup: C:\Users\Stefan Hambach\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\etozd.dat (No File)
C:\ProgramData\rundll32.exe
C:\Users\Stefan Hambach\AppData\Roaming\skype.ini
C:\ProgramData\dzote.bat
C:\ProgramData\dzote.pad
C:\ProgramData\dzote.reg
C:\ProgramData\etozd.dat
         

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

• Starte deinen Rechner erneut in die Reparaturoptionen
• Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-07-2013 02
Ran by SYSTEM at 2013-07-04 16:55:35 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

HKU\Stefan Hambach\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon32.exe => Value deleted successfully.
HKU\Stefan Hambach\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Users\Stefan Hambach\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk => Moved successfully.
C:\PROGRA~3\etozd.dat not found.
C:\ProgramData\rundll32.exe => Moved successfully.
C:\Users\Stefan Hambach\AppData\Roaming\skype.ini => Moved successfully.
C:\ProgramData\dzote.bat => Moved successfully.
C:\ProgramData\dzote.pad => Moved successfully.
C:\ProgramData\dzote.reg => Moved successfully.
"C:\ProgramData\etozd.dat" => File/Directory not found.

==== End of Fixlog ====
         

neu booten?

Hallo Schrauber,

habe den Lappi hochgefahren. Kein GVU mehr da und alles funktioniert! Habe auch das Gefühl, dass er jetzt besser läuft.
Ganz lieben Dank!!!

Kontrollscans

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Scan.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Bleibt die Frage, wie ich Bitdefender ausschalte...... werds mal versuchen...

# AdwCleaner v2.304 - Datei am 05/07/2013 um 19:37:26 erstellt
# Aktualisiert am 03/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Stefan Hambach - STEFANHAMBACH
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Stefan Hambach\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\searchplugins\icqplugin.xml
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Trymedia

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\Software\Freeze.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fd31db37f368bf575c9eb3d51ef0b9a4
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\prefs.js

C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Gelöscht : user_pref("browser.search.defaultenginename", "Ask.com");
Gelöscht : user_pref("browser.search.order.1", "Ask.com");
Gelöscht : user_pref("browser.search.selectedEngine", "Ask.com");
Gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Gelöscht : user_pref("icqtoolbar.engineVerified", false);
Gelöscht : user_pref("icqtoolbar.geolastmodified", 1303559566);
Gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
Gelöscht : user_pref("icqtoolbar.icqgeo", 49);
Gelöscht : user_pref("icqtoolbar.installTime", "1303559566");
Gelöscht : user_pref("icqtoolbar.installsource", "1");
Gelöscht : user_pref("icqtoolbar.newtab_state", "1");
Gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Gelöscht : user_pref("icqtoolbar.skip_default_search", "yes");
Gelöscht : user_pref("icqtoolbar.suggestions", false);
Gelöscht : user_pref("icqtoolbar.uniqueID", "130350574513035056391303559566394");
Gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1303559568);
Gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
Gelöscht : user_pref("keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.0&q=");

Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\k6zyeuaq.default\prefs.js

Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Gelöscht : user_pref("browser.search.defaultenginename", "Ask.com");
Gelöscht : user_pref("browser.search.order.1", "Ask.com");
Gelöscht : user_pref("browser.search.selectedEngine", "Ask.com");
Gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");

-\\ Google Chrome v27.0.1453.116

Datei : C:\Users\Stefan Hambach\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [5154 octets] - [05/07/2013 19:37:26]

########## EOF - C:\AdwCleaner[S1].txt - [5214 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Stefan Hambach on 05.07.2013 at 19:53:05,61
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{94EFF28E-A31D-4F71-8026-44A70D403672}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC8}



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{00DA7C35-B701-4DD2-B1D2-8AC5C8FA6D05}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{029E6741-E506-4DFD-B906-02729DDE5577}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{0584F75C-2FAE-44B7-A9E0-98FE3CD2EDEE}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{083894F3-0444-4CDA-BC9D-0A58B90F05EB}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{0A21E62D-5575-473F-8333-873CF28065AD}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{0AEDCF1A-2A5A-4FAF-901A-478C45732FA5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{0B843CBF-A121-4F71-898B-7D681F311A8A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{0C094B8B-08D6-421A-B1FF-792FA2E831EF}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{0C2E6900-5FC5-4329-A647-A988742A12BD}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{0D1EC09C-A2FB-48A6-B38E-45BFC6014B00}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{0E59D7E9-50E4-40C5-997D-F205B6D5EC98}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{10644CE4-3ACF-4C10-BA87-DE912F11A9D8}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{113ADEB1-292E-4821-B89C-20B0F622288B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{11D3CF35-B530-46ED-AE37-3D3898E31BDE}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{12BD0DE4-C023-4C17-8541-F5B1CFAF1275}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{13AFFB42-C037-4CA8-B756-0BE128B80FF1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{14DC3BBD-C4EB-4DBA-99E3-8956BE1BD480}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{15C591A7-C428-46A3-9C32-281B059DD722}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{15FD6A91-E8E2-4D67-927C-E5877D17DBCC}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{172F1762-308A-42DA-A42D-E1B6D55CED57}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{17975CB2-0FF5-4266-A4EA-17EA2E79D884}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{17C8C704-D998-4647-A6A6-A2D41420F7BC}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{1888E70E-B4F3-47CC-9433-9A045C6B96EE}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{1D6A483E-2B10-4EB0-A50F-06FED6D4A6AE}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{1DA3BE1D-9890-4AFD-8179-4AE06576FCF4}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{1DC5840C-9A77-4DBF-A717-7C477818E3E0}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{1DDD1698-715E-47C3-997B-8C7403F97CAE}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{1ED40878-A973-48AB-9E62-C598CE680CD5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{1FFD4739-BF41-4C62-AE37-49170E8E05B2}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{20F0B47B-741D-4D5B-AE86-B295842FB9F2}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{21743730-57A6-4E50-889D-92BFAB38F8DA}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{234C91F5-8739-4905-886A-A8C613F4FC38}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{24259E65-A923-47FA-BE15-50C104B02496}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{24FF3AFE-857E-4FEF-94CA-334B5A5C4F4D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{2642E9CF-D8C0-4B68-B29D-D1A624E5272B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{26A90AF6-B252-4A56-86A8-A03CE4FAA73F}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{27180D68-62CC-45F4-9F06-6DD7097EE5EF}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{2917CF81-B79C-40E3-9F1C-27BB3E2F4836}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{29D9C0D3-83C9-4535-939B-E4C4539399FF}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{2C568398-A8DB-4AB7-BF8F-F026153A511A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{2D54BB09-2D63-45E7-86BD-40090F6DAF4A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{2D94A086-8F57-4B92-93DD-ED2D4CD2E7E8}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{2ECBF197-B05D-40D7-BC7F-88D0C94EE494}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3056B970-0B9A-4676-98EE-AE63123CB310}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{30ACA239-22A7-4748-8246-BD81BFC7E44F}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3125C2FB-1619-4AE8-9463-0C55C7CBB82B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3162EB8D-BBC1-47FE-88E9-797805097990}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3366725B-3FB2-4BC0-8531-EB3AE8BBFCF5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{33709382-33AB-4F92-917A-0423098ED791}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{346C2209-226D-4978-9631-D0E85CFB39C5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{348B9F4C-AB76-4E0E-959B-7CD852CF3CD0}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{34DF0CA8-DEE9-4460-B3AC-C31D32053FB4}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3564014F-16E5-4F4D-9322-C5FEB40B483A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{37082A2C-F5BE-4C87-B9EA-E883765756E3}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{370D167C-ECE6-4E63-B96A-E63B04516224}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{38123B00-BE47-4C3E-9654-4C42F6D1B2D9}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3885BA83-7ACC-4111-8158-1F56C5567C5A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3ADE8348-024E-4E4F-ADA5-1B3B3DD6E5B8}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3CC9E33A-5F90-42A7-9DB9-2EEF246D7FB9}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3D867EB3-AAAB-4A81-B2BE-C4B329394C5C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{3F40137C-A538-481B-B4BB-B44DE0404808}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{404885B7-DF34-4243-A7C9-9A6BDB52F617}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{420DE196-CCB7-4D9D-8FFE-A06C232B991C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{454A917D-A62E-415F-883C-91544A777E9D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{45E65399-D409-4829-B341-C27788D69527}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{46B3F7F7-3320-41BC-A7E6-952AC5FE7600}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{48636BEF-F0E6-4C53-BFC5-8695999E2E56}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{492E4C95-1811-40BE-BDCB-9E81837400D2}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4A3AD138-98E1-4B1E-B792-C515BAA5280C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4B1B0940-AB06-47E5-B78D-5AD88E5B70DE}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4B504DD0-CFB4-4975-9DF4-813DF8B6E2C9}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4BFBBE86-BCC8-48CD-8810-F384A54C2A57}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4CF71D34-39CC-468F-B90F-0D0D3011A942}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4DD03DB4-3B27-4F18-9614-3E38640E40E2}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4F2619BE-90FD-41A9-A609-3C856DC75958}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4F282A1F-B638-4C3D-973C-4636A23C6B24}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4F2CE4E7-AB8C-4462-9D30-4569EEA9F8B7}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{4FA6BEA3-720D-4263-B18D-6DADCA812798}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{50083C35-1DDB-478B-802C-E8D37484DCD1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{50208349-0C3B-4871-9296-CECBEFB194FB}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{50448B22-F213-4E45-9B1C-A033DCB5A7E5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{505167E9-6425-439D-ADCC-A8EC771BE16C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{51C258D1-4539-45D1-817F-1894531C58AA}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{51DEDDEB-42E2-4DC3-B3DC-DA24514B2DF4}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{527B8BEB-3355-4C23-A3E3-BB2BF6FE88A6}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{55255ED9-C13C-4CD1-BFAD-7CCB25C9220D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{55A38688-9492-45EE-8C81-FA415775C256}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{5808ED29-2E9A-474A-9F09-85B72CCA2338}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{581E3810-ACE8-409E-A677-2C5E14B3ADE3}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{586D026F-08A4-4104-A492-BC03F3E44D8E}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{5933BA9D-9F9D-40C2-A06C-9683B26A7FB2}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{595B3423-F147-4EA5-AC95-6A2BF7755DF5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{5A9A031D-36FC-477F-8ACC-73AFDCBD8AD8}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{5D059733-355C-4398-96FD-BA1437DD3B2F}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{5EDAF1F2-2A25-450C-A8E0-1B34F0D936D7}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{5F556175-B13B-45F5-9FAD-62FF84DFE2F4}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{60FAF114-D542-442E-8FB3-420C86D61157}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{61EAD25A-3D5B-496C-BE47-8CC0B150198E}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{62339BDC-09E5-47B7-A7C9-667A35557947}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{624787F3-26A5-4301-AFA5-BBF638B8EFA9}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{63943D53-6577-4AD3-95A1-9427E2A35D70}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{651CFC00-ABA7-4DE3-9841-47C86501C70B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{661474B9-8EF2-4AA4-B421-9D355E0E2E24}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{66552B10-1FEA-47C8-B52A-B3E1EA3CC865}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{66EFF6B5-F188-42DA-99C8-95EC3F8DEC74}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{6738048E-ED1F-47C6-A8AC-0E0261933375}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{67C9F145-9605-443C-A06D-F053344CE382}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{6873739E-3280-4794-B9D3-58ECCA8394BA}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{68FEA5DA-021B-43D0-B7D6-0F0ECABCDEC6}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{6C0D458A-3F3D-44A1-B558-C5F0BBF036F4}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{6E25403A-673E-417B-AD67-7E7578DDF4C6}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{6E5E9A52-52D1-48D1-9B45-B168D622E1D1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{7021D421-26CD-48B1-8D70-3AC5971D4354}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{70449F76-AFF7-4EFF-8A73-170F715DB627}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{711BC672-7025-496F-9C46-288E046D814B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{71212D99-8FAD-44BC-AB3C-D74606B8CCC3}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{71C3624D-79BF-4D02-B35F-8FD2374A5174}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{7401F270-1286-4790-AA32-D1403FB2B92D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{75A63C5A-CA6A-444F-9D8E-E9A3B11B1B9B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{76CD6E64-98EB-43ED-99C1-31923CC4076A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{76EB0F1E-88A5-472A-AD02-0BD2B46D30DB}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{78837049-EE26-4CB4-83D6-A6E3F7476A8B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{79A39ADC-60BF-4F62-8B2F-53C326365A64}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{79CEDF35-972A-41E0-B7E0-BB0C32EB5B8D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{7B43AE72-01A5-4A90-B7FE-C05B55330367}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{7BEAA1C9-4D7C-4A8E-B056-9F6E76866328}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{7C93CAF2-C6C8-4338-9FE7-78A08027313E}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{7C9F7EBB-803C-4F95-8334-8E998EBA0845}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{7D3659F6-DC84-4545-9408-09735DE4067D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{7D7AB9A2-3F26-4544-B127-760D985F5981}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{80EC0296-09B7-4D2C-9673-2BA9E430C018}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{813DA22B-7DF1-4188-AB33-EAD756D67573}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8145B14D-82FE-4D1F-9358-5A3CBA1F40D1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{82BDFFDF-57D1-4A72-AA89-3DCD8154935A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8362D257-312D-4E28-8FAF-E3FB24114B04}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{83676591-D6A9-4575-9C6E-D4B31D3F6EB6}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8567060A-5192-46F2-8306-F103B7F9D2A1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{86C2A985-A556-4CE9-8227-1B7CB6D09A2D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{87EE5944-FBB3-40E2-9BBD-8540FEB61604}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8A2DDA24-9DB1-471E-8672-41F07C73E6CC}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8A9AAE26-B906-4DC8-84A4-FAED535CC56F}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8D633F05-011D-42D6-ABA7-2E7D305CA781}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8D99A532-EE59-4790-92CA-40E912ADB0D2}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8E1F6545-BB88-45AD-8756-F57ECB825F32}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8E2DBAA3-5966-4F4B-8AAC-2FF74619A86A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8E5F6B10-55E0-4AA3-9384-94DA19E7C03E}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8ECC050D-A486-46A3-9388-B77E51E4C6C0}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8FE7267E-E3AB-4560-8B13-6F58626F8E39}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8FF7D8E7-8103-49F7-A2DF-139F71A5FA89}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{8FFFDCDF-D37F-4B03-96E6-501F2D1ACA3D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{90B15F52-C166-4C0F-88DD-08D402287EB9}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{924C04B3-5058-4AC5-96F4-EBB88FA8AC9D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{93657F96-006B-4940-B9D2-63BE6C5A7D36}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{950E0D01-F7B1-4DDC-9024-9F53ADA5296E}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{9943F3EE-5F4F-4F5F-BB47-029CFF442D75}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{9A1291FD-8D8C-4807-A667-75769EBD2B9B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{9A285BEC-540D-4C9B-9712-DEF1AC5F15F2}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{9ABD6C60-0450-4392-B6C5-78EBBB64FA73}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{9B78DDB0-BA94-4C90-AD9E-1CD15976F7E4}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{9D02518E-73C7-4537-BCAF-EFA59D782242}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{9E4C85FB-5FE2-4CDD-B320-1C211C67AE55}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{9E7D5B99-94FC-4C14-BDFB-E3B889B6645B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{A02F0349-1684-4276-B4D2-C06B59805F91}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{A07ED7D9-8B02-4A8C-90D3-8490ECCEADBD}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{A1D5F38D-F5E0-4E53-A68E-805ED43CEFB5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{A418677C-BD33-4648-BEF7-F06A054804E8}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{A48E20F2-02FC-4153-8D8D-E63E9EFF4EBF}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{A5EA03D0-3BAB-41B1-B848-7D705A12995F}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{AB825986-7FA5-437E-9738-BD0C28A6349A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{ACEACC81-41CF-4765-AAA8-F98EDD1062E1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{ADE85762-ED5E-4072-9AE0-B4698CC3CD9A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{AE1BE7EB-04C4-4BDF-9D5B-2259E00C4E02}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{AE8D91B9-B01A-4BC9-98D0-CC509C710E5B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B09F71EF-0C72-4B98-8FCE-8AD03C762F33}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B1E10BE2-859A-44BA-999A-0DD90B139C09}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B5EC685F-B07F-459D-A1A5-2C115AD3E212}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B609B268-1AF6-4F62-B2F1-E964FC2C6B7B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B64AB739-1F15-4C71-9041-1A406ACC5623}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B657E07F-C281-4AF9-AED5-F186186AF8F4}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B74CA4CD-FD6F-43F0-A892-472D880A0318}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B8D74613-D090-4FF4-A238-98DDD4A55293}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B9467F0B-799A-4F8B-9B4B-09363AEECF9A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{B972DDCC-47B5-4AB1-8222-BA19E577247C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{BA2D9963-6D58-4FD3-B6E9-19D44E8337C8}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{BBE61830-4254-4B43-A6EF-C50AFB14D318}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{BD191068-4745-4097-9F4D-30C0E89E442E}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{BD9B69D7-9297-4B04-9035-84E6A707CEDD}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{BE3B2658-B509-436F-8539-528D08860526}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{BE6B0427-3FB4-4928-821F-E7C780362E1C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{C0B0A006-22F9-4A89-B666-9E1591774E13}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{C101C13E-EEAE-4C10-98B9-766346F656E1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{C41C4F76-97AF-4F46-9B32-E281D00ABF8B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{C6041EF7-116E-41B6-A2CB-6A9C4404E62A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{C6116337-9F58-4001-8105-D7DDB0566CB5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{C6425E77-76E4-44FD-8726-FD6E39ABB587}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{C72CEDE2-7EAE-484C-9F90-AAB084E2A271}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{C8BC83FE-81BC-444D-AE78-62A20BB29C1D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{CABEBB9F-C56E-42A9-A033-CE6ED5E582D5}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{CB5C392E-876C-4D77-80BD-6ADAD66C0EC1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{CD329143-6D63-4C7C-801C-DDA0A5A715A4}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{CD5E1BAA-34AC-4683-9FF9-5B5A6B385467}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D2283B70-7D6F-4DC6-A109-730397036773}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D4349395-9E6B-4F87-B28D-D592D98761F2}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D530B589-7823-41AE-8A54-A27994B50CA0}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D553EAAF-E4E5-4221-B74C-E9ED0BA47EF6}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D71CFEE3-9E60-44BC-B565-7E436EF51285}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D7A4F1D4-20DC-49DE-BE64-157CC67B24BE}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D8817A59-3E2B-4442-A4FC-9B180823CD61}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D8F8A6CB-88BF-4358-A75A-BC099451319B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{D9E55EB6-B40C-443A-94A9-F0C415F5F1DB}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{DB10DE65-502B-450B-9350-80638EC4DA8D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{DCE1E04F-8930-4702-8BFB-451F36E17631}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{DE051BC4-EDF7-4837-A885-B46226E712CF}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E31FCC62-1FD6-4773-A5B3-E16CD0E9498A}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E4179444-E8A3-47C7-98C7-8E8CC932447D}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E525798B-F146-48FD-AE94-8813D0D8937C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E6442469-5A7E-4F60-B39E-7618C73EF883}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E6DF7FB5-0F72-47BE-8CB6-EABB642FC690}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E803E482-35F5-4953-897E-15A27E6C9745}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E830F11D-D1C5-44D5-AAEA-79976216BBD8}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E83323D6-2E81-4D12-9820-E0784A2A8AFA}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E8950581-CE29-4240-9A30-765D81ED38AB}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{E931D3A7-5676-4A4D-B136-2E82B240FDBB}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{EAB06147-9C05-4E14-8DFF-A0CED02ED2BC}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{EC241DB3-1C0F-4C0B-8657-487A4D0C08D1}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{ED5CB5C1-2917-4473-B097-2EFF9418EA64}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{EDD3AEF1-60DA-49E2-B6B0-619561B2D7DC}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{EDFC5C69-7D89-4C2D-A96E-1E3136007E0C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{EEC5CF63-093E-4433-8DED-16196517EE4F}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F07313F3-5849-4CAA-9876-13F1E2B21412}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F13F8463-0C0E-4CE6-BF07-124C7746F76C}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F18EECCE-CD09-4CCE-BD24-9C201A75B679}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F261B89F-307C-4AA3-B69B-228422ACAABC}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F2AC697F-4D82-4C62-AFD1-914258F0E348}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F494D114-0A8B-4548-9420-E0AC49C85806}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F66CEF35-27D4-4C01-B679-D31C85E7D268}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F8ED19C8-8BA4-4C36-8396-FE3D096F7822}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{F9CA8B68-8344-41C9-A6E5-DCAEAE0BFCA3}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FA22FFA2-1A29-460F-95E5-D7FCC98A97F0}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FACD54E8-3637-4F04-A3E2-2E1A7DF65B81}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FB75F1B8-5331-4B8C-872F-306E81EE5FB8}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FC035873-B78F-458F-B484-F4CC9EEE80B7}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FC25B155-D34C-4348-A4EE-E5CB2D79827B}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FC56ADC3-66B6-41F4-9776-5955E964B8F9}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FDF71B02-494B-4AB1-BE52-94D53F238636}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FE05A579-AEF4-47FD-A474-F9997D8D02CD}
Successfully deleted: [Empty Folder] C:\Users\Stefan Hambach\appdata\local\{FE0B1C3F-77AB-4626-8E4C-C7B3014914DC}



~~~ FireFox

Emptied folder: C:\Users\Stefan Hambach\AppData\Roaming\mozilla\firefox\profiles\ff368ksk.default\minidumps [68 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.07.2013 at 20:02:38,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013
Ran by Stefan Hambach (administrator) on 05-07-2013 20:11:47
Running from C:\Users\Stefan Hambach\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Pegatron Corporation) C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Pegatron Corporation) C:\Program Files (x86)\PHotkey\POSD.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Users\Stefan Hambach\Downloads\MicrosoftFixit.IEPerformance.MATSKB.Run.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10918504 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3  [2092648 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-08-01] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2028328 2010-01-22] (Synaptics Incorporated)
HKLM\...\Run: [VX3000] C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [BDAgent] "C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe" [1091200 2012-12-18] (Bitdefender)
HKCU\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-04-21] (Google Inc.)
HKCU\...\Run: [Facebook Update] "C:\Users\Stefan Hambach\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2013-03-25] (Facebook Inc.)
HKCU\...\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844144 2013-02-13] (Samsung)
HKCU\...\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload [1509232 2013-02-13] (Samsung)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [103720 2009-11-03] (CyberLink)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] "C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe" /s [171104 2010-03-03] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKU\Default\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Default User\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Gast\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-04-21] (Google Inc.)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [112232 2010-09-02] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [100968 2010-09-02] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0887FA5D-2B63-4876-BC1D-475D6F1D7BA0} URL = hxxp://de.search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,105,0_0,Search,20120101,16991,0,6,0
SearchScopes: HKCU - {8A244612-A1F7-11E0-95C0-E71F4824019B} URL = hxxp://badoo.com/startpage/?source=bsb&q={searchTerms}
SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_39 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @zylom.com/ZylomGamesPlayer - C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Stefan Hambach\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File
FF SearchPlugin: C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\searchplugins\badoo.xml
FF SearchPlugin: C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\searchplugins\icq.xml
FF Extension: No Name - C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: No Name - C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Yahoo! Toolbar - C:\Users\Stefan Hambach\AppData\Roaming\Mozilla\Firefox\Profiles\ff368ksk.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\
FF Extension: No Name - C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\
FF Extension: No Name - C:\Program Files\Bitdefender\Bitdefender 2012\bdtbext\

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=MDNB&bmod=MDNB
CHR RestoreOnStartup: " hxxp://badoo.com/startpage/"
CHR DefaultSearchURL: (Search) - hxxp://badoo.com/startpage/?source=bsb&q={searchTerms}
CHR DefaultSuggestURL: (Search) -       "suggest_url": ""
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (Zylom Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npzylomgamesplayer.dll (Zylom)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (NPCIG.dll) - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
CHR Extension: (YouTube) - C:\Users\Stefan Hambach\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\Stefan Hambach\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1
CHR Extension: (Gmail) - C:\Users\Stefan Hambach\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

==================== Services (Whitelisted) =================

R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [159752 2010-04-24] ()
S3 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [75384 2012-09-06] (Bitdefender)
S3 Update Server; C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [466736 2011-10-14] (BitDefender)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe [67904 2012-09-06] (Bitdefender)
R2 vsserv; C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe [1957912 2012-12-18] (Bitdefender)

==================== Drivers (Whitelisted) ====================

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [705552 2012-12-18] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-12-18] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [587024 2012-12-18] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93160 2012-09-06] (BitDefender LLC)
R0 bdfsfltr; C:\Windows\System32\DRIVERS\bdfsfltr.sys [442088 2011-08-16] (BitDefender)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 bdsandbox; C:\Windows\system32\drivers\bdsandbox.sys [79952 2011-11-17] (BitDefender SRL)
R1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [103944 2010-01-19] (BitDefender)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] ()
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [329800 2011-10-27] (BitDefender S.R.L.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-05 20:10 - 2013-07-05 20:10 - 01934636 ____A (Farbar) C:\Users\Stefan Hambach\Desktop\FRST64.exe
2013-07-05 20:02 - 2013-07-05 20:02 - 00029474 ____A C:\Users\Stefan Hambach\Desktop\JRT.txt
2013-07-05 19:52 - 2013-07-05 19:52 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Stefan Hambach\Desktop\JRT.exe
2013-07-05 19:52 - 2013-07-05 19:52 - 00000000 ____D C:\Windows\ERUNT
2013-07-05 19:52 - 2013-07-05 19:52 - 00000000 ____D C:\JRT
2013-07-05 19:40 - 2013-07-05 19:40 - 00005279 ____A C:\Users\Stefan Hambach\Desktop\AdwCleaner[S1].txt
2013-07-05 19:39 - 2013-07-05 19:39 - 00000452 ____A C:\Windows\PFRO.log
2013-07-05 19:37 - 2013-07-05 19:38 - 00005279 ____A C:\AdwCleaner[S1].txt
2013-07-05 19:36 - 2013-07-05 19:36 - 00650027 ____A C:\Users\Stefan Hambach\Desktop\adwcleaner.exe
2013-07-04 16:07 - 2013-07-04 16:07 - 00000000 ____D C:\FRST
2013-07-03 20:12 - 2013-07-03 20:12 - 00000000 ____D C:\Users\Gast\Documents\ZPS13
2013-07-03 20:08 - 2013-07-03 20:09 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Zoner
2013-07-03 20:08 - 2013-07-03 20:08 - 00000000 ____D C:\Users\Gast\AppData\Local\Zoner
2013-07-03 19:32 - 2013-07-03 19:32 - 00000439 ____A C:\Users\Gast\AppData\Roaminguser_gensett.xml
2013-07-02 18:05 - 2013-07-02 18:05 - 00347424 ____A (Microsoft Corporation) C:\Users\Stefan Hambach\Downloads\MicrosoftFixit.IEPerformance.MATSKB.Run.exe
2013-07-02 17:34 - 2013-07-03 19:28 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-07-01 20:59 - 2013-07-01 20:59 - 00000000 ____D C:\Users\Gast\AppData\Local\Macromedia
2013-07-01 19:44 - 2013-07-01 19:46 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Games
2013-07-01 19:36 - 2013-07-01 19:36 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-07-01 17:21 - 2013-07-05 19:39 - 00001904 ____A C:\Windows\setupact.log
2013-07-01 17:21 - 2013-07-01 17:21 - 00000000 ____A C:\Windows\setuperr.log
2013-06-14 23:33 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 23:33 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 23:33 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 23:33 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 23:33 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-14 23:33 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-14 23:33 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-14 23:33 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-14 23:32 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 23:32 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 23:32 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-14 23:32 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 05:48 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 05:48 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 05:48 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 05:48 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 05:48 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 05:48 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 05:48 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 05:39 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 05:39 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 05:39 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 05:39 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 05:39 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 05:39 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 05:39 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 05:39 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 05:39 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 05:39 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 05:39 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 05:39 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 05:39 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 05:39 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 05:39 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 05:39 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 05:39 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 05:39 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 05:39 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll

==================== One Month Modified Files and Folders =======

2013-07-05 20:10 - 2013-07-05 20:10 - 01934636 ____A (Farbar) C:\Users\Stefan Hambach\Desktop\FRST64.exe
2013-07-05 20:02 - 2013-07-05 20:02 - 00029474 ____A C:\Users\Stefan Hambach\Desktop\JRT.txt
2013-07-05 19:58 - 2012-06-27 17:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-05 19:54 - 2011-04-21 22:52 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-05 19:52 - 2013-07-05 19:52 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Stefan Hambach\Desktop\JRT.exe
2013-07-05 19:52 - 2013-07-05 19:52 - 00000000 ____D C:\Windows\ERUNT
2013-07-05 19:52 - 2013-07-05 19:52 - 00000000 ____D C:\JRT
2013-07-05 19:47 - 2009-07-14 06:45 - 00009888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-05 19:47 - 2009-07-14 06:45 - 00009888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-05 19:40 - 2013-07-05 19:40 - 00005279 ____A C:\Users\Stefan Hambach\Desktop\AdwCleaner[S1].txt
2013-07-05 19:39 - 2013-07-05 19:39 - 00000452 ____A C:\Windows\PFRO.log
2013-07-05 19:39 - 2013-07-01 17:21 - 00001904 ____A C:\Windows\setupact.log
2013-07-05 19:39 - 2011-04-22 13:13 - 00000376 ____A C:\Users\Stefan Hambach\AppData\Roamingprivacy.xml
2013-07-05 19:39 - 2011-04-21 22:52 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-05 19:39 - 2010-12-27 21:38 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-05 19:39 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-05 19:38 - 2013-07-05 19:37 - 00005279 ____A C:\AdwCleaner[S1].txt
2013-07-05 19:38 - 2011-11-20 12:35 - 02011848 ____A C:\Windows\WindowsUpdate.log
2013-07-05 19:36 - 2013-07-05 19:36 - 00650027 ____A C:\Users\Stefan Hambach\Desktop\adwcleaner.exe
2013-07-05 09:54 - 2013-04-19 20:28 - 00000000 ____D C:\Users\Stefan Hambach\AppData\Roaming\Skype
2013-07-05 08:41 - 2012-03-20 23:53 - 00000964 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001UA.job
2013-07-04 20:41 - 2012-03-20 23:53 - 00000942 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001Core.job
2013-07-04 18:59 - 2011-06-08 16:08 - 00000376 ____A C:\Users\Gast\AppData\Roamingprivacy.xml
2013-07-04 16:57 - 2012-07-08 18:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-04 16:48 - 2013-05-25 07:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-04 16:07 - 2013-07-04 16:07 - 00000000 ____D C:\FRST
2013-07-04 05:52 - 2010-05-12 10:18 - 00654852 ____A C:\Windows\System32\perfh007.dat
2013-07-04 05:52 - 2010-05-12 10:18 - 00130434 ____A C:\Windows\System32\perfc007.dat
2013-07-04 05:52 - 2009-07-14 07:13 - 01500294 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-03 21:38 - 2011-06-08 16:08 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-03 20:14 - 2012-02-18 01:22 - 00000056 ____A C:\Windows\System32\bdsandbox.txt
2013-07-03 20:12 - 2013-07-03 20:12 - 00000000 ____D C:\Users\Gast\Documents\ZPS13
2013-07-03 20:09 - 2013-07-03 20:08 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Zoner
2013-07-03 20:08 - 2013-07-03 20:08 - 00000000 ____D C:\Users\Gast\AppData\Local\Zoner
2013-07-03 19:32 - 2013-07-03 19:32 - 00000439 ____A C:\Users\Gast\AppData\Roaminguser_gensett.xml
2013-07-03 19:28 - 2013-07-02 17:34 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-07-02 18:05 - 2013-07-02 18:05 - 00347424 ____A (Microsoft Corporation) C:\Users\Stefan Hambach\Downloads\MicrosoftFixit.IEPerformance.MATSKB.Run.exe
2013-07-02 05:25 - 2012-11-07 12:11 - 00000000 ____D C:\Users\Gast\AppData\Local\Google
2013-07-01 20:59 - 2013-07-01 20:59 - 00000000 ____D C:\Users\Gast\AppData\Local\Macromedia
2013-07-01 19:46 - 2013-07-01 19:44 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Games
2013-07-01 19:36 - 2013-07-01 19:36 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-07-01 18:30 - 2013-05-14 19:03 - 00000000 ____D C:\Users\Stefan Hambach\Downloads\Neuer Ordner
2013-07-01 17:21 - 2013-07-01 17:21 - 00000000 ____A C:\Windows\setuperr.log
2013-06-30 19:38 - 2011-04-23 12:24 - 00000000 ____D C:\Users\Stefan Hambach\Tracing
2013-06-22 11:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-21 11:56 - 2011-04-21 22:53 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-06-17 18:38 - 2013-04-19 20:28 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-17 18:38 - 2013-04-19 20:28 - 00000000 ____D C:\ProgramData\Skype
2013-06-15 12:40 - 2011-04-21 22:54 - 00000000 ____D C:\users\Stefan Hambach
2013-06-12 18:58 - 2012-06-27 17:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 18:58 - 2012-06-27 17:36 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-12 05:48 - 2010-12-27 22:40 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-08 16:08 - 2013-06-14 23:33 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-14 23:32 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-14 23:33 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-14 23:33 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 16:06 - 2013-06-14 23:32 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 14:28 - 2013-06-14 23:33 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-14 23:33 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-14 23:33 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-14 23:33 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:40 - 2013-06-14 23:32 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-14 23:32 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:13 - 2013-06-14 23:33 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-29 09:23

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-07-2013
Ran by Stefan Hambach at 2013-07-05 20:13:48
Running from C:\Users\Stefan Hambach\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe AIR (x32 Version: 2.0.3.13070)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.5.635)
Alcor Micro USB Card Reader (x32 Version: 1.4.1217.35202)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.26)
Bitdefender Total Security 2012 (Version: 15.0.36)
Bonjour (Version: 3.0.0.10)
CANON iMAGE GATEWAY MyCamera Download Plugin (x32 Version: 3.1.1.2)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (x32 Version: 1.9.0.9)
Canon MOV Decoder (x32 Version: 1.8.0.7)
Canon MOV Encoder (x32 Version: 1.6.0.1)
Canon MovieEdit Task for ZoomBrowser EX (x32 Version: 3.7.0.4)
Canon Utilities Digital Photo Professional 3.10 (x32 Version: 3.10.0.0)
Canon Utilities EOS Sample Music (x32 Version: 1.0.0.204)
Canon Utilities EOS Utility (x32 Version: 2.10.0.0)
Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX (x32 Version: 1.0.0.10)
Canon Utilities Movie Uploader for YouTube (x32 Version: 1.2.0.7)
Canon Utilities PhotoStitch (x32 Version: 3.1.22.46)
Canon Utilities Picture Style Editor (x32 Version: 1.9.0.0)
Canon Utilities ZoomBrowser EX (x32 Version: 6.7.0.24)
Canon ZoomBrowser EX Memory Card Utility (x32 Version: 1.5.0.9)
CCleaner (Version: 3.10)
Cisco EAP-FAST Module (x32 Version: 2.2.14)
Cisco LEAP Module (x32 Version: 1.0.19)
Cisco PEAP Module (x32 Version: 1.1.6)
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2)
CyberLink LabelPrint (x32 Version: 2.5.2602)
CyberLink Power2Go (x32 Version: 6.1.3602c)
CyberLink PowerDVD Copy (x32 Version: 1.5.1306)
CyberLink PowerProducer (x32 Version: 5.0.2.2326)
CyberLink YouCam (x32 Version: 3.0.2626)
D3DX10 (x32 Version: 15.4.2368.0902)
Diablo II (x32)
Diablo III (x32 Version: 1.0.8.16603)
EdenCity Download (x32 Version: 12.0)
Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsluge polaczen zdalnych (x32 Version: 15.4.5722.2)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii uslugi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Google Chrome (x32 Version: 27.0.1453.116)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358)
Google Update Helper (x32 Version: 1.3.21.145)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2119)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Internet Explorer (Enable DEP)
iTunes (Version: 11.0.3.42)
Java(TM) 6 Update 23 (64-bit) (Version: 6.0.230)
Java(TM) 6 Update 39 (x32 Version: 6.0.390)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2)
Medion Home Cinema (x32 Version: 8.0.1505)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Corporation (Version: 9.1.0.0)
Microsoft Corporation (x32 Version: 9.1.0.0)
Microsoft LifeCam (Version: 3.22.270.0)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.4763.1000)
Microsoft PowerPoint Viewer (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MyFreeCodec (HKCU)
NVIDIA Display Control Panel (Version: 6.14.12.5957)
NVIDIA Drivers (Version: 1.10.62.40)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.5957)
NVIDIA Updatus (x32 Version: 1.0.3)
PHotkey (x32 Version: 1.00.0017)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Poczta uslugi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
QuickTime (x32 Version: 7.74.80.86)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6136)
REALTEK Wireless LAN Driver (x32 Version: 1.00.0148)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0)
S?????? f?t???af??? t?? Windows Live (x32 Version: 15.4.3502.0922)
Samsung Kies (x32 Version: 2.3.2.12054_19)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.18.0)
Skype™ 6.5 (x32 Version: 6.5.158)
St???e?? e?????? ActiveX t?? Windows Live Mesh ??a ap?µa???sµ??e? s??d?se?? (x32 Version: 15.4.5722.2)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 15.0.4.0)
TomTom HOME 2.8.3.2499 (x32 Version: 2.8.3.2499)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Uzak Baglantilar Için Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2)
VLC media player 2.0.6 (x32 Version: 2.0.6)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotograf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-vezérlo távoli kapcsolatokhoz (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Zoner Photo Studio 12 (x32 Version: 12.0.1.7)
Zoner Photo Studio 13 (Version: 13.0.1.7)
Zylom Games Player Plugin (x32)

==================== Restore Points  =========================

14-06-2013 21:32:18 Windows Update
18-06-2013 10:43:57 Windows Update
21-06-2013 12:17:01 Windows Update
23-06-2013 09:45:35 Windows Update
28-06-2013 18:16:47 Windows Update
03-07-2013 17:36:43 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1C16B3B9-AFAC-4961-9E43-57C21A0FA40B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-04-21] (Google Inc.)
Task: {265C1A1D-EE79-40BC-8323-6B67DD6EBFAB} - System32\Tasks\Microsoft\Windows Defender\MpIdleTask => C:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {2DD88492-4EA4-46C9-A3D0-8980C491DC9D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: {494C3A5E-BAAC-4090-BD6C-C14FAE9D5C77} - System32\Tasks\{5A393CA7-2842-4D21-BC62-12AA2546001F} => C:\program files (x86)\mozilla firefox\firefox.exe [2013-07-04] (Mozilla Corporation)
Task: {4B7F4E46-EA20-4606-8F4A-006E031DF114} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {54E0A0CA-C483-4433-B1B8-5A0F4BFFC99B} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001UA => C:\Users\Stefan Hambach\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-03-25] (Facebook Inc.)
Task: {5741D9AF-7B81-4EF6-8E5D-02657B654FA6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-04-21] (Google Inc.)
Task: {642AAC71-DF06-48D8-9A1F-340E8A238D3E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001Core => C:\Users\Stefan Hambach\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-03-25] (Facebook Inc.)
Task: {8B0460DD-FBB6-4925-AE38-CA3FF1DFB773} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => C:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {8C87EA5F-6829-4C7A-A67A-047FFBE6E7D3} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {DB36D9B3-AAB9-4360-8784-5231DC385E98} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe No File
Task: {FC7FB5BD-B112-4DC5-8817-75746366F2C8} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001Core.job => C:\Users\Stefan Hambach\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1129976758-2739971074-186298042-1001UA.job => C:\Users\Stefan Hambach\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/05/2013 08:13:11 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x9c0
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:13:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0xd30
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:13:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x9c8
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:12:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x153c
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:12:53 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x13c4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:08:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x1680
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:08:44 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x5c4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:08:43 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x16b8
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:08:42 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc000041d
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x14ec
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (07/05/2013 08:08:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: nvdxgiwrap.dll, Version: 8.17.12.5957, Zeitstempel: 0x4c7f2446
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000261a
ID des fehlerhaften Prozesses: 0x14ec
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (07/05/2013 08:13:11 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261a9c001ce79ab4f3384a4C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dll8d0d49a9-e59e-11e2-b983-e0699514c55b

Error: (07/05/2013 08:13:06 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261ad3001ce79ab4c13b648C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dll89eb19ed-e59e-11e2-b983-e0699514c55b

Error: (07/05/2013 08:13:02 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261a9c801ce79ab49eb7708C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dll87bbb68c-e59e-11e2-b983-e0699514c55b

Error: (07/05/2013 08:12:57 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261a153c01ce79ab465bc7ffC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dll84867bce-e59e-11e2-b983-e0699514c55b

Error: (07/05/2013 08:12:53 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261a13c401ce79ab4406278aC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dll826076de-e59e-11e2-b983-e0699514c55b

Error: (07/05/2013 08:08:55 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261a168001ce79aab66f5f13C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dllf446c2b8-e59d-11e2-b983-e0699514c55b

Error: (07/05/2013 08:08:44 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261a5c401ce79aab00c0db7C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dllede3715c-e59d-11e2-b983-e0699514c55b

Error: (07/05/2013 08:08:43 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261a16b801ce79aaaf19415bC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dllecee43a0-e59d-11e2-b983-e0699514c55b

Error: (07/05/2013 08:08:42 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c000041d0000261a14ec01ce79aaad208e03C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dllec3e1dcb-e59d-11e2-b983-e0699514c55b

Error: (07/05/2013 08:08:40 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE10.0.9200.166115191e7aanvdxgiwrap.dll8.17.12.59574c7f2446c00000050000261a14ec01ce79aaad208e03C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Program Files (x86)\NVIDIA Corporation\CoProcManager\nvdxgiwrap.dlleb6f0614-e59d-11e2-b983-e0699514c55b


CodeIntegrity Errors:
===================================
  Date: 2013-07-05 20:02:50.081
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 19:45:17.304
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 19:39:36.960
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 19:20:28.155
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 11:25:16.889
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 09:53:01.015
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 08:24:21.043
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 08:12:59.922
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 07:16:09.662
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-05 07:06:39.109
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\Bitdefender 2012\Active Virus Control\Avc3_00196_070\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 3893.07 MB
Available physical RAM: 2185.66 MB
Total Pagefile: 7784.32 MB
Available Pagefile: 5761.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:256.99 GB) (Free:109.25 GB) NTFS (Disk=0 Partition=2)
Drive d: (Recover) (Fixed) (Total:40 GB) (Free:20.94 GB) NTFS (Disk=0 Partition=3)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 29DD2CD8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=257 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================
         

Jetzt geht der Internetexplorer nicht mehr

Setze folgendermassen den Internet Explorer zurück:

• Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
• Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
• Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.

(Hier findest du die bebilderte Anleitung.)


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST Log bitte. Noch Probleme?

Anti-Virus-Programm und Firewall deaktivieren

Windows Firewall ist immer ausgeschaltet, da Bitdefender installiert ist. Aber ich muss zu meiner Schande gestehen, dass ich nicht weiß wie ich Bitdefender ausschalte...

OK HABS GEFUNDEN, wie man die FIREWALL bei BITDEFENDER AUSSCHALTET!!!

Hehe alles klar

ESET bleibt bei 2% stehen. Hat einen Trojaner gefunden und macht weiter nichts.

Soll ich noch ESET mal neu installieren?

Wie lange scannt er denn schon? Der Scan kann gerne mal mehrere Stunden dauern.