adwcleaner-log:

# AdwCleaner v3.000 - Report created 20/08/2013 at 17:13:59
# Updated 20/08/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : C. Bannuscher - COMPUTEROBEN
# Running from : C:\Users\C. Bannuscher\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : APNMCP

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\APN
Folder Deleted : C:\ProgramData\AskPartnerNetwork
Folder Deleted : C:\Program Files\AskPartnerNetwork
Folder Deleted : C:\Users\CFF05~1.BAN\AppData\Local\Temp\APN

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Key Deleted : HKCU\Software\AskPartnerNetwork
Key Deleted : HKLM\Software\AskPartnerNetwork

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16502


-\\ Mozilla Firefox v

*************************

AdwCleaner[R0].txt - [1067 octets] - [20/08/2013 17:11:53]
AdwCleaner[S0].txt - [1014 octets] - [20/08/2013 17:13:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1074 octets] ##########
         

jrt-log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.1 (08.19.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by C. Bannuscher on 20.08.2013 at 17:19:46,22
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.08.2013 at 17:21:19,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

frst-log

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-08-2013 03
Ran by C. Bannuscher (administrator) on 20-08-2013 17:32:20
Running from C:\Users\C. Bannuscher\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(BUFFALO INC.) C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
() C:\Windows\system32\PSIService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
() C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe
(X10) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
() C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe
(CyberLink Corp.) C:\Program Files\HomeCinema\TV Enhance\TVEService.exe
(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
(BUFFALO INC.) C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
(Avira Operations GmbH & Co. KG) C:\program files\avira\antivir desktop\avcenter.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [TVEService] - C:\Program Files\HomeCinema\TV Enhance\TVEService.exe [155648 2007-10-19] (CyberLink Corp.)
HKLM\...\Run: [QuickFinder Scheduler] - C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE [83568 2007-01-02] (Corel Corporation)
HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [220160 2008-07-11] (Google)
HKLM\...\Run: [toolbar_eula_launcher] - C:\Program Files\GoogleEULA\EULALauncher.exe [16896 2007-02-09] ( )
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [5369856 2008-03-26] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [13543968 2008-06-09] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] - C:\Windows\system32\NvMcTray.dll [92704 2008-06-09] (NVIDIA Corporation)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2010-08-10] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253672 2011-01-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-20] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-05-02] (Google Inc.)
HKCU\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [202024 2007-10-15] (Nero AG)
HKCU\...\Winlogon: [Shell] explorer.exe <==== ATTENTION 
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ClientManagerV.lnk
ShortcutTarget: ClientManagerV.lnk -> C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe (BUFFALO INC.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
Handler: msdaipp - No CLSID Value - 
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 33 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\npctrl.1.0.30401.0.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-20] (Avira Operations GmbH & Co. KG)
S3 GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe [69120 2008-07-11] (Google)
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [174656 2006-11-02] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [262247 2007-10-19] ()
R2 TVECapSvc; C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe [290909 2007-10-19] ()
R2 TVESched; C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe [114779 2007-10-19] ()
R2 x10nets; C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [20480 2001-11-12] (X10)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-20] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 MTOnlPktAlyX; C:\PROGRA~1\T-ONLI~1\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [17536 2006-10-09] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 PhilCap; C:\Windows\System32\DRIVERS\PhilCap.sys [908832 2007-07-30] (NXP Semiconductors Germany GmbH)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-20] (Avira GmbH)
R3 WLIU2KG125S; C:\Windows\System32\DRIVERS\usb8023.sys [15872 2013-02-12] (Microsoft Corporation)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13976 2006-11-17] (X10 Wireless Technology, Inc.)
S3 catchme; \??\C:\Users\CFF05~1.BAN\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-20 17:21 - 2013-08-20 17:21 - 00000642 _____ C:\Users\C. Bannuscher\Desktop\JRT.txt
2013-08-20 17:19 - 2013-08-20 17:19 - 01018949 _____ (Thisisu) C:\Users\C. Bannuscher\Desktop\JRT.exe
2013-08-20 17:19 - 2013-08-20 17:19 - 00000000 ____D C:\Windows\ERUNT
2013-08-20 17:10 - 2013-08-20 17:14 - 00000000 ____D C:\AdwCleaner
2013-08-20 17:10 - 2013-08-20 17:10 - 00975858 _____ C:\Users\C. Bannuscher\Desktop\adwcleaner.exe
2013-08-20 16:49 - 2013-08-20 16:51 - 00000000 ____D C:\Windows\system32\MRT
2013-08-20 16:45 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-20 16:45 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-20 16:45 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-20 16:45 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-20 16:45 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-20 16:45 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-20 16:45 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-20 16:45 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-20 16:45 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-20 16:45 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-20 16:45 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-20 16:45 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-20 16:45 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-20 16:45 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-20 16:45 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-20 16:45 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-20 16:39 - 2013-08-20 16:39 - 00009618 _____ C:\ComboFix.txt
2013-08-20 16:26 - 2013-08-20 16:39 - 00000000 ____D C:\Qoobox
2013-08-20 16:26 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-20 16:26 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-20 16:26 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-20 16:26 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-20 16:26 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-20 16:26 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-20 16:26 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-20 16:26 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-20 16:25 - 2013-08-20 16:37 - 00000000 ____D C:\Windows\erdnt
2013-08-20 16:21 - 2013-08-20 16:21 - 05106564 ____R (Swearware) C:\Users\C. Bannuscher\Desktop\ComboFix.exe
2013-08-20 15:49 - 2013-08-20 15:51 - 00017358 _____ C:\Users\C. Bannuscher\Downloads\FRST.txt
2013-08-20 15:47 - 2013-08-20 15:49 - 00016160 _____ C:\Users\C. Bannuscher\Downloads\Addition.txt
2013-08-20 15:46 - 2013-08-20 15:46 - 00000000 ____D C:\FRST
2013-08-20 15:45 - 2013-08-20 15:45 - 01070241 _____ (Farbar) C:\Users\C. Bannuscher\Downloads\FRST.exe
2013-08-20 14:10 - 2013-08-20 14:10 - 00000000 ____D C:\Users\C. Bannuscher\AppData\Roaming\Avira
2013-08-20 14:09 - 2013-08-20 14:09 - 00000000 ____D C:\Users\C. Bannuscher\AppData\Roaming\Mozilla
2013-08-20 14:08 - 2013-08-20 14:08 - 00001851 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-20 14:08 - 2013-08-20 14:08 - 00000000 ____D C:\ProgramData\Avira
2013-08-20 14:08 - 2013-08-20 14:08 - 00000000 ____D C:\Program Files\Avira
2013-08-20 14:08 - 2013-08-20 14:02 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 14:08 - 2013-08-20 14:02 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-20 14:08 - 2013-08-20 14:02 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-20 14:08 - 2013-08-20 14:02 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-08-20 13:08 - 2013-08-20 13:08 - 00000000 ____D C:\Users\C. Bannuscher\AppData\Roaming\Malwarebytes
2013-08-20 13:08 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-20 13:08 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-20 13:08 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-20 13:08 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-20 13:08 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-20 13:08 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-20 13:08 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-20 13:07 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-20 13:07 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-20 13:07 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-20 13:07 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-20 13:07 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-20 13:05 - 2013-08-20 13:05 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-20 13:05 - 2013-08-20 13:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-20 13:05 - 2013-08-20 13:05 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-20 13:05 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-20 13:04 - 2013-08-20 13:04 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\C. Bannuscher\Desktop\mbam-setup-1.75.0.1300.exe

==================== One Month Modified Files and Folders =======

2013-08-20 17:31 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-08-20 17:29 - 2010-03-03 13:24 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-20 17:29 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-20 17:24 - 2013-08-20 17:23 - 01070241 _____ (Farbar) C:\Users\C. Bannuscher\Desktop\FRST.exe
2013-08-20 17:21 - 2013-08-20 17:21 - 00000642 _____ C:\Users\C. Bannuscher\Desktop\JRT.txt
2013-08-20 17:21 - 2008-01-21 09:16 - 01568464 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-20 17:19 - 2013-08-20 17:19 - 01018949 _____ (Thisisu) C:\Users\C. Bannuscher\Desktop\JRT.exe
2013-08-20 17:19 - 2013-08-20 17:19 - 00000000 ____D C:\Windows\ERUNT
2013-08-20 17:19 - 2008-08-14 12:25 - 02046779 _____ C:\Windows\WindowsUpdate.log
2013-08-20 17:16 - 2010-03-03 13:24 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-20 17:15 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-20 17:15 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-20 17:15 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-20 17:14 - 2013-08-20 17:10 - 00000000 ____D C:\AdwCleaner
2013-08-20 17:14 - 2006-11-02 15:01 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-20 17:10 - 2013-08-20 17:10 - 00975858 _____ C:\Users\C. Bannuscher\Desktop\adwcleaner.exe
2013-08-20 17:03 - 2008-01-21 04:47 - 00140060 _____ C:\Windows\PFRO.log
2013-08-20 17:03 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-20 16:51 - 2013-08-20 16:49 - 00000000 ____D C:\Windows\system32\MRT
2013-08-20 16:51 - 2012-12-06 16:29 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-20 16:49 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-20 16:39 - 2013-08-20 16:39 - 00009618 _____ C:\ComboFix.txt
2013-08-20 16:39 - 2013-08-20 16:26 - 00000000 ____D C:\Qoobox
2013-08-20 16:39 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2013-08-20 16:39 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-08-20 16:37 - 2013-08-20 16:25 - 00000000 ____D C:\Windows\erdnt
2013-08-20 16:34 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-08-20 16:33 - 2008-08-14 12:39 - 00000000 ____D C:\Users\C. Bannuscher
2013-08-20 16:21 - 2013-08-20 16:21 - 05106564 ____R (Swearware) C:\Users\C. Bannuscher\Desktop\ComboFix.exe
2013-08-20 15:51 - 2013-08-20 15:49 - 00017358 _____ C:\Users\C. Bannuscher\Downloads\FRST.txt
2013-08-20 15:49 - 2013-08-20 15:47 - 00016160 _____ C:\Users\C. Bannuscher\Downloads\Addition.txt
2013-08-20 15:46 - 2013-08-20 15:46 - 00000000 ____D C:\FRST
2013-08-20 15:45 - 2013-08-20 15:45 - 01070241 _____ (Farbar) C:\Users\C. Bannuscher\Downloads\FRST.exe
2013-08-20 14:10 - 2013-08-20 14:10 - 00000000 ____D C:\Users\C. Bannuscher\AppData\Roaming\Avira
2013-08-20 14:09 - 2013-08-20 14:09 - 00000000 ____D C:\Users\C. Bannuscher\AppData\Roaming\Mozilla
2013-08-20 14:08 - 2013-08-20 14:08 - 00001851 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-20 14:08 - 2013-08-20 14:08 - 00000000 ____D C:\ProgramData\Avira
2013-08-20 14:08 - 2013-08-20 14:08 - 00000000 ____D C:\Program Files\Avira
2013-08-20 14:02 - 2013-08-20 14:08 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 14:02 - 2013-08-20 14:08 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-20 14:02 - 2013-08-20 14:08 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-20 14:02 - 2013-08-20 14:08 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-08-20 13:08 - 2013-08-20 13:08 - 00000000 ____D C:\Users\C. Bannuscher\AppData\Roaming\Malwarebytes
2013-08-20 13:05 - 2013-08-20 13:05 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-20 13:05 - 2013-08-20 13:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-20 13:05 - 2013-08-20 13:05 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-20 13:04 - 2013-08-20 13:04 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\C. Bannuscher\Desktop\mbam-setup-1.75.0.1300.exe
2013-07-25 04:40 - 2013-08-20 16:45 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-25 04:32 - 2013-08-20 16:45 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-25 04:30 - 2013-08-20 16:45 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-25 04:26 - 2013-08-20 16:45 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-25 04:26 - 2013-08-20 16:45 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-25 04:25 - 2013-08-20 16:45 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-25 04:24 - 2013-08-20 16:45 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-25 04:24 - 2013-08-20 16:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-25 04:23 - 2013-08-20 16:45 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-25 04:23 - 2013-08-20 16:45 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-25 04:23 - 2013-08-20 16:45 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-25 04:23 - 2013-08-20 16:45 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-25 04:23 - 2013-08-20 16:45 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-25 04:22 - 2013-08-20 16:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-25 04:22 - 2013-08-20 16:45 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-25 04:22 - 2013-08-20 16:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-20 17:20

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

addition log:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-08-2013 03
Ran by C. Bannuscher at 2013-08-20 17:32:31
Running from C:\Users\C. Bannuscher\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) (Version: 8.1.2)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.224)
Adobe Reader 8.1.2 - Deutsch (Version: 8.1.2)
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Apple Application Support (Version: 1.3.1)
Apple Software Update (Version: 2.1.3.127)
Avira Free Antivirus (Version: 13.0.0.3885)
Avira SearchFree Toolbar plus Web Protection (Version: 12.2.2.663)
Brockhaus multimedial 2008 (Version: 10.00.0000)
BUFFALO Client Manager V
Canon iP4300
Corel MediaOne (Version: 2.00.0000)
DHTML Editing Component (Version: 6.02.0001)
Full Tilt Poker (Version: 4.32.2.WIN.FullTilt.COM)
Google Desktop (Version: -)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4209.2358)
Google Update Helper (Version: 1.3.21.153)
Java Auto Updater (Version: 2.0.4.1)
Java(TM) 6 Update 25 (Version: 6.0.250)
MakeDisc (Version: 3.0.2601)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
MCE Software Encoder 1.1 (Version: 1.1.0.1918)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 German Language Pack (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office Professional Edition 2003 (Version: 11.0.5614.0)
Microsoft Silverlight (Version: 1.0.30401.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual J# .NET Redistributable Package 1.1 (Version: 1.1.4322)
MindManager 2002 (Version: 4.5.621)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Nero 8 Essentials (Version: 8.10.284)
neroxml (Version: 1.0.0)
NVIDIA Drivers
PokerStars
PowerDVD (Version: 7.0.3118.0)
PowerProducer (Version: 4.2.2504)
QuickTime (Version: 7.67.75.0)
Realtek High Definition Audio Driver (Version: 6.0.1.5591)
T-Online 6.0
T-Online WLAN-Access Finder
TV Enhance (Version: 1.0.4930)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
VCRedistSetup (Version: 1.0.0)
VLC media player 1.1.4 (Version: 1.1.4)
WinRAR archiver
WordPerfect Office X3
WordPerfect Office X3 (Version: 13.3)
X10 Hardware(TM)
 

==================== Restore Points  =========================

15-08-2011 10:34:03 Windows Update
15-08-2011 20:02:13 Windows Update
16-08-2011 09:21:08 Windows Update
23-08-2011 08:50:39 Windows Update
23-08-2011 13:54:05 Windows Update
05-09-2011 14:47:37 Windows Update
05-09-2011 15:35:10 Installed Java(TM) 6 Update 25
06-09-2011 08:58:53 Windows Update
06-09-2011 11:18:46 Windows Update
17-10-2011 09:31:31 Windows Update
25-10-2011 08:19:30 Windows Update
25-10-2011 13:52:00 Windows Update
25-10-2011 14:32:45 Windows Update
09-12-2011 16:55:09 Windows Update
23-12-2011 10:08:52 Windows Update
23-12-2011 10:47:50 Windows Update
01-02-2012 09:43:05 Windows Update
01-02-2012 10:34:17 Windows Update
28-03-2012 11:58:51 Windows Update
28-03-2012 13:33:30 Windows Update
28-03-2012 18:15:57 Windows Update
29-03-2012 12:45:28 Geplanter Prüfpunkt
30-03-2012 00:38:30 Windows Update
30-03-2012 09:09:07 Windows Update
09-04-2012 13:28:28 Windows Update
09-07-2012 10:20:27 Windows Update
09-07-2012 10:37:21 Windows Update
09-07-2012 10:47:38 Windows Update
09-07-2012 11:50:33 Windows Update
10-07-2012 11:51:51 Windows Update
16-07-2012 08:03:02 Windows Update
16-07-2012 13:06:19 Windows Update
06-12-2012 12:57:17 Windows Update
06-12-2012 13:34:25 Windows Update
03-01-2013 18:33:53 Windows Update
03-04-2013 12:35:21 Windows Update
03-04-2013 16:44:34 Windows Update
11-06-2013 11:41:40 Windows Update
11-06-2013 23:23:42 Windows Update
12-06-2013 07:46:42 Windows Update
16-07-2013 09:43:10 Windows Update
16-07-2013 17:11:03 Windows Update
20-08-2013 11:05:52 Windows Update
20-08-2013 14:42:45 Windows Update

==================== Hosts content: ==========================

2006-11-02 12:23 - 2013-08-20 16:34 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {023ADC71-A50A-472C-97BC-454C4F87666F} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: {1898F086-7018-4393-A9DB-0142139B7A91} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2284BF41-5532-48AF-BD5B-82A116FBBC8E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-03] (Google Inc.)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {4A691C68-BFB8-42A0-8A82-5486D255E751} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-16] (Adobe Systems Incorporated)
Task: {5017B409-AAC7-418F-B4F3-19232D476BA8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-03] (Google Inc.)
Task: {5B7AA008-939B-42F5-8299-8CCBE8091CA1} - System32\Tasks\User_Feed_Synchronization-{1F0EFEEC-AE92-49F7-B0E8-1567481591A6} => C:\Windows\system32\msfeedssync.exe [2012-03-30] (Microsoft Corporation)
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)
Task: {ABCC30A5-0000-477E-AC34-73F4A8C8CF28} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-12] (Microsoft Corporation)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2011-06-08 16:18:16.262
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-08 16:18:16.169
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-08 16:18:16.060
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-08 16:18:15.950
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-08 16:18:15.826
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 39%
Total physical RAM: 3070.58 MB
Available physical RAM: 1842.41 MB
Total Pagefile: 6360.16 MB
Available Pagefile: 4962.8 MB
Total Virtual: 2047.88 MB
Available Virtual: 1943.89 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:576.15 GB) (Free:438.68 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:20.01 GB) (Free:11.14 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596 GB) (Disk ID: 2BAB359D)
Partition 1: (Active) - (Size=576 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=20 GB) - (Type=OF Extended)

==================== End Of Log ============================
         

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKCU\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 20-08-2013 03
Ran by C. Bannuscher at 2013-08-20 19:24:50 Run:1
Running from C:\Users\C. Bannuscher\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKCU\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
*****************

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon => Key deleted successfully.

==== End of Fixlog ====
         

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

malwarebytes hat nichts gefunden. beim eset scan waren 2 meldungen.

eset-log:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=abc33fe58b32b34b9aa787e4b79fb213
# engine=14842
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-20 06:48:18
# local_time=2013-08-20 08:48:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 95 24010 147699403 16699 0
# compatibility_mode=5892 16776574 100 100 27713 214557226 0 0
# scanned=197953
# found=2
# cleaned=2
# scan_time=3214
sh=BFBDBAC8B854A795DE4FA79DBA076D832853DEC6 ft=0 fh=0000000000000000 vn="JS/TrojanDownloader.Iframe.NKE trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\C. Bannuscher\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7PSQFVXY\cpvload[1].htm"
sh=103D7D42AD7674B8D3E04ED881782D632AD74941 ft=0 fh=0000000000000000 vn="multiple threats (cleaned by deleting - quarantined)" ac=C fn="C:\Users\C. Bannuscher\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\34470696-439d7b19"
         

Logs von Malwarebytes bitte immer posten, egal ob Fund oder kein Fund

Kann es sein, dass du alles sehr wörtlich ohne Kontext nimmst und dann noch polemisch wirst?
Zudem hab ich in meiner ersten AW an dich nicht direkt neue Logs angefordert, sondern schon vorhandene.
Die "neuen" Logs bezogen sich auf den Anfang des Problems. Wenn du ein Problem hast und es Funde gab, macht es natürlich kaum einen Sinn nur neue Logs, womöglich welche ohne Funde zu posten. Jetzt sind wir aber am Ende, ein Kontrollscan. Das hab ich ich auch in meiner letzten Anweisung gepostet, dass es Kontrollscans sind. Ja und da will ich die Logs sehen, weil es noch weitere Infos in einem Log gibt außer Fund oder kein Fund, zB ob die Signaturen gerade aktuell waren zum Zeitpunkt des Scans.

ja is gut....also sind wir am ende oder wat?

Bitte die TMP und Cache Ordner noch leeren mit TFC

TFC - Temp File Cleaner

Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

• Öffne die TFC.exe.
  Vista und Win 7 User mit Rechtsklick "als Administrator starten".
• Schließe alle anderen Programme.
• Drücke auf den Button Start.
• Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.