Über pdf-creator Qvo6 Virus eingefangen :(

Deza

Hallo liebe Hilfewillige,

Habe mir heute den Qvo6 Virus eingefangen. Dann hab ich mich durch eure Anleitung gelesen und gescannt und würde nun hier die Ergebnisse posten mit der Hoffnung, dass mir jemand helfen kann (ich hoffe ich bin hier richtig?)

Da der defogger keine Fehlermeldung produziert hat spare ich mir das Log.

FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2013
Ran by Sven (administrator) on 25-08-2013 16:52:25
Running from C:\Users\Sven\Desktop
Windows 7 Ultimate (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor Corp.) C:\Windows\SOUNDMAN.EXE
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(OpenOffice.org) D:\Programme\OpenOffice\program\soffice.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(OpenOffice.org) D:\Programme\OpenOffice\program\soffice.bin
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(Wsys Co., Ltd.) C:\ProgramData\eSafe\eGdpSvc.exe
(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe
(Microsoft Corporation) C:\Windows\system32\PrintIsolationHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SoundMan] - C:\Windows\SOUNDMAN.EXE [604704 2009-04-14] (Realtek Semiconductor Corp.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2780776 2011-07-19] (CANON INC.)
HKLM-x32\...\Runonce: [Del1476296] - cmd.exe /Q /D /c del "C:\Users\Sven\AppData\Local\Temp\0.del" [x]
HKCU\...\Run: [ImpulseFastStart] - "C:\Program Files (x86)\Stardock\Impulse\Impulse.exe" /fastload [x]
HKCU\...\Run: [Sony PC Companion] - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKCU\...\Runonce: [Del1476296] - cmd.exe /Q /D /c del "C:\Users\Sven\AppData\Local\Temp\0.del" [x]
MountPoints2: {75d5b9d9-8d66-11e2-8af9-00138f9af97a} - I:\Startme.exe
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-26] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1637496 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [468112 2011-07-25] (CANON INC.)
Startup: C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> D:\Programme\OpenOffice\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: LyricXeeker - {81563814-fea0-415e-ba46-5b4735306573} - C:\Program Files (x86)\LyriXeeker\128.dll (LyricXeeker)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\sfch9ejk.default
FF user.js: detected! => C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\sfch9ejk.default\user.js
FF SelectedSearchEngine: qvo6
FF Homepage: hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439064
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - D:\Programme\Picasa\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - D:\Programme\Sony Xperia Z\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - D:\Programme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Sven\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKCU\...\Firefox\Extensions: [lyrix@lyrixeeker.co] C:\Program Files (x86)\LyriXeeker\128.xpi
FF Extension: No Name - C:\Program Files (x86)\LyriXeeker\128.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=SAMSUNGXSP2504C_S09QJ1OL312859&ts=1377439210

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\17.0.963.78\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\17.0.963.78\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Reader Application Detector) - D:\Programme\Reader Sony\npreaderdetectmoz.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (YouTube) - C:\Users\Sven\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0
CHR Extension: (Google Search) - C:\Users\Sven\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Sven\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\Sven\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0
CHR HKLM-x32\...\Chrome\Extension: [epojlgbehpaeekopencdagbdamnkppci] - C:\Program Files (x86)\LyriXeeker\128.crx
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - \User Data\Default\Extensions\newtab.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-26] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-26] (Avira Operations GmbH & Co. KG)
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [424104 2013-08-25] (Taiwan Shui Mu Chih Ching Technology Limited.)
R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [303680 2013-08-22] (Wsys Co., Ltd.)

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC64.SYS [3491616 2009-06-18] (Realtek Semiconductor Corp.)
S3 athrusb; C:\Windows\System32\DRIVERS\athrxusb.sys [1075712 2008-07-29] (Atheros Communications, Inc.)
R3 athrusb6; C:\Windows\System32\DRIVERS\athrxu6.sys [1039360 2007-08-01] (Atheros Communications, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-03] (Avira Operations GmbH & Co. KG)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [27648 2008-01-19] (Microsoft Corporation)
S3 pfc; C:\Windows\SysWow64\drivers\pfc.sys [14604 2003-08-11] (Padus, Inc.)
R3 ULi5261; C:\Windows\System32\DRIVERS\ULILAN64.SYS [34176 2006-06-30] (ULi Electronics Inc.)
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [x]
S3 pfc; system32\drivers\pfc.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-25 16:51 - 2013-08-25 16:51 - 01576506 _____ (Farbar) C:\Users\Sven\Desktop\FRST64.exe
2013-08-25 16:50 - 2013-08-25 16:50 - 00000470 _____ C:\Users\Sven\Desktop\defogger_disable.log
2013-08-25 16:50 - 2013-08-25 16:50 - 00000000 _____ C:\Users\Sven\defogger_reenable
2013-08-25 16:49 - 2013-08-25 16:49 - 00050477 _____ C:\Users\Sven\Desktop\Defogger.exe
2013-08-25 16:02 - 2013-08-25 16:32 - 00000000 ____D C:\Users\Sven\AppData\Local\CUSTPDF Writer
2013-08-25 16:00 - 2013-08-25 16:00 - 00000000 ____D C:\User Data
2013-08-25 15:59 - 2013-08-25 15:59 - 00000000 ____D C:\Users\Sven\AppData\Roaming\WinZipper
2013-08-25 15:59 - 2013-08-25 15:59 - 00000000 ____D C:\Program Files (x86)\WinZipper
2013-08-25 15:58 - 2013-08-25 16:06 - 00000000 ____D C:\ProgramData\eSafe
2013-08-25 15:57 - 2013-08-25 15:58 - 00003218 _____ C:\Windows\System32\Tasks\DSite
2013-08-25 15:57 - 2013-08-25 15:58 - 00000282 _____ C:\Windows\Tasks\DSite.job
2013-08-25 15:57 - 2013-08-25 15:57 - 00003022 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-25 15:57 - 2013-08-25 15:57 - 00000376 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-25 15:57 - 2013-08-25 15:57 - 00000000 ____D C:\Users\Sven\AppData\Roaming\DSite
2013-08-25 15:57 - 2013-08-25 15:57 - 00000000 ____D C:\Program Files\PDFCreator
2013-08-25 15:57 - 2013-08-25 15:57 - 00000000 ____D C:\Program Files (x86)\LyriXeeker
2013-08-25 15:57 - 2013-08-25 15:57 - 00000000 ____D C:\Program Files (x86)\GPLGS
2013-08-25 15:57 - 2011-10-04 22:43 - 00087552 _____ C:\Windows\system32\custmon64i.dll
2013-08-25 14:29 - 2013-04-09 15:13 - 00110264 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2013-08-23 12:13 - 2013-08-23 12:14 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-20 19:36 - 2013-08-20 19:38 - 00000000 ____D C:\Windows\system32\MRT
2013-08-20 15:38 - 2013-08-20 15:38 - 00000610 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-08 10:24 - 2013-08-08 10:24 - 00000678 _____ C:\Users\Sven\Desktop\ELAN 4.6.1.lnk

==================== One Month Modified Files and Folders =======

2013-08-25 16:52 - 2013-08-25 16:52 - 00000000 ____D C:\FRST
2013-08-25 16:51 - 2013-08-25 16:51 - 01576506 _____ (Farbar) C:\Users\Sven\Desktop\FRST64.exe
2013-08-25 16:50 - 2013-08-25 16:50 - 00000470 _____ C:\Users\Sven\Desktop\defogger_disable.log
2013-08-25 16:50 - 2013-08-25 16:50 - 00000000 _____ C:\Users\Sven\defogger_reenable
2013-08-25 16:50 - 2010-12-02 17:38 - 00000000 ____D C:\Users\Sven
2013-08-25 16:49 - 2013-08-25 16:49 - 00050477 _____ C:\Users\Sven\Desktop\Defogger.exe
2013-08-25 16:32 - 2013-08-25 16:02 - 00000000 ____D C:\Users\Sven\AppData\Local\CUSTPDF Writer
2013-08-25 16:31 - 2013-04-03 18:12 - 00000000 ____D C:\Users\Sven\AppData\Roaming\MoviScript Report Generator
2013-08-25 16:08 - 2012-07-07 16:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-25 16:06 - 2013-08-25 15:58 - 00000000 ____D C:\ProgramData\eSafe
2013-08-25 16:00 - 2013-08-25 16:00 - 00000000 ____D C:\User Data
2013-08-25 15:59 - 2013-08-25 15:59 - 00000000 ____D C:\Users\Sven\AppData\Roaming\WinZipper
2013-08-25 15:59 - 2013-08-25 15:59 - 00000000 ____D C:\Program Files (x86)\WinZipper
2013-08-25 15:58 - 2013-08-25 15:57 - 00003218 _____ C:\Windows\System32\Tasks\DSite
2013-08-25 15:58 - 2013-08-25 15:57 - 00000282 _____ C:\Windows\Tasks\DSite.job
2013-08-25 15:58 - 2010-12-06 21:36 - 00001352 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-25 15:58 - 2010-12-02 17:39 - 00001653 _____ C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-25 15:58 - 2010-12-02 17:39 - 00001631 _____ C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-08-25 15:57 - 2013-08-25 15:57 - 00003022 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-25 15:57 - 2013-08-25 15:57 - 00000376 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-25 15:57 - 2013-08-25 15:57 - 00000000 ____D C:\Users\Sven\AppData\Roaming\DSite
2013-08-25 15:57 - 2013-08-25 15:57 - 00000000 ____D C:\Program Files\PDFCreator
2013-08-25 15:57 - 2013-08-25 15:57 - 00000000 ____D C:\Program Files (x86)\LyriXeeker
2013-08-25 15:57 - 2013-08-25 15:57 - 00000000 ____D C:\Program Files (x86)\GPLGS
2013-08-25 15:38 - 2009-07-14 06:45 - 00016848 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-25 15:38 - 2009-07-14 06:45 - 00016848 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-25 15:33 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-25 15:33 - 2009-07-14 06:51 - 00073361 _____ C:\Windows\setupact.log
2013-08-25 15:32 - 2010-12-02 17:35 - 01777752 _____ C:\Windows\WindowsUpdate.log
2013-08-25 14:30 - 2010-12-06 23:25 - 00488546 _____ C:\Windows\PFRO.log
2013-08-25 14:24 - 2010-12-02 18:43 - 00064024 _____ C:\Users\Sven\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-25 14:22 - 2009-07-14 06:45 - 00294168 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-25 14:05 - 2011-10-25 18:59 - 00000000 ____D C:\Users\Sven\AppData\Local\Sony Corporation
2013-08-25 14:03 - 2011-06-27 21:01 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-25 14:02 - 2010-12-02 19:46 - 00000000 ____D C:\Users\Sven\AppData\Roaming\Adobe
2013-08-25 14:02 - 2010-12-02 17:39 - 00000000 ___RD C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-25 12:59 - 2012-07-06 11:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-23 12:14 - 2013-08-23 12:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-23 11:08 - 2012-07-07 16:48 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-23 11:08 - 2012-07-07 16:48 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-23 11:08 - 2011-05-15 09:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-21 12:03 - 2010-12-03 00:11 - 00000000 ____D C:\Users\Sven\AppData\Roaming\vlc
2013-08-21 11:27 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-21 11:10 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-20 19:38 - 2013-08-20 19:36 - 00000000 ____D C:\Windows\system32\MRT
2013-08-20 19:36 - 2010-12-02 19:07 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-20 15:38 - 2013-08-20 15:38 - 00000610 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-13 15:50 - 2010-12-03 00:01 - 00000000 ____D C:\Users\Sven\AppData\Local\Adobe
2013-08-08 10:24 - 2013-08-08 10:24 - 00000678 _____ C:\Users\Sven\Desktop\ELAN 4.6.1.lnk
2013-08-08 09:54 - 2013-01-22 19:03 - 00000000 ____D C:\Users\Sven\AppData\Local\Windows Live
2013-07-30 14:58 - 2013-04-30 16:58 - 00000000 ____D C:\ProgramData\clone.AD
2013-07-30 11:29 - 2011-02-27 16:19 - 00273744 _____ C:\Windows\DPINST.LOG

Files to move or delete:
====================
C:\Users\Sven\AppData\Local\Temp\Quarantine.exe
C:\Users\Sven\AppData\Local\Temp\uninstall.exe
C:\Users\Sven\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\Sven\AppData\Local\Temp\VCB\NewUI.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Setup.exe
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\ZHH\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\TRK\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\THA\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\SVE\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\RUS\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\PTG\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\PLK\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\NOR\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\NLD\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\KOR\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\JPN\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\ITA\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\HUN\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\HEB\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\FRC\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\FRA\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\FIN\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\ESP\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\ESM\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\ENU\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\ENG\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\ELL\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\DEU\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\DAN\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\CSY\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\CHT\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\CHS\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Languages\ARB\VCBResources.dll
C:\Users\Sven\AppData\Local\Temp\VCB\Graphics\NewUI.dll
C:\Users\Sven\AppData\Local\Temp\is357113909\1415902_Setup.EXE
C:\Users\Sven\AppData\Local\Temp\is357113909\Converter.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\cor_ar_201381417179_qvo6.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\CPWriter2.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\custmon32i.dll
C:\Users\Sven\AppData\Local\Temp\is357113909\custmon64i.dll
C:\Users\Sven\AppData\Local\Temp\is357113909\custmoni.dll
C:\Users\Sven\AppData\Local\Temp\is357113909\DeltaTB.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\pdfwriter.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\pdfwriter32.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\pdfwriter64.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\Preferences.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\Setup.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\unInstpw.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\unInstpw64.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\wajam_validate.exe
C:\Users\Sven\AppData\Local\Temp\is357113909\Driver\ICONLIB.DLL
C:\Users\Sven\AppData\Local\Temp\is357113909\Driver\PS5UI.DLL
C:\Users\Sven\AppData\Local\Temp\is357113909\Driver\PSCRIPT5.DLL
C:\Users\Sven\AppData\Local\Temp\is357113909\Driver\PSMON.DLL
C:\Users\Sven\AppData\Local\Temp\is357113909\Driver\X64\PS5UI.DLL
C:\Users\Sven\AppData\Local\Temp\is357113909\Driver\X64\PSCRIPT5.DLL
C:\Users\Sven\AppData\Local\Temp\eIntaller\D528D7CEA1B448838F4492BD9311EC69\eXQ.exe
C:\Users\Sven\AppData\Local\Temp\eIntaller\1544D26920774a889D2052AB3DF9CE2A\eGdpSvc.exe
C:\Users\Sven\AppData\Local\Temp\eIntaller\1544D26920774a889D2052AB3DF9CE2A\eXQ.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-23 11:25

==================== End Of Log ============================

Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2013
Ran by Sven at 2013-08-25 16:53:45
Running from C:\Users\Sven\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================


3Com OfficeConnect Wireless 54Mbps 11g USB Adapter (x32 Version: 4.0.1.0)
Adobe AIR (x32 Version: 3.7.0.2090)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Premiere Pro (x32 Version: 7.0)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Auto Gordian Knot 2.55 (x32 Version: 2.55)
avi.NET 3.5.1.0 (x32)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
AviSynth 2.5 (x32)
Canon Easy-PhotoPrint EX (x32)
Canon Easy-WebPrint EX (x32)
Canon IJ Network Scanner Selector EX (x32)
Canon IJ Network Tool (x32)
Canon Kurzwahlprogramm (x32)
Canon MP Navigator EX 5.1 (x32)
Canon MX710 series Benutzerregistrierung (x32)
Canon MX710 series MP Drivers
Canon MX710 series On-screen Manual (x32)
Canon My Printer (x32)
Canon Solution Menu EX (x32)
CloneDVD2 (x32 Version: 2.9.3.0)
CuPED (x32)
D3DX10 (x32 Version: 15.4.2368.0902)
DivX-Setup (x32 Version: 2.6.1.8)
ELAN 4.6.1 (x32 Version: 4.6.1.0)
Fotogalerie (x32 Version: 16.4.3505.0912)
Freemake Video Converter Version 4.0.1 (x32 Version: 4.0.1)
Google Books Downloader version 2.3 (x32 Version: 2.3)
HD Tune 2.55 (x32)
HPSSupply (x32 Version: 140.0.212.0)
Impulse (x32 Version: 1.0)
Impulse (x32)
LyricXeeker (x32)
Media Go (x32 Version: 2.4.256)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1)
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1)
Movie Maker (x32 Version: 16.4.3505.0912)
MoviScript (x32)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
NVIDIA Display Control Panel (Version: 6.14.12.5896)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Paint.NET v3.5.10 (Version: 3.60.0)
PDF Creator
Photo Gallery (x32 Version: 16.4.3505.0912)
Picasa 3 (x32 Version: 3.9)
PlayStation(R)Store (x32 Version: 4.14.6.15183)
PVSonyDll (Version: 1.00.0001)
Realtek AC'97 Audio (x32)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Shop for HP Supplies (Version: 14.0)
Sony Ericsson Update Engine (x32 Version: 2.13.5.201304180917)
Sony PC Companion 2.10.165 (x32 Version: 2.10.165)
SoulSeek 157 NS 13e (x32)
TES Construction Set (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for PDF Creator (HKCU)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VLC media player 2.0.8 (x32 Version: 2.0.8)
VobSub v2.23 (Remove Only) (x32)
WiMP 2.4.2 (x32 Version: 2.4.2)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
Windows Live Essentials (x32 Version: 16.4.3505.0912)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3505.0912)
Windows Live Photo Common (x32 Version: 16.4.3505.0912)
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
Windows Live SOXE (x32 Version: 16.4.3505.0912)
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
Windows Live UX Platform (x32 Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)
WinZipper (x32 Version: 1.4.8)
XMedia Recode Version 3.1.5.4 (x32 Version: 3.1.5.4)
Xvid 1.1.3 final uninstall (x32 Version: 1.1)
XviD MPEG4 Video Codec (remove only) (x32)
Zip Motion Block Video codec (Remove Only) (x32)
Zulu DJ Software (x32)

==================== Restore Points =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0B254778-0891-4904-9685-E48944F70974} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-23] (Adobe Systems Incorporated)
Task: {366D36E1-491F-494B-A634-697E375FBF9C} - System32\Tasks\LyricXeeker Update => C:\Program Files (x86)\LyriXeeker\LyriXupdate.exe [2013-08-21] ()
Task: {4767DA3C-D350-43E1-B411-E8EFEEC05ADE} - System32\Tasks\DSite => C:\Users\Sven\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE [2013-08-25] ()
Task: {5F971441-3613-47AB-BBF2-7BAA5D389E61} - System32\Tasks\DivX online update program => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2011-07-29] ()
Task: {63B90E8C-B0B1-4E56-BB40-9F32CEF7A6EA} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {C198929B-FE34-4100-9444-71172965EBB7} - System32\Tasks\Adobe online update program => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DSite.job => C:\Users\Sven\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\LyricXeeker Update.job => C:\Program Files (x86)\LyriXeeker\LyriXupdate.exe


==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/25/2013 02:48:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.

Error: (08/25/2013 02:48:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.

Error: (08/25/2013 02:25:28 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.

Error: (08/20/2013 03:35:25 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: CNSEUPDT.EXE, Version: 1.4.0.0, Zeitstempel: 0x4e3a21c1
Name des fehlerhaften Moduls: CNMDWLD.DLL, Version: 1.0.0.0, Zeitstempel: 0x4cad61a4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000024c0
ID des fehlerhaften Prozesses: 0xee8
Startzeit der fehlerhaften Anwendung: 0xCNSEUPDT.EXE0
Pfad der fehlerhaften Anwendung: CNSEUPDT.EXE1
Pfad des fehlerhaften Moduls: CNSEUPDT.EXE2
Berichtskennung: CNSEUPDT.EXE3

Error: (07/11/2013 10:47:48 AM) (Source: Application Hang) (User: )
Description: Programm Explorer.EXE, Version 6.1.7600.16768 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 88c

Startzeit: 01ce7e098cabc2f0

Endzeit: 0

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID:

Error: (06/30/2013 00:28:02 PM) (Source: MsiInstaller) (User: Sven-PC)
Description: Product: WiMP 2.3.9 -- Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.

Error: (06/30/2013 00:22:41 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.

Error: (06/30/2013 00:21:47 PM) (Source: MsiInstaller) (User: Sven-PC)
Description: Product: WiMP 2.3.2 -- Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.

Error: (06/12/2013 11:07:34 AM) (Source: System Restore) (User: )
Description: Der geplante Wiederherstellungspunkt konnte nicht erstellt werden. Zusätzliche Informationen: (0x8004231f).

Error: (06/12/2013 11:07:34 AM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x8004231f).


System errors:
=============
Error: (08/25/2013 03:33:12 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (08/25/2013 02:49:46 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (08/25/2013 02:46:59 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (08/25/2013 02:30:52 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (08/25/2013 02:22:34 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (08/25/2013 00:59:32 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (08/24/2013 00:25:39 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (08/23/2013 11:00:12 AM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (08/23/2013 10:57:16 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1053

Error: (08/23/2013 10:57:16 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053


Microsoft Office Sessions:
=========================
Error: (08/25/2013 02:48:24 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifestD:\$RECYCLE.BIN\S-1-5-21-3882353046-3482010864-680234897-1000\$RQOLOEZ.exe

Error: (08/25/2013 02:48:24 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifestD:\$RECYCLE.BIN\S-1-5-21-3882353046-3482010864-680234897-1000\$RQOLOEZ.exe

Error: (08/25/2013 02:25:28 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifestD:\Downloads\SoftonicDownloader_fuer_virtualdub.exe

Error: (08/20/2013 03:35:25 PM) (Source: Application Error)(User: )
Description: CNSEUPDT.EXE1.4.0.04e3a21c1CNMDWLD.DLL1.0.0.04cad61a4c0000005000024c0ee801ce9daa10f2e3e6C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXEC:\Program Files (x86)\Canon\Solution Menu EX\CNMDWLD.DLL5e4550d1-099d-11e3-9f45-00138f9af97a

Error: (07/11/2013 10:47:48 AM) (Source: Application Hang)(User: )
Description: Explorer.EXE6.1.7600.1676888c01ce7e098cabc2f00C:\Windows\Explorer.EXE

Error: (06/30/2013 00:28:02 PM) (Source: MsiInstaller)(User: Sven-PC)
Description: Product: WiMP 2.3.9 -- Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/30/2013 00:22:41 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifestD:\Downloads\SoftonicDownloader_fuer_virtualdub.exe

Error: (06/30/2013 00:21:47 PM) (Source: MsiInstaller)(User: Sven-PC)
Description: Product: WiMP 2.3.2 -- Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/12/2013 11:07:34 AM) (Source: System Restore)(User: )
Description: 0x8004231f

Error: (06/12/2013 11:07:34 AM) (Source: System Restore)(User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x8004231f


==================== Memory info ===========================

Percentage of memory in use: 52%
Total physical RAM: 2047.3 MB
Available physical RAM: 966.08 MB
Total Pagefile: 4094.61 MB
Available Pagefile: 2581.25 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:29.2 GB) (Free:0.68 GB) NTFS
Drive d: () (Fixed) (Total:203.59 GB) (Free:67.47 GB) NTFS
Drive e: (DVD_VIDEO_RECORDER) (CDROM) (Total:1.75 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: E85DE85D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=29 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=204 GB) - (Type=07 NTFS)

==================== End Of Log ============================

GMER:

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-25 17:50:14
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_SP2504C rev.VT100-37 232,89GB
Running: lerspd0s.exe; Driver: C:\Users\Sven\AppData\Local\Temp\kxldypog.sys


---- User code sections - GMER 2.1 ----

.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[2508] C:\Windows\syswow64\USER32.dll!GetMenu + 388 0000000076975835 7 bytes JMP 0000000110053ac0
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[2508] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamW + 104 0000000076979662 7 bytes JMP 0000000110053bf0
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[2508] C:\Windows\syswow64\USER32.dll!SendMessageA + 81 000000007698ef45 7 bytes JMP 0000000110053c10
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[2508] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA + 199 00000000769bfe28 7 bytes JMP 0000000110053c60
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[2508] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW + 52 00000000769bfe61 7 bytes JMP 0000000110053d30
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[2508] C:\Windows\syswow64\USER32.dll!MessageBoxExA + 31 00000000769bfe85 7 bytes JMP 0000000110053ce0
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[2508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077681465 2 bytes [68, 77]
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[2508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776814bb 2 bytes [68, 77]
.text ... * 2
.text D:\Programme\OpenOffice\program\soffice.bin[2712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077681465 2 bytes [68, 77]
.text D:\Programme\OpenOffice\program\soffice.bin[2712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776814bb 2 bytes [68, 77]
.text ... * 2
.text C:\ProgramData\eSafe\eGdpSvc.exe[3292] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000077681465 2 bytes [68, 77]
.text C:\ProgramData\eSafe\eGdpSvc.exe[3292] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000776814bb 2 bytes [68, 77]
.text ... * 2

---- EOF - GMER 2.1 ----

Von Antivir poste ich das Quarantäne Verzeichnis:




Typ: Datei
Quelle: C:\Users\Sven\AppData\Local\Temp\is357113909\uninstaller.exe
Status: Infiziert
Quarantäne-Objekt: 558a9a45.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows XP/VISTA Workstation/Windows 7
Suchengine: 8.02.12.110
Virendefinitionsdatei: 7.11.98.32
Meldung: ADWARE/InstallCore.Gen
Datum/Uhrzeit: 25.08.2013, 16:00


Typ: Datei
Quelle: C:\Users\Sven\AppData\Local\Temp\is357113909\message.exe
Status: Infiziert
Quarantäne-Objekt: 54ec9807.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows XP/VISTA Workstation/Windows 7
Suchengine: 8.02.12.110
Virendefinitionsdatei: 7.11.98.32
Meldung: ADWARE/InstallCore.Gen
Datum/Uhrzeit: 25.08.2013, 15:58


Typ: Datei
Quelle: C:\Users\Sven\AppData\Local\Temp\683.1463676479568_Update.exe
Status: Infiziert
Quarantäne-Objekt: 561336e0.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows XP/VISTA Workstation/Windows 7
Suchengine: 8.02.12.24
Virendefinitionsdatei: 7.11.71.212
Meldung: ADWARE/InstallCore.E
Datum/Uhrzeit: 11.04.2013, 14:05


Typ: Datei
Quelle: C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk
Status: Infiziert
Quarantäne-Objekt: 57f21c3d.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows XP/VISTA Workstation/Windows 7
Suchengine: 8.02.10.222
Virendefinitionsdatei: 7.11.53.226
Meldung:
Datum/Uhrzeit: 10.01.2013, 14:04


Typ: Datei
Quelle: C:\Users\Sven\AppData\Roaming\Dropbox\bin\Dropbox.exe
Status: Infiziert
Quarantäne-Objekt: 4f65308a.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows XP/VISTA Workstation/Windows 7
Suchengine: 8.02.10.222
Virendefinitionsdatei: 7.11.53.226
Meldung: TR/Dropper.Gen7
Datum/Uhrzeit: 10.01.2013, 14:04


OK, ich hoffe damit kann jemand was anfangen und mir sagen wie ich den Mist wieder loswerde!

Danke!!
Sven a.k.a Deza