Guten Tag,

ich sitze hier am Laptop eines Kumpels meines Bruders der die besagte Toolbar? auf dem Rechner hat und nicht weiß was er machen soll. Da ich mir selbst nicht sicher bin und auch nicht weiß ob er noch andere Schadsoftware auf dem Rechner hat bitte ich euch um Hife.

Auf dem Rechner läuft Windows 8, Antivir und die Comodo Firewall soweit mir bekannt. Allerdings letztere wahrscheinlich durch die B1 Search eingeschränkt (keine Updates und deaktiviert).

MfG
AlphA

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01
Ran by Dorian (administrator) on ZOCKERPC on 31-08-2013 11:43:43
Running from C:\Users\Dorian\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
() C:\Program Files (x86)\ControlFilters\CFMonitor.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files (x86)\ControlFilters\CFService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PMMUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-09-27] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Spotify Web Helper] - C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-11-24] ()
HKCU\...\Run: [Comrade.exe] - C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe [36864 2007-05-27] (IGN Entertainment Inc.)
HKCU\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-09-27] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [81952 2012-10-30] (PC Utilities Pro)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1672616 2013-07-09] (Valve Corporation)
HKLM-x32\...\Run: [LManager] -  [x]
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [ControlFilters] - C:\Program Files (x86)\ControlFilters\ControlFilters.exe [403256 2013-04-11] ()
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk
ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8877;https=127.0.0.1:8877
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0
SearchScopes: HKLM - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0
SearchScopes: HKLM-x32 - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - DefaultScope {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = 
SearchScopes: HKCU - {0BD0A52C-9380-4182-ADE4-0BA4CC4F198E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=811df156-cc18-4579-9a5b-9c932fd499a2&apn_sauid=40AA1AFF-8D25-4554-B408-077202E0064E
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0
SearchScopes: HKCU - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = 
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO-x32: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Dorian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\4sharedCopyLinks.xpi
FF Extension: firefox - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\firefox@ghostery.com.xpi
FF Extension: No Name - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [811064 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
R2 CFMonitor.exe; C:\Program Files (x86)\ControlFilters\CFMonitor.exe [27960 2013-04-11] ()
R2 CFService.exe; C:\Program Files (x86)\ControlFilters\CFService.exe [31032 2013-04-11] ()
R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5784472 2013-04-15] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [158928 2013-04-15] (COMODO)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2094216 2013-05-29] ()
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [85904 2012-09-05] (ELAN Microelectronics Corp.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-11-24] (Dritek System INC.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130016 2013-03-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [83672 2013-07-18] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-04-15] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [712216 2013-04-15] (COMODO)
R1 cmdhlp; C:\Windows\system32\DRIVERS\cmdhlp.sys [37560 2013-04-15] (COMODO)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32000 2013-06-02] ()
R1 inspect; C:\Windows\system32\DRIVERS\inspect.sys [118400 2013-04-15] (COMODO)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-11-24] (Dritek System Inc.)
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [x]
S3 X6va014; \??\C:\Windows\SysWOW64\Drivers\X6va014 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-31 11:42 - 2013-08-31 11:42 - 01587214 _____ (Farbar) C:\Users\Dorian\Desktop\FRST64.exe
2013-08-30 13:53 - 2013-08-30 13:53 - 00000000 ____D C:\Team17
2013-08-26 19:57 - 2013-08-26 19:58 - 00000000 ____D C:\Windows\system32\MRT
2013-08-26 13:53 - 2013-05-24 01:02 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-26 13:53 - 2013-05-24 00:25 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-26 13:52 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-26 13:52 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-26 13:52 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-26 13:52 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-26 13:52 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-26 13:52 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-26 13:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-26 13:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-26 13:52 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-08-26 13:52 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-26 13:52 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-26 13:52 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-26 13:52 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2013-08-26 13:52 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2013-08-26 13:52 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-26 13:52 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-26 13:52 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2013-08-26 13:52 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2013-08-26 13:52 - 2013-07-09 08:07 - 02233168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-26 13:52 - 2013-07-02 02:44 - 00036288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2013-08-26 13:52 - 2013-07-02 00:08 - 00247216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2013-08-25 20:37 - 2013-08-30 23:04 - 00003836 _____ C:\Windows\SysWOW64\bufferpool.txt
2013-08-25 14:27 - 2013-08-25 14:32 - 110344048 _____ C:\Users\Dorian\Downloads\avira_free4045_antivirus_de.exe
2013-08-25 13:07 - 2013-08-25 13:08 - 15714204 _____ (diclovit                                                    ) C:\Users\Dorian\Downloads\dmp_1.7.3_setup.exe
2013-08-03 20:18 - 2013-08-03 20:18 - 00003044 _____ C:\Windows\System32\Tasks\{F85BD424-B543-452C-8E8E-4E16EE8FC24A}

==================== One Month Modified Files and Folders =======

2013-08-31 11:43 - 2013-08-31 11:43 - 00000000 ____D C:\FRST
2013-08-31 11:43 - 2013-04-17 18:01 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-31 11:42 - 2013-08-31 11:42 - 01587214 _____ (Farbar) C:\Users\Dorian\Desktop\FRST64.exe
2013-08-31 11:02 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-31 11:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-30 23:04 - 2013-08-25 20:37 - 00003836 _____ C:\Windows\SysWOW64\bufferpool.txt
2013-08-30 23:04 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-08-30 22:55 - 2013-03-25 19:27 - 00000000 ____D C:\Program Files (x86)\MicroVolts
2013-08-30 22:34 - 2013-06-01 10:45 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\Skype
2013-08-30 14:41 - 2013-03-26 15:17 - 00000000 ____D C:\Users\Dorian\Documents\TrackMania
2013-08-30 13:53 - 2013-08-30 13:53 - 00000000 ____D C:\Team17
2013-08-30 13:53 - 2012-11-02 05:40 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-29 19:39 - 2013-04-01 19:02 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\TS3Client
2013-08-27 15:58 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-27 15:58 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-26 19:58 - 2013-08-26 19:57 - 00000000 ____D C:\Windows\system32\MRT
2013-08-26 19:57 - 2013-03-26 19:23 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-26 13:53 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-26 13:46 - 2013-06-02 15:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-26 13:46 - 2013-06-02 15:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-25 14:41 - 2013-03-25 18:07 - 00002030 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-25 14:32 - 2013-08-25 14:27 - 110344048 _____ C:\Users\Dorian\Downloads\avira_free4045_antivirus_de.exe
2013-08-25 13:08 - 2013-08-25 13:07 - 15714204 _____ (diclovit                                                    ) C:\Users\Dorian\Downloads\dmp_1.7.3_setup.exe
2013-08-21 15:43 - 2013-04-17 18:01 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-15 19:56 - 2013-03-25 17:42 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3428012327-743159870-3646233233-1002
2013-08-12 17:21 - 2013-03-25 18:06 - 00000000 ____D C:\Users\Dorian\AppData\Local\CrashDumps
2013-08-11 17:55 - 2012-11-24 12:38 - 00763140 _____ C:\Windows\system32\perfh007.dat
2013-08-11 17:55 - 2012-11-24 12:38 - 00160234 _____ C:\Windows\system32\perfc007.dat
2013-08-11 17:55 - 2012-07-26 09:28 - 01772590 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-03 20:22 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\NDF
2013-08-03 20:18 - 2013-08-03 20:18 - 00003044 _____ C:\Windows\System32\Tasks\{F85BD424-B543-452C-8E8E-4E16EE8FC24A}
2013-08-02 18:52 - 2013-03-26 17:30 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\.minecraft

Files to move or delete:
====================
C:\Users\Dorian\Opera_1215_int_Setup (1).exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-21 17:13

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-08-2013 01
Ran by Dorian at 2013-08-31 11:44:20
Running from C:\Users\Dorian\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 clear.fi SDK - Video 2 (x32 Version: 2.1.1925)
 clear.fi SDK- Movie 2 (x32 Version: 2.1.2008)
4shared Desktop (x32)
7-Zip 9.20 (x32)
AbiWord 2.8.6 (x32 Version: 2.8.6)
Acer Backup Manager (x32 Version: 4.0.0.0059)
Acer Device Fast-lane (Version: 1.00.3007)
Acer Instant Update Service (Version: 1.00.3013)
Acer Power Management (Version: 7.00.3006)
Acer Recovery Management (Version: 6.00.3011)
AcerCloud (x32 Version: 2.01.3115)
AcerCloud Docs (x32 Version: 1.00.3201)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader 6.0.1 (x32 Version: 006.000.001)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
Backup Manager v4 (x32 Version: 4.0.0.0059)
Battle.net (x32)
Blazing Angels Squadrons of WWII (x32 Version: 1.02.0000)
Broadcom Card Reader Driver Installer (Version: 15.4.7.1)
clear.fi Media (x32 Version: 2.01.3108)
clear.fi Photo (x32 Version: 2.01.3108)
Clonk Rage (x32)
Comodo Dragon (x32 Version: 27.0.4.0)
COMODO Firewall (Version: 6.1.13008.2801)
ControlFilters (x32 Version: 1.0.0)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819)
Diablo (x32)
Dolby Home Theater v4 (x32 Version: 7.2.8000.13)
eaner (Version: 4.02)
EPSON WF-3520 Series Printer Uninstall
ETDWare PS/2-X64 11.6.9.001_WHQL (Version: 11.6.9.001)
GameSpy Comrade (x32 Version: 1.4.3.154)
HitmanPro 3.7 (Version: 3.7.5.199)
Identity Card (x32 Version: 2.00.3004)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2867)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.0.1207)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149)
Intel® Trusted Connect Service Client (Version: 1.24.388.1)
Java 7 Update 17 (x32 Version: 7.0.170)
Java Auto Updater (x32 Version: 2.1.9.0)
Launch Manager (x32 Version: 7.0.5)
LEGO® Star Wars™ III: The Clone Wars™ (x32 Version: 1.0.0.0)
Live Updater (x32 Version: 2.00.3004)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft Office (x32 Version: 14.0.6120.5004)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0)
MicroVolts (x32)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MyWinLocker (Version: 4.0.14.35)
MyWinLocker 4 (x32 Version: 4.0.14.35)
MyWinLocker Suite (x32 Version: 4.0.14.24)
NTI Media Maker 9 (x32 Version: 9.0.2.9008)
NVIDIA Grafiktreiber 307.17 (Version: 307.17)
NVIDIA Install Application (Version: 2.1002.85.551)
NVIDIA Optimus 1.10.8 (Version: 1.10.8)
NVIDIA PhysX (x32 Version: 9.12.0613)
NVIDIA PhysX-Systemsoftware 9.12.0613 (Version: 9.12.0613)
NVIDIA Systemsteuerung 307.17 (Version: 307.17)
NVIDIA Update 1.10.8 (Version: 1.10.8)
NVIDIA Update Components (Version: 1.10.8)
Office Addin (x32 Version: 2.01.3200)
Optimizer Pro v3.0 (x32 Version: 3.0)
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.206)
Qualcomm Atheros WiFi Driver Installation (x32 Version: 11.05)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6657)
sEngine (x32 Version: 1.0.1)
Shared C Run-time for x64 (Version: 10.0.0)
Shredder (Version: 2.0.8.9)
Shredder (x32 Version: 2.0.8.9)
Sid Meier's Civilization 4 Complete (x32 Version: 1.74)
Skype™ 6.2 (x32 Version: 6.2.106)
Spotify (x32 Version: 0.8.4.99.ga249b5f1)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (x32 Version: 3.0.10.1)
TmUnitedForever Update 2010-03-15 (x32)
Unity Web Player (HKCU Version: )
Visual Studio 2005 Tools for Office Second Edition Runtime (x32)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729)
Visual Studio Tools for the Office system 3.0 Runtime (x32)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (x32 Version: 1)
World of Tanks - Common Test (x32)
World of Tanks (x32)
Worms World Party (x32)

==================== Restore Points  =========================

12-08-2013 15:55:04 Geplanter Prüfpunkt
21-08-2013 15:11:10 Geplanter Prüfpunkt
26-08-2013 17:54:52 Windows Update

==================== Hosts content: ==========================

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0E52EC20-206D-402D-AE62-58B24385DD48} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUFirmwareInstall
Task: {10D85952-E3F6-47A1-96CF-5E1C2D874EA6} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe [2012-07-26] (Microsoft Corporation)
Task: {13A2AC02-B682-48CC-9155-2E2673580117} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical
Task: {17644F17-DC4C-4AC8-9444-7AAA52EB5CDC} - System32\Tasks\Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler
Task: {19C58524-6F9C-4515-9AC3-B4A4C1163625} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe No File
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => C:\Windows\System32\sysmain.dll [2013-05-04] (Microsoft Corporation)
Task: {1DB7C2F1-876C-4F24-AD17-8428211113F9} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents
Task: {214B24F4-FEB4-4C59-AF1F-70136065199C} - System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance
Task: {23700E5C-0E77-499D-908A-415D5C6252F4} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => C:\Windows\System32\WSClient.dll [2012-09-20] (Microsoft Corporation)
Task: {27949D9D-ABF9-436E-A568-6B88DBF87C2B} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-07-04] (CyberLink)
Task: {2C6B9EA8-7F5A-4ABA-BF96-8D352D02A743} - System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh
Task: {2E030FA7-3D7C-4E1D-8CFE-56ADB26FD402} - System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks
Task: {3054485A-F517-4E95-9977-4DD827B1E9B3} - System32\Tasks\Microsoft\Windows\WS\Badge Update
Task: {33F733D5-F865-4EDD-8086-6857ED5D3DD1} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup
Task: {3764ACD2-537D-4A2A-B876-701C956B9C2B} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] ()
Task: {378401BA-A703-444A-A79C-3C47AD2DC5B6} - System32\Tasks\Microsoft\Windows\TaskScheduler\Maintenance Configurator
Task: {3AE164E7-30CD-40BC-9422-3EC7A5618965} - System32\Tasks\Microsoft\Windows\WS\WSTask
Task: {3C490ABD-D849-41AF-9AC4-87DD759B0996} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
Task: {4073C1B3-6E16-4AA8-B7F3-C6A6D35D5071} - System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance
Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - System32\Tasks\Microsoft\Windows\Live\Roaming\SynchronizeWithStorage
Task: {483A8F5C-5D26-44B5-B49E-AF6741D1BBEB} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\Windows\System32\MbaeParserTask.exe [2013-06-01] (Microsoft Corporation)
Task: {4B952129-9AE9-41A3-BE2B-8AD2E06F66B6} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon
Task: {4D02C09C-7EC1-4366-89F4-A63219B60ED6} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-23] ()
Task: {5755E746-D7ED-4C20-A472-66C11834CDE4} - System32\Tasks\Microsoft\Windows\TaskScheduler\Manual Maintenance
Task: {5C4EFB77-EFA6-45DF-A373-D795C0725BFF} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required
Task: {627441F3-8526-4B62-BF9A-1A3EA414E71A} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\Windows\system32\SpaceAgent.exe [2012-07-26] (Microsoft Corporation)
Task: {69AC89AD-0274-4668-8047-BEEAA6D194B4} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {6E9DE125-5583-4031-B572-FEE48F25CFFF} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\Windows\System32\wpcmon.exe [2012-09-20] (Microsoft Corporation)
Task: {6FDDEA7C-6310-428D-AEB2-54FFC72811EF} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319
Task: {725D1200-2B5D-4369-B0DC-3631C371AE58} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {74096F94-B654-4DB0-96F5-3C3408B92FE3} - System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update
Task: {74CDED6B-8592-4E7A-8D60-313673DFD1F5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-21] (Adobe Systems Incorporated)
Task: {7C9C9B35-B542-48E9-A25E-88938FCD4BDA} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe [2012-08-15] (Microsoft Corporation)
Task: {7D9A9A1C-499C-40A6-8F8A-5BCC4CC9A87C} - System32\Tasks\Microsoft\Windows\TaskScheduler\Regular Maintenance
Task: {82B33C67-F329-458D-B9FC-BD1FEDEC1E40} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-23] ()
Task: {845CB020-68B5-4C6B-9876-7BEC7B3E27AC} - System32\Tasks\Microsoft\Windows\TaskScheduler\Idle Maintenance
Task: {87354DAA-66DF-4B41-9346-15958D96E1D2} - System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode)
Task: {8D71B8DF-2A46-4C7B-90D9-CCFC5BFDBD95} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {921A1D4E-32FB-46D7-B6C0-6F467884074D} - System32\Tasks\Microsoft\Windows\WS\Sync Licenses
Task: {9479EF8E-11D4-41B3-9783-CC65070D592D} - System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime
Task: {94DCF254-64FB-4C4E-8E12-5F4055C10C2A} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64
Task: {989A7C6D-BE82-4C3C-AF96-6116039E336B} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic
Task: {9F2B63B0-1C17-42E5-AB42-A941607F84A8} - System32\Tasks\COMODO\COMODO Welcome {CEB54B45-2B5E-4FF5-9223-6735CD80FE69} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [2013-04-15] (COMODO)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => C:\Windows\System32\WSClient.dll [2012-09-20] (Microsoft Corporation)
Task: {A800277E-E202-4492-AD38-3312641CBC04} - System32\Tasks\Microsoft\Windows\Live\Roaming\MaintenanceTask
Task: {AB62FA47-2C99-44B1-A5D0-D4161423BE43} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefresh
Task: {AC6259DE-AC59-459E-849E-6ADFFD1ADE63} - System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask
Task: {ADC49FC3-377E-422F-B07A-70BCACB1A72F} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start => C:\Windows\system32\sc.exe [2012-07-26] (Microsoft Corporation)
Task: {AEB0B5BD-B9E5-458A-898A-E559BD9EB51B} - System32\Tasks\Microsoft\Windows\SettingSync\BackgroundUploadTask
Task: {AF549BD8-337C-4BF7-8681-36A182E30507} - System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan
Task: {B1F4564E-D7D1-42C7-872B-7B44C40C987A} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe No File
Task: {B4ACA1C1-0B05-4B67-AFB7-D89F2782507D} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUSessionConnect
Task: {BC76AEF7-2CF0-4EB6-B65B-A8803E0B5E12} - System32\Tasks\Microsoft\Windows\AppID\SmartScreenSpecific
Task: {C1ACCD1E-4385-4FB2-B5E4-7F2A57A626A2} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan
Task: {C463FD1E-31C7-4C20-AB65-08E514CA152D} - System32\Tasks\Microsoft\Windows\IME\SQM data sender
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => C:\Windows\System32\Windows.Storage.ApplicationData.dll [2012-07-26] (Microsoft Corporation)
Task: {CD1054FF-8005-4904-8B9C-436EAB1E2021} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork
Task: {CD5149D5-8940-4D9F-8122-52E94B90B707} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2012-07-31] (Acer Incorporated)
Task: {D5658A95-2CD9-4FEB-BFEC-74D04707221F} - System32\Tasks\WPD\SqmUpload_S-1-5-21-3428012327-743159870-3646233233-1002 => C:\Windows\System32\portabledeviceapi.dll [2012-07-26] (Microsoft Corporation)
Task: {DBCF6E1B-CE0A-441E-B7A5-219C8BE50C65} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical
Task: {DC38ACCD-5CF4-4109-B7B5-E3E50A04CE26} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-04-15] (COMODO)
Task: {DDADEDBD-2B56-4634-9D9F-F4CED38F85BA} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {DECE5921-598D-454B-9A04-B2DE95EFC1B3} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery
Task: {E362B774-061C-4883-A305-3D84DD76F7EF} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUScheduledInstall
Task: {E3BA6B46-84C1-41D8-ACA7-CC753BBE99DF} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2013-04-15] (COMODO)
Task: {E4DFE66F-E089-4CC3-A70F-957223D565F4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask
Task: {E8DAA09B-DF2A-4951-9134-6FA9587793F9} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\Windows\System32\drvinst.exe [2012-09-20] (Microsoft Corporation)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => C:\Windows\System32\Startupscan.dll [2012-07-26] (Microsoft Corporation)
Task: {ED0C1F69-C3A2-41EA-B8C3-3F0D83A1F6C0} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\BthSQM
Task: {F27D265F-64FC-4972-9BF9-8DC396EF1F5B} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated)
Task: {F5B6D118-0F7A-46EA-906B-CA075495B28F} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3428012327-743159870-3646233233-1002
Task: {FF9139C4-4EC4-44E3-8386-F257B4C7FA9D} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3428012327-743159870-3646233233-500
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-11-02 05:16 - 2012-09-20 08:30 - 01743872 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\combase.dll
2012-07-26 01:55 - 2012-07-26 05:07 - 00180224 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\WINMMBASE.dll
2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\SHCORE.DLL
2012-11-02 05:54 - 2012-09-05 11:31 - 02277776 _____ (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDFavorite.dll
2012-11-02 05:54 - 2012-09-05 11:31 - 02303376 _____ (ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDApix.dll
2012-11-02 05:54 - 2012-09-05 11:31 - 02384272 _____ (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCmds.dll
2012-07-26 04:19 - 2012-07-26 05:06 - 00023040 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\pcacli.dll
2012-07-26 01:55 - 2012-07-26 05:07 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\WINMMBASE.dll
2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\SHCORE.dll
2013-04-15 18:38 - 2013-04-15 18:38 - 00111312 _____ (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll
2013-04-15 18:38 - 2013-04-15 18:38 - 02376912 _____ (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdcfg.dll
2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\SHCORE.dll
2013-03-27 17:10 - 2012-10-11 07:46 - 01395712 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Immersive.dll
2012-11-02 05:16 - 2012-09-20 08:33 - 00699392 _____ (Microsoft Corporation) C:\Windows\System32\twinapi.dll
2013-06-20 11:39 - 2013-05-04 08:57 - 00389120 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\Bcp47Langs.dll
2013-06-20 11:39 - 2013-05-04 08:58 - 10116096 _____ (Microsoft Corporation) C:\Windows\System32\twinui.dll
2012-07-26 01:33 - 2012-07-26 05:07 - 00069632 _____ (Microsoft Corporation) C:\Windows\System32\windows.immersiveshell.serviceprovider.dll
2013-03-27 17:10 - 2012-10-11 07:45 - 00093184 _____ (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TipBand.dll
2012-07-26 01:54 - 2012-07-26 05:05 - 00171008 _____ (Microsoft Corporation) C:\Windows\System32\IDStore.dll
2013-06-20 11:40 - 2013-04-09 06:51 - 00456704 _____ (Microsoft Corporation) C:\Windows\System32\wpncore.dll
2012-07-26 04:06 - 2012-07-26 05:07 - 00119296 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\sppc.dll
2012-11-24 03:57 - 2012-10-11 20:41 - 00974184 _____ (NVIDIA Corporation) C:\Windows\SYSTEM32\nvumdshimx.dll
2012-11-24 03:57 - 2012-10-11 20:41 - 00247144 _____ (NVIDIA Corporation) C:\Windows\SYSTEM32\nvinitx.dll
2012-07-25 22:22 - 2012-10-23 20:37 - 12836864 _____ (Intel Corporation) C:\Windows\system32\igd10umd64.dll
2012-07-26 02:05 - 2012-07-26 05:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\dcomp.dll
2012-07-26 01:31 - 2012-07-26 05:08 - 00343552 _____ (Microsoft Corporation) C:\Windows\System32\wlidprov.dll
2012-07-26 01:55 - 2012-07-26 05:07 - 01161216 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\UIAutomationCore.dll
2012-07-26 01:24 - 2012-07-26 05:05 - 00186368 _____ (Microsoft Corporation) C:\Windows\System32\InputSwitch.dll
2012-07-26 02:04 - 2012-07-26 05:07 - 00046592 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\windows.globalization.fontgroups.dll
2012-07-26 01:22 - 2012-07-26 05:06 - 00601600 _____ (Microsoft Corporation) C:\Windows\System32\MrmCoreR.dll
2013-03-26 18:03 - 2013-02-02 10:23 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\Windows.Networking.Connectivity.dll
2012-07-26 03:37 - 2012-07-26 05:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\NcaApi.dll
2012-07-26 01:33 - 2012-07-26 05:06 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\NetworkStatus.dll
2012-07-26 03:06 - 2012-07-26 05:06 - 00454144 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2012-07-26 04:33 - 2012-07-26 04:33 - 00629760 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\UIRibbonRes.dll
2012-07-26 01:54 - 2012-07-26 05:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\System32\BluetoothApis.dll
2012-07-26 02:59 - 2012-07-26 05:05 - 00465408 _____ (Microsoft Corporation) C:\Windows\System32\dlnashext.dll
2013-04-13 18:26 - 2013-03-02 04:44 - 00049152 _____ (Microsoft Corporation) C:\Windows\System32\DevDispItemProvider.dll
2013-03-25 18:05 - 2013-07-18 08:01 - 00231480 _____ (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll
2013-08-26 13:52 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\apprepapi.dll
2012-11-02 05:55 - 2012-10-23 20:37 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrDEU.lrc
2012-08-10 19:28 - 2012-08-10 19:28 - 00033408 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\CommApi.dll
2012-08-10 19:28 - 2012-08-10 19:28 - 00035456 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\ipc.dll
2011-06-11 02:15 - 2011-06-11 02:15 - 00608080 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\MSVCP100.dll
2011-06-11 02:15 - 2011-06-11 02:15 - 00829264 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\MSVCR100.dll
2012-08-10 19:28 - 2012-08-10 19:28 - 00098944 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\utils.dll
2012-08-10 19:28 - 2012-08-10 19:28 - 00027264 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\TCPConnection.dll
2012-07-26 03:00 - 2012-07-26 05:05 - 00163328 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\credui.dll
2012-11-24 03:57 - 2012-10-11 20:41 - 02735976 _____ (NVIDIA Corporation) C:\Windows\SYSTEM32\nvapi64.dll
2012-07-26 04:09 - 2012-07-26 05:05 - 00124928 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\CHARTV.dll
2012-08-10 19:28 - 2012-08-10 19:28 - 00202368 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\FolderViewImpl.dll
2012-07-26 02:12 - 2012-07-26 06:55 - 01326784 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\webservices.dll
2011-03-29 22:10 - 2011-03-29 22:10 - 00063344 _____ (Egis Technology Inc.) C:\Program Files (x86)\EgisTec Shredder\x64\ShredderContextMenu.dll
2011-03-29 22:10 - 2011-03-29 22:10 - 00322416 _____ (Egis Technology Inc.) C:\Program Files (x86)\EgisTec Shredder\x64\FrameUtility.dll
2012-11-24 04:09 - 2012-11-24 04:09 - 00179704 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818\ATL90.DLL
2011-03-29 22:10 - 2011-03-29 22:10 - 01067376 _____ (Egis Technology Inc.) C:\Program Files (x86)\EgisTec Shredder\x64\LibFrame.dll
2012-07-12 05:10 - 2012-07-12 05:10 - 00053328 _____ (Egis Technology Inc. ) C:\Program Files (x86)\EgisTec MyWinLocker\x64\MWLIVShellExt.dll
2012-07-12 05:10 - 2012-07-12 05:10 - 00756304 _____ (Egis Technology Inc. ) C:\Program Files (x86)\EgisTec MyWinLocker\x64\MWLUtility.dll
2012-07-26 02:05 - 2012-07-26 05:06 - 00069632 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\NETAPI32.dll
2012-07-12 05:10 - 2012-07-12 05:10 - 00251984 _____ (Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x64\CryptoAPI.dll
2012-06-22 03:12 - 2012-06-22 03:12 - 01407568 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2012-08-10 19:28 - 2012-08-10 19:28 - 00288896 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\ShellContextExt.dll
2013-03-25 18:05 - 2013-07-18 08:02 - 02288184 _____ (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\shlext64.dll
2012-08-10 19:28 - 2012-08-10 19:28 - 00107648 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvAppExt.dll
2012-08-10 19:28 - 2012-08-10 19:28 - 01067136 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\OutLookLib.dll
2011-06-11 02:15 - 2011-06-11 02:15 - 05601616 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\mfc100u.dll
2011-06-11 02:15 - 2011-06-11 02:15 - 00158536 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\ATL100.DLL
2011-06-11 02:15 - 2011-06-11 02:15 - 00064336 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\MFC100DEU.DLL
2013-03-14 18:28 - 2013-03-14 18:28 - 00653824 _____ () C:\PROGRA~2\4SHARE~1\CMenu64.dll
2012-11-24 03:58 - 2012-10-12 09:36 - 00870760 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2012-11-02 05:16 - 2012-09-20 08:33 - 01304064 _____ (Microsoft Corporation) C:\Windows\System32\Windows.Media.Streaming.dll
2012-11-02 05:54 - 2012-08-28 22:37 - 00922736 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDUtl.dll
2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\shcore.dll
2012-11-02 05:55 - 2012-10-23 20:37 - 00028672 _____ (Intel Corporation) C:\Windows\system32\IGFXEXPS.DLL
2012-11-02 05:55 - 2012-10-23 20:37 - 00063488 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.dll
2012-11-24 03:58 - 2012-10-12 09:37 - 04128616 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvUI.dll
2012-11-24 03:58 - 2012-10-11 20:41 - 00778088 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\easyDaemonAPIU64.DLL
2012-07-26 01:58 - 2012-07-26 05:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2012-11-24 03:58 - 2012-10-11 20:41 - 03457896 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\NvUpdt.dll
2012-11-24 03:58 - 2012-10-11 20:41 - 00980840 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\NVUPDTR.DLL
2013-04-15 18:38 - 2013-04-15 18:38 - 05033168 _____ (Terra Informatica Software, Inc.) C:\Program Files\COMODO\COMODO Internet Security\cmdhtml.dll
2012-08-22 21:02 - 2012-08-22 21:02 - 00174736 _____ (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\CommonControl.dll
2012-08-22 21:02 - 2012-08-22 21:02 - 00175248 _____ (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\PowerSettingControl.dll
2012-07-26 02:06 - 2012-07-26 05:05 - 00024064 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\DSPARSE.dll
2012-11-02 05:55 - 2012-10-23 20:37 - 00441856 _____ (Intel Corporation) C:\Windows\system32\igfxdev.dll
2012-11-02 05:55 - 2012-10-23 20:37 - 00110592 _____ (Intel Corporation) C:\Windows\System32\hccutils.DLL
2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\System32\SHCORE.dll
2012-11-02 05:55 - 2012-10-23 20:37 - 09007616 _____ (Intel Corporation) C:\Windows\System32\igfxress.dll
2012-11-02 05:55 - 2012-10-23 20:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-11-24 04:03 - 2010-11-03 12:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2012-11-24 04:03 - 2012-06-08 10:18 - 03615888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2013-06-20 11:40 - 2013-04-09 07:33 - 00489576 _____ (Microsoft Corporation) C:\Windows\system32\audioeng.dll
2012-11-24 04:09 - 2012-11-24 04:09 - 05086712 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9\mfc90.dll
2012-11-24 04:09 - 2012-11-24 04:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90DEU.DLL
2012-07-12 04:40 - 2012-07-12 04:40 - 00072272 _____ (Egis Technology Inc.) C:\Program Files\EgisTec IPS\KernelController.dll
2012-07-12 04:41 - 2012-07-12 04:41 - 00090704 _____ (Egis Technology Inc.) C:\Program Files\EgisTec IPS\LicenseCenter.dll
2012-07-12 04:41 - 2012-07-12 04:41 - 00070736 _____ (Egis Technology Inc.) C:\Program Files\EgisTec IPS\UpdateModel.dll
2012-07-26 04:32 - 2012-07-26 05:05 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\ktmw32.dll
2012-07-26 04:20 - 2012-07-26 05:07 - 00015360 _____ (Microsoft Corporation) C:\Windows\System32\tschannel.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\Users\Dorian\Desktop\Thumbs.db:encryptable
AlternateDataStreams: C:\Users\Dorian\Downloads\Thumbs.db:encryptable


==================== Faulty Device Manager Devices =============

Name: Bluetooth USB Module
Description: Bluetooth USB Module
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/05/2013 10:06:59 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80070005

Error: (08/01/2013 04:00:59 PM) (Source: Application Error) (User: )
Description: Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen werden:
Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten
Speichertreibern, oder der Datenträger fehlt.
Das Programm LEGO® Clone Wars™ wurde wegen dieses Fehlers geschlossen.

Programm: LEGO® Clone Wars™
Datei: 

Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.
Benutzeraktion
1. Öffnen Sie die Datei erneut.
Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.
2.
Wenn Sie weiterhin nicht auf die Datei zugreifen können und
	- diese sich im Netzwerk befindet, 
dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann.
	- diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.
3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht.
5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt. 
Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.

Zusätzliche Daten
Fehlerwert: 00000000
Datenträgertyp: 0

Error: (08/01/2013 04:00:59 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: LEGOCloneWars.exe, Version: 1.0.0.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: LEGOCloneWars.exe, Version: 1.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc000001d
Fehleroffset: 0x014640fd
ID des fehlerhaften Prozesses: 0xf98
Startzeit der fehlerhaften Anwendung: 0xLEGOCloneWars.exe0
Pfad der fehlerhaften Anwendung: LEGOCloneWars.exe1
Pfad des fehlerhaften Moduls: LEGOCloneWars.exe2
Berichtskennung: LEGOCloneWars.exe3
Vollständiger Name des fehlerhaften Pakets: LEGOCloneWars.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LEGOCloneWars.exe5

Error: (07/30/2013 05:13:12 PM) (Source: Application Hang) (User: )
Description: Programm 7zFM.exe, Version 9.20.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1fb4

Startzeit: 01ce8d3744f90759

Endzeit: 4294967295

Anwendungspfad: C:\Program Files (x86)\7-Zip\7zFM.exe

Berichts-ID: 8c3e38d7-f92a-11e2-bee5-b888e3ac4950

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (07/30/2013 05:11:48 PM) (Source: Application Hang) (User: )
Description: Programm 7zFM.exe, Version 9.20.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1cdc

Startzeit: 01ce8d370c70b59b

Endzeit: 4294967295

Anwendungspfad: C:\Program Files (x86)\7-Zip\7zFM.exe

Berichts-ID: 59df9f31-f92a-11e2-bee5-b888e3ac4950

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (07/30/2013 05:10:54 PM) (Source: Application Hang) (User: )
Description: Programm 7zFM.exe, Version 9.20.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1710

Startzeit: 01ce8d36e12d741c

Endzeit: 4294967295

Anwendungspfad: C:\Program Files (x86)\7-Zip\7zFM.exe

Berichts-ID: 3a39943d-f92a-11e2-bee5-b888e3ac4950

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (07/30/2013 04:02:46 PM) (Source: Application Hang) (User: )
Description: Programm javaw.exe, Version 7.0.170.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1a4

Startzeit: 01ce8d2c9584195f

Endzeit: 101

Anwendungspfad: C:\Windows\SysWOW64\javaw.exe

Berichts-ID: a753a764-f920-11e2-bee5-b888e3ac4950

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


System errors:
=============
Error: (08/31/2013 11:02:11 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎31.‎08.‎2013 um 10:33:36 unerwartet heruntergefahren.

Error: (08/31/2013 10:34:16 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFService erreicht.

Error: (08/31/2013 10:33:46 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.

Error: (08/30/2013 02:02:43 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFService erreicht.

Error: (08/30/2013 02:02:13 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.

Error: (08/30/2013 01:52:11 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFService erreicht.

Error: (08/30/2013 01:51:41 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.

Error: (08/27/2013 04:00:03 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎26.‎08.‎2013 um 20:11:51 unerwartet heruntergefahren.

Error: (08/26/2013 01:42:05 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.

Error: (08/25/2013 08:41:38 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.


Microsoft Office Sessions:
=========================
Error: (08/05/2013 10:06:59 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80070005

Error: (08/01/2013 04:00:59 PM) (Source: Application Error)(User: )
Description: LEGO® Clone Wars™000000000

Error: (08/01/2013 04:00:59 PM) (Source: Application Error)(User: )
Description: LEGOCloneWars.exe1.0.0.000000000LEGOCloneWars.exe1.0.0.000000000c000001d014640fdf9801ce8ebf81cbd357C:\Program Files (x86)\LucasArts\LEGO Clone Wars\LEGOCloneWars.exeC:\Program Files (x86)\LucasArts\LEGO Clone Wars\LEGOCloneWars.execa935ef1-fab2-11e2-bee9-b888e3ac4950

Error: (07/30/2013 05:13:12 PM) (Source: Application Hang)(User: )
Description: 7zFM.exe9.20.0.01fb401ce8d3744f907594294967295C:\Program Files (x86)\7-Zip\7zFM.exe8c3e38d7-f92a-11e2-bee5-b888e3ac4950

Error: (07/30/2013 05:11:48 PM) (Source: Application Hang)(User: )
Description: 7zFM.exe9.20.0.01cdc01ce8d370c70b59b4294967295C:\Program Files (x86)\7-Zip\7zFM.exe59df9f31-f92a-11e2-bee5-b888e3ac4950

Error: (07/30/2013 05:10:54 PM) (Source: Application Hang)(User: )
Description: 7zFM.exe9.20.0.0171001ce8d36e12d741c4294967295C:\Program Files (x86)\7-Zip\7zFM.exe3a39943d-f92a-11e2-bee5-b888e3ac4950

Error: (07/30/2013 04:02:46 PM) (Source: Application Hang)(User: )
Description: javaw.exe7.0.170.21a401ce8d2c9584195f101C:\Windows\SysWOW64\javaw.exea753a764-f920-11e2-bee5-b888e3ac4950


CodeIntegrity Errors:
===================================
  Date: 2013-08-31 11:43:15.763
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-31 11:05:23.097
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-31 10:45:48.994
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-31 10:36:21.000
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-30 19:30:57.808
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-30 14:04:47.665
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-30 14:04:28.155
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-30 13:54:18.869
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-30 13:52:50.846
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-29 17:34:07.576
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Percentage of memory in use: 22%
Total physical RAM: 8007.27 MB
Available physical RAM: 6208.01 MB
Total Pagefile: 9223.27 MB
Available Pagefile: 7254.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:679.19 GB) (Free:568.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 7973EA10)

Partition: GPT Partition Type
==================== End Of Log ============================
         

MfG
AlphA

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ES ploppt eine Meldung auf. Ich hab keine Windows 8 Kopie hier da er seine CDs nicht mitgebracht hat. Wäre das notwendig? Muss die registry wiederhergestellt werden?

ERU for Windoes NT

Unable to create file:
C:\Windows\erdnt\Hiv-bsckup\ERDNT.INF

Registry backup will continue, but not restore information for the ERDNT programm will be saved. This means that later restoration of the registry can only be done manually, by using another OS copy back the files.

Hm warum darf ich meinen eigenen Post erst nach 60min editieren? oO und warum hängt er einen weiteren Post einfach dran? Komisches System..

Ich hab nach der Meldung weiter geklickt:sz:. Im weiteren Verlauf sind immer wieder Fehlermeldungen aufgetaucht...

ComboFix 13-08-30.02 - Dorian 31.08.2013  16:27:30.1.8 - x64
ausgeführt von:: c:\users\Dorian\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Public\sdelevURL.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-07-28 bis 2013-08-31  ))))))))))))))))))))))))))))))
.
.
2013-08-31 14:36 . 2013-08-31 14:36	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-08-31 14:36 . 2013-08-31 14:36	--------	d-----w-	c:\users\Dorian\AppData\Local\temp
2013-08-31 14:36 . 2013-08-31 14:36	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-08-31 12:53 . 2001-08-29 05:36	434176	----a-w-	c:\windows\SysWow64\divxdec.ax
2013-08-31 12:49 . 2013-08-31 12:49	--------	d-----w-	c:\program files (x86)\Stormregion Ltd
2013-08-31 09:43 . 2013-08-31 09:43	--------	d-----w-	C:\FRST
2013-08-30 11:53 . 2013-08-30 11:53	--------	d-----w-	C:\Team17
2013-08-30 11:53 . 2001-04-11 16:25	77824	----a-w-	c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2013-08-30 11:53 . 2001-04-11 16:25	225280	----a-w-	c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2013-08-30 11:53 . 2001-04-11 16:21	176128	----a-w-	c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2013-08-30 11:53 . 2001-04-11 16:20	32768	----a-w-	c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2013-08-26 17:57 . 2013-08-26 17:58	--------	d-----w-	c:\windows\system32\MRT
2013-08-26 11:53 . 2013-05-23 23:02	1314816	----a-w-	c:\windows\system32\rpcrt4.dll
2013-08-26 11:53 . 2013-05-23 22:25	694272	----a-w-	c:\windows\SysWow64\rpcrt4.dll
2013-08-20 15:39 . 2013-08-20 15:39	240304	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10214.bin
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-26 17:57 . 2013-03-26 17:23	78161360	----a-w-	c:\windows\system32\MRT.exe
2013-07-18 06:02 . 2013-05-07 13:28	83672	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-06-27 22:04 . 2013-06-21 08:02	78200	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-27 22:04 . 2013-06-21 08:02	693112	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-16 22:41 . 2013-07-29 10:37	997632	----a-w-	c:\windows\system32\drivers\ndis.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE" [2012-09-27 283232]
"Spotify Web Helper"="c:\program files (x86)\Spotify\Data\SpotifyWebHelper.exe" [2012-11-24 1193176]
"Comrade.exe"="c:\program files (x86)\GameSpy\Comrade\Comrade.exe" [2007-05-27 36864]
"EPLTarget\P0000000000000001"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE" [2012-09-27 283232]
"Optimizer Pro"="c:\program files (x86)\Optimizer Pro\OptProLauncher.exe" [2012-10-30 81952]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2013-07-09 1672616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dolby Home Theater v4"="c:\dolby pcee4\pcee4.exe" [2012-04-23 508256]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-07-18 345144]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"ControlFilters"="c:\program files (x86)\ControlFilters\ControlFilters.exe" [2013-04-11 403256]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2012-07-26 62976]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\
Acer Backup Manager Tray.lnk - c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe -h -k [2012-8-23 533568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceActiveDesktopOn"= 0 (0x0)
"NoActiveDesktopChanges"= 1 (0x1)
"NoActiveDesktop"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\syswow64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0bootdelete
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@=""
.
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
R2 DragonUpdater;COMODO Dragon Update Service;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\System32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\System32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 BthLEEnum;Treiber für energiearme Bluetooth-Geräte;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]
R3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [x]
R3 DeviceFastLaneService;Device Fast-lane Service;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [x]
R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]
R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys;c:\windows\SYSNATIVE\drivers\hitmanpro37.sys [x]
R3 WSDScan;WSD-Scanunterstützung;c:\windows\System32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]
R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys;c:\windows\SYSNATIVE\DRIVERS\cmderd.sys [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys;c:\windows\SYSNATIVE\DRIVERS\cmdguard.sys [x]
S1 cmdhlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys;c:\windows\SYSNATIVE\DRIVERS\cmdhlp.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 BrcmCardReader;Broadcom Card Reader Service;c:\program files\Broadcom\MemoryCard\BrcmCardReader.exe;c:\program files\Broadcom\MemoryCard\BrcmCardReader.exe [x]
S2 CCDMonitorService;CCDMonitorService;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [x]
S2 CFMonitor.exe;CFMonitor;c:\program files (x86)\ControlFilters\CFMonitor.exe;c:\program files (x86)\ControlFilters\CFMonitor.exe [x]
S2 CFService.exe;CFService;c:\program files (x86)\ControlFilters\CFService.exe;c:\program files (x86)\ControlFilters\CFService.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ETDService;Elan Service;c:\program files\Elantech\ETDService.exe;c:\program files\Elantech\ETDService.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]
S2 RfButtonDriverService;Dritek RF Button Command Service;c:\windows\RfBtnSvc64.exe;c:\windows\RfBtnSvc64.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 ZAtheros Wlan Agent;ZAtheros Wlan Agent;c:\program files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe;c:\program files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [x]
S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\System32\drivers\b57xdbd.sys;c:\windows\SYSNATIVE\drivers\b57xdbd.sys [x]
S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\System32\drivers\b57xdmp.sys;c:\windows\SYSNATIVE\drivers\b57xdmp.sys [x]
S3 bScsiMSa;bScsiMSa;c:\windows\System32\drivers\bScsiMSa.sys;c:\windows\SYSNATIVE\drivers\bScsiMSa.sys [x]
S3 bScsiSDa;bScsiSDa;c:\windows\System32\drivers\bScsiSDa.sys;c:\windows\SYSNATIVE\drivers\bScsiSDa.sys [x]
S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\System32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]
S3 ePowerSvc;ePower Service;c:\program files\Acer\Acer Power Management\ePowerSvc.exe;c:\program files\Acer\Acer Power Management\ePowerSvc.exe [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 k57nd60a;Broadcom NetLink (TM)-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 Ps2Kb2Hid;PS/2 Keyboard to HID Driver;c:\windows\System32\drivers\aPs2Kb2Hid.sys;c:\windows\SYSNATIVE\drivers\aPs2Kb2Hid.sys [x]
S3 X6va014;X6va014;c:\windows\SysWOW64\Drivers\X6va014;c:\windows\SysWOW64\Drivers\X6va014 [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-31 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-17 13:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-10-23 171040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-10-23 399392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-10-23 441888]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-06-07 1212048]
"BtPreLoad"="c:\program files (x86)\Bluetooth Suite\BtPreLoad.exe" [2012-08-10 64640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\system32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uSearch Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
uStart Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991
uDefault_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
mDefault_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
mStart Page = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:8877;https=127.0.0.1:8877
IE: &Download All using 4shared Desktop - c:\program files (x86)\4shared Desktop\Desktop.32/D_ALL_LINK
IE: &Download using 4shared Desktop - c:\program files (x86)\4shared Desktop\Desktop.32/D_ONE_LINK
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.type - 0
.
.
------- Dateityp-Verknüpfung -------
.
regedit=regedit.exe "%1"
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-LManager - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Toolbar-Locked - (no file)
.
.
.
Zeit der Fertigstellung: 2013-08-31  16:41:34
ComboFix-quarantined-files.txt  2013-08-31 14:41
.
Vor Suchlauf: 11 Verzeichnis(se), 607.311.933.440 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 607.380.148.224 Bytes frei
.
- - End Of File - - 4BB67947566DE8629FE0CF92C0995FC1
         

komisch.

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.01.02

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16660
Dorian :: ZOCKERPC [Administrator]

Schutz: Aktiviert

01.09.2013 10:50:39
mbam-log-2013-09-01 (10-50-39).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: Dateisystem | Heuristiks/Extra | P2P
Durchsuchte Objekte: 23013
Laufzeit: 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Optimizer Pro (PUP.Optional.OptimizePro.A) -> Daten: C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe (PUP.Optional.OptimizePro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

# AdwCleaner v3.001 - Report created 01/09/2013 at 11:09:31
# Updated 24/08/2013 by Xplode
# Operating System : Windows 8  (64 bits)
# Username : Dorian - ZOCKERPC
# Running from : C:\Users\Dorian\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\eSafe
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro
Folder Deleted : C:\Program Files (x86)\optimizer pro
Folder Deleted : C:\Users\Dorian\AppData\Local\B1E
Folder Deleted : C:\Users\Dorian\AppData\Roaming\B1Toolbar
Folder Deleted : C:\Users\Dorian\AppData\Roaming\eIntaller
Folder Deleted : C:\Users\Dorian\AppData\Roaming\optimizer pro
Folder Deleted : C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\jetpack
File Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Shortcuts ] *****

Shortcut Disinfected : C:\Users\Dorian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Shortcut Disinfected : C:\Users\Dorian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Key Deleted : HKCU\Software\5d6888bb56aee44
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Iminent
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\HappyLyrics
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\Software\Desksvc
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\Software\portaldositesSoftware
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v23.0.1 (de)

[ File : C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10623 octets] - [01/09/2013 11:08:52]
AdwCleaner[S0].txt - [9414 octets] - [01/09/2013 11:09:31]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9474 octets] ##########
         

JRT liegt auf dem Desktop, starte als Admin und bekomme folgende Fehlermeldung:

7-ZIP SFX archive: error

Error during execution ""C:\Users\Dorian\AppData\Local\Temp\jrt\get.bat"".

MfG
AlphA

Lass JRT weg.

Dann fehlt nur noch der FRST log, bitte:


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01
Ran by Dorian (administrator) on ZOCKERPC on 01-09-2013 15:03:58
Running from C:\Users\Dorian\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
() C:\Program Files (x86)\ControlFilters\CFMonitor.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
() C:\Program Files (x86)\ControlFilters\CFService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PMMUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-09-27] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Spotify Web Helper] - C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-11-24] ()
HKCU\...\Run: [Comrade.exe] - C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe [36864 2007-05-27] (IGN Entertainment Inc.)
HKCU\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-09-27] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1672616 2013-07-09] (Valve Corporation)
HKLM-x32\...\Run: [LManager] -  [x]
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [ControlFilters] - C:\Program Files (x86)\ControlFilters\ControlFilters.exe [403256 2013-04-11] ()
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk
ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8877;https=127.0.0.1:8877
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {0BD0A52C-9380-4182-ADE4-0BA4CC4F198E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=811df156-cc18-4579-9a5b-9c932fd499a2&apn_sauid=40AA1AFF-8D25-4554-B408-077202E0064E
SearchScopes: HKCU - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = 
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO-x32: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Dorian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\4sharedCopyLinks.xpi
FF Extension: firefox - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\firefox@ghostery.com.xpi
FF Extension: No Name - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [811064 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
R2 CFMonitor.exe; C:\Program Files (x86)\ControlFilters\CFMonitor.exe [27960 2013-04-11] ()
R2 CFService.exe; C:\Program Files (x86)\ControlFilters\CFService.exe [31032 2013-04-11] ()
R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5784472 2013-04-15] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [158928 2013-04-15] (COMODO)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2094216 2013-05-29] ()
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [85904 2012-09-05] (ELAN Microelectronics Corp.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-11-24] (Dritek System INC.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130016 2013-03-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [83672 2013-07-18] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-04-15] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [712216 2013-04-15] (COMODO)
R1 cmdhlp; C:\Windows\system32\DRIVERS\cmdhlp.sys [37560 2013-04-15] (COMODO)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32000 2013-06-02] ()
R1 inspect; C:\Windows\system32\DRIVERS\inspect.sys [118400 2013-04-15] (COMODO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-11-24] (Dritek System Inc.)
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [x]
S3 X6va014; \??\C:\Windows\SysWOW64\Drivers\X6va014 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-01 11:30 - 2013-09-01 11:30 - 00866817 _____ C:\Users\Dorian\Downloads\avira_fusebundlegen-win32-en.zip
2013-09-01 11:08 - 2013-09-01 11:09 - 00000000 ____D C:\AdwCleaner
2013-09-01 10:58 - 2013-09-01 10:58 - 00000354 _____ C:\Windows\PFRO.log
2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\Malwarebytes
2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-01 10:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-01 10:46 - 2013-09-01 10:46 - 01027511 _____ (Thisisu) C:\Users\Dorian\Desktop\JRT.exe
2013-09-01 10:45 - 2013-09-01 10:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Dorian\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-01 10:45 - 2013-09-01 10:45 - 00994642 _____ C:\Users\Dorian\Desktop\adwcleaner.exe
2013-08-31 22:16 - 2013-08-31 22:17 - 00000000 ____D C:\Users\Dorian\Desktop\QuakeIII
2013-08-31 22:08 - 2013-08-31 22:08 - 00000797 _____ C:\Windows\setupact.log
2013-08-31 22:08 - 2013-08-31 22:08 - 00000000 _____ C:\Windows\setuperr.log
2013-08-31 16:48 - 2013-08-31 16:49 - 00000000 ____D C:\Users\Dorian\Downloads\multimaps
2013-08-31 16:41 - 2013-08-31 16:41 - 00015618 _____ C:\ComboFix.txt
2013-08-31 16:25 - 2013-08-31 16:42 - 00000000 ____D C:\ComboFix
2013-08-31 16:03 - 2013-08-31 16:05 - 25897692 _____ C:\Users\Dorian\Downloads\swine_1.zip
2013-08-31 15:31 - 2013-08-31 16:42 - 00000000 ____D C:\Qoobox
2013-08-31 15:30 - 2013-08-31 16:37 - 00000000 ____D C:\Windows\erdnt
2013-08-31 15:25 - 2013-08-31 15:25 - 05117322 ____R (Swearware) C:\Users\Dorian\Desktop\ComboFix.exe
2013-08-31 14:55 - 2013-09-01 15:04 - 00512471 _____ C:\Windows\WindowsUpdate.log
2013-08-31 14:53 - 2001-08-29 07:36 - 00434176 _____ (DivXNetworks, Inc.) C:\Windows\SysWOW64\divxdec.ax
2013-08-31 14:49 - 2013-08-31 14:49 - 00000000 ____D C:\Program Files (x86)\Stormregion Ltd
2013-08-31 11:44 - 2013-08-31 11:47 - 00040292 _____ C:\Users\Dorian\Desktop\Addition.txt
2013-08-31 11:43 - 2013-08-31 11:43 - 00000000 ____D C:\FRST
2013-08-31 11:42 - 2013-08-31 11:42 - 01587214 _____ (Farbar) C:\Users\Dorian\Desktop\FRST64.exe
2013-08-30 13:53 - 2013-08-30 13:53 - 00000000 ____D C:\Team17
2013-08-26 19:57 - 2013-08-26 19:58 - 00000000 ____D C:\Windows\system32\MRT
2013-08-26 13:53 - 2013-05-24 01:02 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-26 13:53 - 2013-05-24 00:25 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-08-26 13:52 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-26 13:52 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-26 13:52 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-26 13:52 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-26 13:52 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-26 13:52 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-26 13:52 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-26 13:52 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-26 13:52 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-26 13:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-26 13:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-26 13:52 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-08-26 13:52 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-26 13:52 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-26 13:52 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-26 13:52 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2013-08-26 13:52 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2013-08-26 13:52 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-26 13:52 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-26 13:52 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2013-08-26 13:52 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2013-08-26 13:52 - 2013-07-09 08:07 - 02233168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-26 13:52 - 2013-07-02 02:44 - 00036288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2013-08-26 13:52 - 2013-07-02 00:08 - 00247216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2013-08-25 20:37 - 2013-09-01 11:25 - 00006023 _____ C:\Windows\SysWOW64\bufferpool.txt
2013-08-25 14:27 - 2013-08-25 14:32 - 110344048 _____ C:\Users\Dorian\Downloads\avira_free4045_antivirus_de.exe
2013-08-25 13:07 - 2013-08-25 13:08 - 15714204 _____ (diclovit                                                    ) C:\Users\Dorian\Downloads\dmp_1.7.3_setup.exe
2013-08-03 20:18 - 2013-08-03 20:18 - 00003044 _____ C:\Windows\System32\Tasks\{F85BD424-B543-452C-8E8E-4E16EE8FC24A}

==================== One Month Modified Files and Folders =======

2013-09-01 15:04 - 2013-08-31 14:55 - 00512471 _____ C:\Windows\WindowsUpdate.log
2013-09-01 15:02 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-09-01 14:43 - 2013-04-17 18:01 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-01 11:55 - 2013-06-02 15:06 - 00325710 _____ C:\Windows\system32\Drivers\fvstore.dat
2013-09-01 11:30 - 2013-09-01 11:30 - 00866817 _____ C:\Users\Dorian\Downloads\avira_fusebundlegen-win32-en.zip
2013-09-01 11:25 - 2013-08-25 20:37 - 00006023 _____ C:\Windows\SysWOW64\bufferpool.txt
2013-09-01 11:25 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-01 11:21 - 2013-03-25 17:42 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3428012327-743159870-3646233233-1002
2013-09-01 11:09 - 2013-09-01 11:08 - 00000000 ____D C:\AdwCleaner
2013-09-01 11:09 - 2013-03-25 17:35 - 00001001 _____ C:\Users\Dorian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-01 10:58 - 2013-09-01 10:58 - 00000354 _____ C:\Windows\PFRO.log
2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\Malwarebytes
2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-01 10:46 - 2013-09-01 10:46 - 01027511 _____ (Thisisu) C:\Users\Dorian\Desktop\JRT.exe
2013-09-01 10:45 - 2013-09-01 10:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Dorian\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-01 10:45 - 2013-09-01 10:45 - 00994642 _____ C:\Users\Dorian\Desktop\adwcleaner.exe
2013-08-31 22:17 - 2013-08-31 22:16 - 00000000 ____D C:\Users\Dorian\Desktop\QuakeIII
2013-08-31 22:08 - 2013-08-31 22:08 - 00000797 _____ C:\Windows\setupact.log
2013-08-31 22:08 - 2013-08-31 22:08 - 00000000 _____ C:\Windows\setuperr.log
2013-08-31 21:17 - 2013-03-26 15:17 - 00000000 ____D C:\Users\Dorian\Documents\TrackMania
2013-08-31 19:08 - 2013-03-25 18:06 - 00000000 ____D C:\Users\Dorian\AppData\Local\CrashDumps
2013-08-31 19:05 - 2013-03-25 19:27 - 00000000 ____D C:\Program Files (x86)\MicroVolts
2013-08-31 19:03 - 2013-03-26 17:30 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\.minecraft
2013-08-31 17:38 - 2012-11-24 12:38 - 00763140 _____ C:\Windows\system32\perfh007.dat
2013-08-31 17:38 - 2012-11-24 12:38 - 00160234 _____ C:\Windows\system32\perfc007.dat
2013-08-31 17:38 - 2012-07-26 09:28 - 01772590 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-31 17:04 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\NDF
2013-08-31 16:49 - 2013-08-31 16:48 - 00000000 ____D C:\Users\Dorian\Downloads\multimaps
2013-08-31 16:42 - 2013-08-31 16:25 - 00000000 ____D C:\ComboFix
2013-08-31 16:42 - 2013-08-31 15:31 - 00000000 ____D C:\Qoobox
2013-08-31 16:42 - 2013-04-16 15:16 - 00000000 ____D C:\Users\Dorian\Desktop\Meine Dateien
2013-08-31 16:41 - 2013-08-31 16:41 - 00015618 _____ C:\ComboFix.txt
2013-08-31 16:37 - 2013-08-31 15:30 - 00000000 ____D C:\Windows\erdnt
2013-08-31 16:05 - 2013-08-31 16:03 - 25897692 _____ C:\Users\Dorian\Downloads\swine_1.zip
2013-08-31 15:25 - 2013-08-31 15:25 - 05117322 ____R (Swearware) C:\Users\Dorian\Desktop\ComboFix.exe
2013-08-31 15:03 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-31 14:49 - 2013-08-31 14:49 - 00000000 ____D C:\Program Files (x86)\Stormregion Ltd
2013-08-31 14:49 - 2012-11-02 05:40 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-31 11:47 - 2013-08-31 11:44 - 00040292 _____ C:\Users\Dorian\Desktop\Addition.txt
2013-08-31 11:43 - 2013-08-31 11:43 - 00000000 ____D C:\FRST
2013-08-31 11:42 - 2013-08-31 11:42 - 01587214 _____ (Farbar) C:\Users\Dorian\Desktop\FRST64.exe
2013-08-30 23:04 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-08-30 22:34 - 2013-06-01 10:45 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\Skype
2013-08-30 13:53 - 2013-08-30 13:53 - 00000000 ____D C:\Team17
2013-08-29 19:39 - 2013-04-01 19:02 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\TS3Client
2013-08-27 15:58 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-27 15:58 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-26 19:58 - 2013-08-26 19:57 - 00000000 ____D C:\Windows\system32\MRT
2013-08-26 19:57 - 2013-03-26 19:23 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-26 13:46 - 2013-06-02 15:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-26 13:46 - 2013-06-02 15:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-25 14:41 - 2013-03-25 18:07 - 00002030 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-25 14:32 - 2013-08-25 14:27 - 110344048 _____ C:\Users\Dorian\Downloads\avira_free4045_antivirus_de.exe
2013-08-25 13:08 - 2013-08-25 13:07 - 15714204 _____ (diclovit                                                    ) C:\Users\Dorian\Downloads\dmp_1.7.3_setup.exe
2013-08-21 15:43 - 2013-04-17 18:01 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-03 20:18 - 2013-08-03 20:18 - 00003044 _____ C:\Windows\System32\Tasks\{F85BD424-B543-452C-8E8E-4E16EE8FC24A}

Files to move or delete:
====================
C:\Users\Dorian\Opera_1215_int_Setup (1).exe
C:\Users\Dorian\AppData\Local\Temp\i4jdel0.exe
C:\Users\Dorian\AppData\Local\Temp\Quarantine.exe
C:\Users\Dorian\AppData\Local\Temp\jrt\erunt\ERUNT.EXE

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-01 10:40

==================== End Of Log ============================
         

--- --- ---


MfG
AlphA

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?