Windows 7 , PC stürzt immer wieder ab, nach säuberung mit Vipre immer noch viele verdächtig Datein im Autorun

Daniel1988de · 17.12.2013, 04:45

Sehr geehrte Foren Mitglieder,
Ich benutze Windows 7 und in letzter Zeit läuft mein PC sehr langsam. Ich benutze Vipre Antivir und dieser fand auch jede Menge Maleware usw. als ich diese gelöscht hatte stürzte mein PC immer wieder ab bzw nach dem Einschalten war nur ein schwarzer Bildschirm mit Streifen oder Punkten. Jetzt fährt er wieder hoch jedoch kann ich nichts downloaden und im Autrun exe. werden jede Menge mir unbekannter Dateien ausgeführt. Eine davon habe ich gegoogelt und bin auf den Bundestrojaner gestossen.
Jetzt weiss ich leider nicht wie ich weiter vorgehen soll, habe mir auf youtube von semper Video das Video Computer Forensic angeschaut auf dem mit dem Programm Volatility der PC gesäubert wird und der Autor auch ausführt das Antiviren Programme sowie Programme zum Malware löschen recht unbrauchbar sind.
Jetzt bin ich als leider nicht Fachmann ein bischen überfordert und bitte hier um Hilfe und hoffe es nimmt sich jemand meiner an.
Freundliche Grüße Daniel

schrauber · 17.12.2013, 08:26

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Daniel1988de · 17.12.2013, 19:05

hallo schrauber,
vielen vielen dank das du dich meiner angenommen hast

, ich habe nun das Problem das ich von dir besagte Dateine bzw Programme nich downloaden kann da dann kommt...
konnte nicht gespeichert werden, da die quelldatei nicht gelesen werden kann... wie soll ich weiter vorgehen??? woran kann das liegen..
besten dank
daniel

C:\Users\sascha\AppData\Local\Temp\vkV8ZdLm.exe.part konnte nicht gespeichert werden, weil die Quelldatei nicht gelesen werden konnte.

Versuchen Sie es später nochmals oder kontaktieren Sie den Server-Administrator.

so hab es jetzt mit dem i net explorer geladen hier die logfiles...
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2013 01
Ran by sascha (administrator) on SASCHA-PC on 17-12-2013 18:38:59
Running from C:\Users\sascha\Downloads
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
(PowerISO Computing, Inc.) C:\Program Files\PowerISO\PWRISOVM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccApp.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(PC Help Soft) C:\Program Files\PC Cleaner\PCCSmartScan.exe
(PC Help Soft) C:\Program Files\PC Cleaner\PCCReminder.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Sysinternals - www.sysinternals.com) C:\Users\sascha\AppData\Local\Temp\Rar$EX00.258\autoruns.exe
(Microsoft Corporation) C:\Windows\regedit.exe
(MyPCBackup.com) C:\Program Files\MyPC Backup\MyPC Backup.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PWRISOVM.EXE] - C:\Program Files\PowerISO\PWRISOVM.EXE [180224 2010-04-12] (PowerISO Computing, Inc.)
HKLM\...\Run: [] - 0
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.)
HKLM\...\Run: [ccApp] - C:\Program Files\Common Files\Symantec Shared\ccApp.exe [115624 2011-02-03] (Symantec Corporation)
HKLM\...\Run: [SBAMTray] - C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe [1353040 2011-05-11] (Sunbelt Software)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [821144 2010-10-25] (Adobe Systems Inc.)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [36760 2010-10-25] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKCU\...\Run: [Skype] - D:\OutputFolder\Skype\Phone\Skype.exe [26102056 2010-04-05] (Skype Technologies S.A.)
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [{5E4099CE-E7A9-37B5-6D0B-6FB739946CB1}] - C:\Users\sascha\AppData\Roaming\Vuo\vaovant.exe [192883 2013-11-18] ()
HKCU\...\Run: [{D3CF336A-82D3-195F-BCF4-DCAF6BCBCB94}] - C:\Users\sascha\AppData\Roaming\Ocoqti\nepien.exe [192883 2013-09-16] ()
HKCU\...\RunOnce: [17u317aA] - "C:\Users\sascha\AppData\Roaming\17u317aA.exe" opt [883200 2013-12-11] (AVAST Software)
HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1
HKCU\...\Policies\Explorer: [HideSCAHealth] 1
MountPoints2: {863347c5-334e-11e3-99fb-001e8c00353d} - K:\HTC_Sync_Manager_PC.exe
MountPoints2: {d3b2cc41-eea6-11e2-8269-001e8c00353d} - O:\AutoRun.exe
MountPoints2: {d3b2cc4f-eea6-11e2-8269-001e8c00353d} - J:\AutoRun.exe
Startup: C:\Users\sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.chess.com/home
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9256FFF5FC04CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll No File
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: AutorunsDisabled\livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
Handler: AutorunsDisabled\ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
Handler: AutorunsDisabled\msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
Handler: AutorunsDisabled\wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
Handler: AutorunsDisabled\wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default
FF user.js: detected! => C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\user.js
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SelectedSearchEngine: search
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @Allin1Convert_8h.com/Plugin - C:\Program Files\Allin1Convert_8h\bar\1.bin\NP8hStub.dll No File
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.450 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll No File
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\sascha\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\sascha\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\searchplugins\search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Allin1Convert - C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\Extensions\8hffxtbr@Allin1Convert_8h.com
FF Extension: Default Manager - C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\Extensions\DefaultManager@Microsoft
FF Extension: toolbar - C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\Extensions\toolbar@gmx.net.xpi
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchKeyword: google.de
CHR DefaultSearchProvider: Google
CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}
CHR Plugin: (Shockwave Flash) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\sascha\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Extension: (Google Wallet) - C:\Users\sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

========================== Services (Whitelisted) =================

S2 BackupStack; C:\Program Files\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
R2 ccEvtMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108456 2011-02-03] (Symantec Corporation)
R2 ccSetMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108456 2011-02-03] (Symantec Corporation)
S3 LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093944 2011-01-19] (Symantec Corporation)
R2 LVCOMSer; C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe [186904 2008-07-26] (Logitech Inc.)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [11736 2011-04-27] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [208944 2011-04-27] (Microsoft Corporation)
R2 SBAMSvc; C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe [2804280 2011-05-11] (Sunbelt Software)
R2 SBPIMSvc; C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe [181584 2011-05-11] (Sunbelt Software)
R2 SmcService; C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe [1893840 2011-03-07] (Symantec Corporation)
R2 SNAC; C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE [357792 2011-02-18] (Symantec Corporation)
S4 Allin1Convert_8hService; C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbarsvc.exe [x]
S4 gusvc; "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" [x]
S4 Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe /RunAsService [x]

==================== Drivers (Whitelisted) ====================

S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25624 2008-07-26] ()
S3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41752 2008-07-26] (Logitech Inc.)
R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [165648 2011-04-18] (Microsoft Corporation)
S3 MpNWMon; C:\Windows\System32\DRIVERS\MpNWMon.sys [43392 2011-04-18] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 pepifilter; C:\Windows\System32\DRIVERS\lv302af.sys [13848 2008-07-26] (Logitech Inc.)
S3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [2570520 2008-07-26] (Logitech Inc.)
R2 sbapifs; C:\Windows\System32\DRIVERS\sbapifs.sys [74968 2011-05-11] (Sunbelt Software)
R1 SbFw; C:\Windows\System32\drivers\SbFw.sys [221784 2011-04-05] (Sunbelt Software, Inc.)
S3 SBFWIMCL; C:\Windows\System32\DRIVERS\sbfwim.sys [69208 2011-02-08] (Sunbelt Software, Inc.)
R3 SBFWIMCLMP; C:\Windows\System32\DRIVERS\SBFWIM.sys [69208 2011-02-08] (Sunbelt Software, Inc.)
S3 SbHips; C:\Windows\System32\drivers\sbhips.sys [94040 2011-04-05] (Sunbelt Software, Inc.)
R1 SBRE; C:\Windows\system32\drivers\SBREdrv.sys [101720 2011-04-29] (Sunbelt Software)
R1 SbTis; C:\Windows\System32\drivers\sbtis.sys [78936 2011-04-05] (Sunbelt Software, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
S4 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S4 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S4 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S4 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-17 18:38 - 2013-12-17 18:39 - 00017657 _____ C:\Users\sascha\Downloads\FRST.txt
2013-12-17 18:36 - 2013-12-17 18:36 - 01061167 _____ (Farbar) C:\Users\sascha\Downloads\FRST (1).exe
2013-12-17 18:36 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Esruexx
2013-12-17 18:36 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Afybxo
2013-12-17 18:33 - 2013-12-17 18:33 - 01061167 _____ (Farbar) C:\Users\sascha\Downloads\FRST.exe
2013-12-17 18:33 - 2013-12-17 18:33 - 00000000 ____D C:\FRST
2013-12-17 17:55 - 2013-12-11 23:27 - 00883200 ___SH (AVAST Software) C:\Users\sascha\AppData\Roaming\17u317aA.exe
2013-12-17 08:04 - 2013-12-17 08:04 - 00001052 _____ C:\Users\sascha\Desktop\MyPC Backup.lnk
2013-12-17 08:04 - 2013-12-17 08:04 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-12-17 08:02 - 2013-12-17 18:25 - 00000000 ____D C:\Users\sascha\Documents\PC Cleaner
2013-12-17 08:02 - 2013-12-17 18:00 - 00000000 ____D C:\Program Files\MyPC Backup
2013-12-17 08:02 - 2013-12-17 08:02 - 00000991 _____ C:\Users\sascha\Desktop\PC Cleaner.lnk
2013-12-17 08:02 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\PC Cleaner
2013-12-17 08:02 - 2013-12-17 08:02 - 00000000 ____D C:\Program Files\PC Cleaner
2013-12-16 22:59 - 2013-12-16 22:59 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Ykwi
2013-12-16 22:59 - 2013-12-16 22:59 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Dyxaub
2013-12-14 21:27 - 2013-12-14 21:27 - 00936448 ___SH (overbe Yieyeles) C:\Users\sascha\AppData\Roaming\93m79w.exe
2013-12-12 08:05 - 2013-12-12 08:05 - 00550371 _____ C:\Users\sascha\Downloads\Autoruns.zip
2013-12-12 07:45 - 2013-12-12 07:50 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\sascha\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-10 13:41 - 2013-12-10 13:41 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Tiin
2013-12-10 13:41 - 2013-12-10 13:41 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Poe
2013-12-08 21:41 - 2013-12-08 21:41 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Qexyf
2013-12-08 21:41 - 2013-12-08 21:41 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Aksuqe
2013-12-08 20:02 - 2013-12-17 18:37 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Eqsyby
2013-12-08 20:02 - 2013-12-08 20:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Vuo
2013-12-07 16:32 - 2013-12-07 16:33 - 00000000 ____D C:\Program Files\Steam
2013-12-06 20:21 - 2013-12-06 20:21 - 00000000 ____D C:\Users\sascha\Documents\Fragmente
2013-12-04 17:50 - 2013-12-04 17:50 - 00131072 ____H C:\Windows\DUMP1a32.DMP
2013-12-04 17:48 - 2013-12-04 17:48 - 00131072 ____H C:\Windows\DUMPea1d.DMP
2013-12-03 16:23 - 2013-12-04 18:43 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Ylwye
2013-12-03 16:23 - 2013-12-03 16:23 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Ocoqti
2013-12-01 21:19 - 2013-12-17 02:07 - 00000090 _____ C:\Users\sascha\AppData\Roaming\netstat.bat
2013-12-01 20:44 - 2013-12-01 20:44 - 00012316 _____ C:\Windows\system32\svchost.daa
2013-12-01 12:23 - 2013-12-01 12:23 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
2013-12-01 12:23 - 2013-12-01 12:23 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-12-01 10:53 - 2013-12-01 10:54 - 182971610 _____ C:\Users\sascha\Desktop\Dj Fabio & Moon.daa
2013-12-01 10:53 - 2013-12-01 10:53 - 09762476 _____ C:\Users\sascha\Desktop\Lebenslauf_Andre.daa
2013-12-01 09:28 - 2013-12-01 09:28 - 16100696 _____ C:\Program Files\Microsoft Analysis Services.daa
2013-12-01 09:28 - 2013-12-01 09:28 - 00593799 _____ C:\Program Files\Google.daa
2013-12-01 09:26 - 2013-12-01 09:26 - 00477603 _____ C:\Program Files\Google.rar
2013-11-28 15:25 - 2013-11-28 15:25 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Real
2013-11-28 08:50 - 2013-11-28 08:51 - 02038876 _____ (GnuWin <gnuwin32.sourceforge.net>                           ) C:\Users\sascha\Downloads\sed-4.2.1-setup (1).exe
2013-11-28 08:27 - 2013-11-28 08:27 - 00915368 _____ (Oracle Corporation) C:\Users\sascha\Downloads\chromeinstall-7u45.exe

==================== One Month Modified Files and Folders =======

2013-12-17 18:39 - 2013-12-17 18:38 - 00017657 _____ C:\Users\sascha\Downloads\FRST.txt
2013-12-17 18:37 - 2013-12-08 20:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Eqsyby
2013-12-17 18:36 - 2013-12-17 18:36 - 01061167 _____ (Farbar) C:\Users\sascha\Downloads\FRST (1).exe
2013-12-17 18:36 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Esruexx
2013-12-17 18:36 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Afybxo
2013-12-17 18:33 - 2013-12-17 18:33 - 01061167 _____ (Farbar) C:\Users\sascha\Downloads\FRST.exe
2013-12-17 18:33 - 2013-12-17 18:33 - 00000000 ____D C:\FRST
2013-12-17 18:25 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\Documents\PC Cleaner
2013-12-17 18:23 - 2013-09-19 12:53 - 00003210 _____ C:\Users\sascha\Downloads\tempDownload_30008958-5b12-4470-b727-b9684424852b_1379414403389
2013-12-17 18:08 - 2011-07-26 17:26 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-17 18:02 - 2009-07-14 05:34 - 00014368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-17 18:02 - 2009-07-14 05:34 - 00014368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-17 18:00 - 2013-12-17 08:02 - 00000000 ____D C:\Program Files\MyPC Backup
2013-12-17 17:59 - 2011-04-26 18:42 - 01627612 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-17 17:55 - 2011-09-24 17:03 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Skype
2013-12-17 17:54 - 2011-04-26 21:12 - 00073422 _____ C:\Windows\PFRO.log
2013-12-17 17:54 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-17 17:54 - 2009-07-14 05:39 - 00084217 _____ C:\Windows\setupact.log
2013-12-17 09:20 - 2011-07-26 17:36 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3962178414-892835450-1011351265-1000Core.job
2013-12-17 09:20 - 2011-04-27 18:47 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-17 09:20 - 2011-04-27 18:47 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-17 08:04 - 2013-12-17 08:04 - 00001052 _____ C:\Users\sascha\Desktop\MyPC Backup.lnk
2013-12-17 08:04 - 2013-12-17 08:04 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-12-17 08:02 - 2013-12-17 08:02 - 00000991 _____ C:\Users\sascha\Desktop\PC Cleaner.lnk
2013-12-17 08:02 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\PC Cleaner
2013-12-17 08:02 - 2013-12-17 08:02 - 00000000 ____D C:\Program Files\PC Cleaner
2013-12-17 04:04 - 2011-04-26 20:27 - 00114584 _____ C:\Users\sascha\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-17 04:04 - 2009-07-14 05:33 - 00433432 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-17 02:50 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-17 02:50 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-12-17 02:50 - 2009-07-14 03:04 - 00000557 _____ C:\Windows\win.ini
2013-12-17 02:07 - 2013-12-01 21:19 - 00000090 _____ C:\Users\sascha\AppData\Roaming\netstat.bat
2013-12-16 22:59 - 2013-12-16 22:59 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Ykwi
2013-12-16 22:59 - 2013-12-16 22:59 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Dyxaub
2013-12-15 02:43 - 2011-04-26 20:45 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-12-15 02:38 - 2011-04-26 20:45 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Adobe
2013-12-14 21:27 - 2013-12-14 21:27 - 00936448 ___SH (overbe Yieyeles) C:\Users\sascha\AppData\Roaming\93m79w.exe
2013-12-12 08:05 - 2013-12-12 08:05 - 00550371 _____ C:\Users\sascha\Downloads\Autoruns.zip
2013-12-12 07:50 - 2013-12-12 07:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\sascha\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-11 23:27 - 2013-12-17 17:55 - 00883200 ___SH (AVAST Software) C:\Users\sascha\AppData\Roaming\17u317aA.exe
2013-12-10 13:41 - 2013-12-10 13:41 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Tiin
2013-12-10 13:41 - 2013-12-10 13:41 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Poe
2013-12-08 21:41 - 2013-12-08 21:41 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Qexyf
2013-12-08 21:41 - 2013-12-08 21:41 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Aksuqe
2013-12-08 20:02 - 2013-12-08 20:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Vuo
2013-12-07 16:33 - 2013-12-07 16:32 - 00000000 ____D C:\Program Files\Steam
2013-12-06 20:21 - 2013-12-06 20:21 - 00000000 ____D C:\Users\sascha\Documents\Fragmente
2013-12-04 18:43 - 2013-12-03 16:23 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Ylwye
2013-12-04 17:50 - 2013-12-04 17:50 - 00131072 ____H C:\Windows\DUMP1a32.DMP
2013-12-04 17:48 - 2013-12-04 17:48 - 00131072 ____H C:\Windows\DUMPea1d.DMP
2013-12-03 16:23 - 2013-12-03 16:23 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Ocoqti
2013-12-03 15:34 - 2011-04-26 17:47 - 01135458 _____ C:\Windows\WindowsUpdate.log
2013-12-01 22:10 - 2011-09-29 17:04 - 00000042 _____ C:\SfeErrors.txt
2013-12-01 21:29 - 2011-04-26 20:56 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2013-12-01 20:44 - 2013-12-01 20:44 - 00012316 _____ C:\Windows\system32\svchost.daa
2013-12-01 12:28 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-12-01 12:23 - 2013-12-01 12:23 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
2013-12-01 12:23 - 2013-12-01 12:23 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-12-01 10:54 - 2013-12-01 10:53 - 182971610 _____ C:\Users\sascha\Desktop\Dj Fabio & Moon.daa
2013-12-01 10:53 - 2013-12-01 10:53 - 09762476 _____ C:\Users\sascha\Desktop\Lebenslauf_Andre.daa
2013-12-01 10:51 - 2013-09-19 13:04 - 00000000 ____D C:\Users\sascha\Desktop\Lebenslauf_Andre
2013-12-01 10:51 - 2013-09-04 12:42 - 00000000 ____D C:\Users\sascha\Desktop\Dj Fabio & Moon
2013-12-01 10:49 - 2011-07-26 18:20 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-12-01 10:10 - 2011-04-27 18:47 - 00000000 ____D C:\Program Files\Google
2013-12-01 09:30 - 2011-04-26 20:27 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-12-01 09:28 - 2013-12-01 09:28 - 16100696 _____ C:\Program Files\Microsoft Analysis Services.daa
2013-12-01 09:28 - 2013-12-01 09:28 - 00593799 _____ C:\Program Files\Google.daa
2013-12-01 09:26 - 2013-12-01 09:26 - 00477603 _____ C:\Program Files\Google.rar
2013-12-01 09:15 - 2011-09-27 13:34 - 00000000 ____D C:\Program Files\Common Files\LogiShrd
2013-12-01 09:15 - 2011-04-26 20:22 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-12-01 09:11 - 2011-08-14 21:32 - 00000000 ____D C:\Program Files\Bonjour
2013-11-30 18:51 - 2011-04-27 17:51 - 00000000 ____D C:\Users\sascha\AppData\Local\Windows Live
2013-11-30 09:07 - 2011-04-26 20:59 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-28 20:06 - 2011-04-28 10:38 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Mozilla
2013-11-28 15:25 - 2013-11-28 15:25 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Real
2013-11-28 12:07 - 2011-07-26 17:20 - 00000000 ____D C:\Users\sascha\AppData\Roaming\MozillaControl
2013-11-28 08:51 - 2013-11-28 08:50 - 02038876 _____ (GnuWin <gnuwin32.sourceforge.net>                           ) C:\Users\sascha\Downloads\sed-4.2.1-setup (1).exe
2013-11-28 08:27 - 2013-11-28 08:27 - 00915368 _____ (Oracle Corporation) C:\Users\sascha\Downloads\chromeinstall-7u45.exe
2013-11-28 07:58 - 2011-04-26 20:08 - 00000000 ____D C:\Users\sascha\AppData\Roaming\IDM
2013-11-28 07:58 - 2011-04-26 20:08 - 00000000 ____D C:\Program Files\Internet Download Manager
2013-11-19 03:33 - 2011-04-27 17:31 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Files to move or delete:
====================
C:\ProgramData\dxqzbli.exe
C:\Users\sascha\winx-hd-converter-deluxe.exe


Some content of TEMP:
====================
C:\Users\sascha\AppData\Local\Temp\BackupSetup.exe
C:\Users\sascha\AppData\Local\Temp\msi14415.exe
C:\Users\sascha\AppData\Local\Temp\msi1762.exe
C:\Users\sascha\AppData\Local\Temp\msi2901.exe
C:\Users\sascha\AppData\Local\Temp\msi39345.exe
C:\Users\sascha\AppData\Local\Temp\msi41841.exe
C:\Users\sascha\AppData\Local\Temp\msi54695.exe
C:\Users\sascha\AppData\Local\Temp\msi57829.exe
C:\Users\sascha\AppData\Local\Temp\msi59139.exe
C:\Users\sascha\AppData\Local\Temp\msi60996.exe
C:\Users\sascha\AppData\Local\Temp\msi8548.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-12 03:18

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

und hier der addition.txt

dditional scan result of Farbar Recovery Scan Tool (x86) Version: 17-12-2013 01
Ran by sascha at 2013-12-17 18:39:54
Running from C:\Users\sascha\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Microsoft Security Essentials (Disabled - Up to date) {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Sunbelt VIPRE (Enabled - Up to date) {BE5DD172-7F42-7948-1A60-E6A720288F81}
AS: Microsoft Security Essentials (Disabled - Up to date) {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sunbelt VIPRE (Enabled - Up to date) {053C3096-5978-76C6-20D0-DDD55BAFC53C}
FW: Sunbelt VIPRE (Enabled) {86665057-352D-7810-313F-4F92DEFBC8FA}

==================== Installed Programs ======================

µTorrent (Version: 2.0.2)
Adobe Acrobat X Pro - English, Français, Deutsch (Version: 10.0.0)
Adobe Flash Player 10 ActiveX (Version: 10.3.181.34)
Adobe Flash Player 10 Plugin (Version: 10.3.183.5)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Allin1Convert Internet Explorer Toolbar
Any Video Converter Professional 3.0.7
Apple Application Support (Version: 1.5.0)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (Version: 2.1.3.127)
Bonjour (Version: 2.0.4.0)
BS.Player PRO (Version: 2.57.1048)
ChessBase 11 (Version: 11.0.0.0)
D3DX10 (Version: 15.4.2368.0902)
De-Ascend 1.0 (Version: 1.0)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Deutschland Spielt - Spiele Post (Version: 1.0.3.0)
DEUTSCHLAND SPIELT GAME CENTER (Version: 1.0.0.46)
DivX Web Player (Version: 1.4.1)
eMule
Feedback Tool (Version: 1.2.0)
Fritz 12 (Version: 12.0.0)
'Full Speed' Internet Booster + Performance Tests (Version: 3.3)
GnuWin32: sed-4.2.1 (Version: 4.2.1)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4601.54)
Google Update Helper (Version: 1.3.21.165)
HPSSupply (Version: 140.0.212.0)
iTunes (Version: 10.2.1.1)
Java Auto Updater (Version: 2.0.5.1)
Java(TM) 6 Update 26 (Version: 6.0.260)
Junk Mail filter update (Version: 15.4.3502.0922)
K-Lite Mega Codec Pack 5.6.0 (Version: 5.6.0)
LiveUpdate 3.3 (Symantec Corporation) (Version: 3.3.0.101)
Logitech QuickCam (Version: 11.80.1065)
Logitech QuickCam-Treiberpaket
Luxor Evolved (Version: 1.0.0.0)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Antimalware (Version: 3.0.8402.2)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office Access MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Access MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Groove MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Groove MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office InfoPath MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office InfoPath MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Language Pack 2010 - German/Deutsch (Version: 14.0.7015.1000)
Microsoft Office Language Pack 2010 - Russian/русский (Version: 14.0.7015.1000)
Microsoft Office O MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office O MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook Connector (Version: 14.0.5118.5000)
Microsoft Office Outlook MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Spanish) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Ukrainian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office SharePoint Designer MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office SharePoint Designer MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Office X MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office X MUI (Russian) 2010 (Version: 14.0.7015.1000)
Microsoft Security Client (Version: 2.1.1116.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 2.1.1116.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (Version: 10.0.30319)
Mozilla Firefox 5.0 (x86 de) (Version: 5.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyPC Backup (Version: ) <==== ATTENTION
PC Cleaner v3.2 (Version: 3.2)
PC Speed Maximizer v2.2 (Version: 2.2)
PokerStars
PowerISO (Version: 4.7)
QuickTime (Version: 7.69.80.9)
Revo Uninstaller Pro 2.4.3 (Version: 2.4.3)
Ritter Arthur II - Collectors Edition (Version: 1.0.0.0)
Safari (Version: 5.33.16.0)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition
Shop for HP Supplies (Version: 14.0)
Symantec Network Access Control (Version: 11.0.6300.803)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition
VIPRE Antivirus Premium (Version: 4.0.4194)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3508.1109)
Windows Live Family Safety (Version: 15.4.3502.0922)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
WinRAR
WinUtilities 9.8 Professional Edition
WinX HD Video Converter Deluxe 3.1

==================== Restore Points =========================

15-12-2013 12:24:26 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 03:04 - 2011-04-26 20:52 - 00006897 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 3dns-2.adobe.com #192.150.22.22
127.0.0.1 3dns-3.adobe.com #192.150.14.21
127.0.0.1 3dns-4.adobe.com #192.150.18.247
127.0.0.1 3dns-5.adobe.com #192.150.22.46
127.0.0.1 adobe-dns.adobe.com #192.150.11.30
127.0.0.1 adobe-dns-2.adobe.com #192.150.11.247
127.0.0.1 adobe-dns-3.adobe.com #192.150.22.30
127.0.0.1 adobe.activate.com #69.175.22.26
127.0.0.1 activate.adobe.com #192.150.22.40
127.0.0.1 activate.wip3.adobe.com #192.150.22.40
127.0.0.1 activate.wip4.adobe.com #192.150.22.40
127.0.0.1 activate-sea.adobe.com #192.150.22.40
127.0.0.1 activate-sjc0.adobe.com #192.150.14.69
127.0.0.1 ereg.adobe.com #192.150.18.103
127.0.0.1 ereg.wip3.adobe.com #192.150.18.63
127.0.0.1 ereg.wip4.adobe.com #192.150.18.103
127.0.0.1 practivate.adobe.com #192.150.18.54
127.0.0.1 www.wip3.adobe.com #192.150.8.60
127.0.0.1 Adobe #192.150.18.200
127.0.0.1 www.adobeereg.com #75.125.24.83
127.0.0.1 adobeereg.com #207.66.2.10
127.0.0.1 hl2rcv.adobe.com #192.150.14.174
127.0.0.1 wwis-dubc1-vip30.adobe.com #192.150.8.30
127.0.0.1 wwis-dubc1-vip31.adobe.com #192.150.8.31
127.0.0.1 wwis-dubc1-vip32.adobe.com #192.150.8.32
127.0.0.1 wwis-dubc1-vip33.adobe.com #192.150.8.33
127.0.0.1 wwis-dubc1-vip34.adobe.com #192.150.8.34
127.0.0.1 wwis-dubc1-vip35.adobe.com #192.150.8.35
127.0.0.1 wwis-dubc1-vip36.adobe.com #192.150.8.36

There are 88 more lines.

==================== Scheduled Tasks (whitelisted) =============

Task: {05EE699F-AB25-42D8-8781-558C5D1D2FAD} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 => Rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
Task: {0E12083C-0335-49DB-9542-BA1EC6D83ECC} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 => Rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
Task: {18E6D428-D26C-4169-BEDF-3B5BDDC952F6} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe aepdu.dll,AePduRunUpdate
Task: {1B8443F3-0984-4159-900C-6C37067914FB} - System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector => Rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
Task: {1EC9510D-A439-4950-9399-B6399EDF9EA7} - System32\Tasks\Microsoft\Windows\Autochk\Proxy => Rundll32.exe /d acproxy.dll,PerformAutochkOperations
Task: {50926B4C-A8D1-40D0-80D1-4B3C7B4BD5E1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-27] (Google Inc.)
Task: {5C2C622F-70E9-4194-A7DA-033E827365AD} - System32\Tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange => Rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
Task: {6E9B2A62-8062-4B50-A816-BC9E76DAF196} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation)
Task: {8D2E93E8-6604-418D-9F17-27C2DFE4EB9A} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3962178414-892835450-1011351265-1000Core => C:\Users\sascha\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {9334C323-F100-4656-9BA0-E4AA69C0F9C2} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => Rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
Task: {9DB67D6A-F5F3-47F3-B91E-A2D20C3EA833} - System32\Tasks\WPD\SqmUpload_S-1-5-21-3962178414-892835450-1011351265-1000 => Rundll32.exe portabledeviceapi.dll,#1
Task: {FD6C23A0-2829-42FE-BE78-E71067D9D438} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-27] (Google Inc.)
Task: {FEB8D712-3C19-461A-967C-7D17E4677FCD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3962178414-892835450-1011351265-1000Core.job => C:\Users\sascha\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-25 14:15 - 2010-10-25 14:15 - 00019968 _____ () C:\Program Files\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2008-07-26 07:24 - 2008-07-26 07:24 - 00068120 _____ () C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVCSPS.dll
2013-09-19 23:37 - 2013-09-19 23:37 - 00012288 _____ () C:\Program Files\MyPC Backup\GetText.dll
2013-09-19 23:32 - 2013-09-19 23:32 - 00904704 _____ () C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll
2011-07-26 17:26 - 2011-06-16 05:32 - 01850328 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2011-04-26 19:57 - 2011-08-12 21:32 - 06277280 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32.dll

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SBAMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SBPIMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SmcService => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:
==================
Error: (12/17/2013 03:21:35 AM) (Source: Application Hang) (User: )
Description: Programm autoruns.exe, Version 11.70.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1694

Startzeit: 01cefacc68a96640

Endzeit: 8

Anwendungspfad: C:\Users\sascha\AppData\Local\Temp\Rar$EX01.178\autoruns.exe

Berichts-ID: f20a2e74-66c1-11e3-9066-001e8c00353d

Error: (12/17/2013 03:04:31 AM) (Source: Application Hang) (User: )
Description: Programm autoruns.exe, Version 11.70.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: d6c

Startzeit: 01cefac5b868dd98

Endzeit: 7

Anwendungspfad: C:\Users\sascha\AppData\Local\Temp\Rar$EX02.016\autoruns.exe

Berichts-ID: 8ef41875-66bf-11e3-9066-001e8c00353d

Error: (12/17/2013 02:50:18 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Setup.exe_Microsoft Setup Bootstrapper, Version: 14.0.7011.1000, Zeitstempel: 0x513700af
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x75c02c74
ID des fehlerhaften Prozesses: 0x1508
Startzeit der fehlerhaften Anwendung: 0xSetup.exe_Microsoft Setup Bootstrapper0
Pfad der fehlerhaften Anwendung: Setup.exe_Microsoft Setup Bootstrapper1
Pfad des fehlerhaften Moduls: Setup.exe_Microsoft Setup Bootstrapper2
Berichtskennung: Setup.exe_Microsoft Setup Bootstrapper3

Error: (12/17/2013 02:50:14 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Setup.exe_Microsoft Setup Bootstrapper, Version: 14.0.7011.1000, Zeitstempel: 0x513700af
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x75c02c74
ID des fehlerhaften Prozesses: 0x1508
Startzeit der fehlerhaften Anwendung: 0xSetup.exe_Microsoft Setup Bootstrapper0
Pfad der fehlerhaften Anwendung: Setup.exe_Microsoft Setup Bootstrapper1
Pfad des fehlerhaften Moduls: Setup.exe_Microsoft Setup Bootstrapper2
Berichtskennung: Setup.exe_Microsoft Setup Bootstrapper3

Error: (12/17/2013 00:23:49 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: sdiagnhost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc113
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x762158af
ID des fehlerhaften Prozesses: 0x14a4
Startzeit der fehlerhaften Anwendung: 0xsdiagnhost.exe0
Pfad der fehlerhaften Anwendung: sdiagnhost.exe1
Pfad des fehlerhaften Moduls: sdiagnhost.exe2
Berichtskennung: sdiagnhost.exe3

Error: (12/12/2013 02:08:32 PM) (Source: Application Hang) (User: )
Description: Programm autoruns.exe, Version 11.70.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: aec

Startzeit: 01cef73b1304f656

Endzeit: 16

Anwendungspfad: C:\Users\sascha\AppData\Local\Temp\Rar$EX69.141\autoruns.exe

Berichts-ID: 7e650c9a-632e-11e3-a596-001e8c00353d

Error: (12/12/2013 02:07:07 PM) (Source: Application Hang) (User: )
Description: Programm autoruns.exe, Version 11.70.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 16d4

Startzeit: 01cef70ae364913d

Endzeit: 16

Anwendungspfad: C:\Users\sascha\AppData\Local\Temp\Rar$EX00.038\autoruns.exe

Berichts-ID: 4a8c13a3-632e-11e3-a596-001e8c00353d

Error: (12/12/2013 08:21:40 AM) (Source: Application Hang) (User: )
Description: Programm autoruns.exe, Version 11.70.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 994

Startzeit: 01cef708936674cf

Endzeit: 11

Anwendungspfad: C:\Users\sascha\AppData\Local\Temp\Rar$EX00.180\autoruns.exe

Berichts-ID: 0939c398-62fe-11e3-a596-001e8c00353d

Error: (12/11/2013 03:56:50 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 5.0.0.4183 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1210

Startzeit: 01cef663ddd18dcc

Endzeit: 124

Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe

Berichts-ID: 7321d7ce-6274-11e3-a6ce-001e8c00353d

Error: (12/06/2013 08:14:49 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.

Vorgang:
Generatordaten werden gesammelt

Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {e1c05b9c-9d4d-4349-ad7b-aaba08c446b1}

System errors:
=============
Error: (12/17/2013 05:57:29 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update Service (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (12/17/2013 05:57:29 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update Service (gupdate) erreicht.

Error: (12/17/2013 05:55:38 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.

Error: (12/17/2013 05:55:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Microsoft Antimalware Service" wurde mit folgendem Fehler beendet:
%%-2147017840

Error: (12/17/2013 05:55:34 PM) (Source: Microsoft Antimalware) (User: )
Description: %%860 Real-Time Protection feature has encountered an error and failed.

Feature: %%835

Error Code: 0x80004005

Error description: Unbekannter Fehler

Reason: %%842

Error: (12/17/2013 05:55:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Process Monitor" wurde mit folgendem Fehler beendet:
%%-2147467259

Error: (12/17/2013 05:55:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (12/17/2013 05:55:20 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Computer Backup (MyPC Backup) erreicht.

Error: (12/17/2013 05:54:50 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (12/17/2013 05:54:50 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.

Microsoft Office Sessions:
=========================
Error: (12/17/2013 03:21:35 AM) (Source: Application Hang)(User: )
Description: autoruns.exe11.70.0.0169401cefacc68a966408C:\Users\sascha\AppData\Local\Temp\Rar$EX01.178\autoruns.exef20a2e74-66c1-11e3-9066-001e8c00353d

Error: (12/17/2013 03:04:31 AM) (Source: Application Hang)(User: )
Description: autoruns.exe11.70.0.0d6c01cefac5b868dd987C:\Users\sascha\AppData\Local\Temp\Rar$EX02.016\autoruns.exe8ef41875-66bf-11e3-9066-001e8c00353d

Error: (12/17/2013 02:50:18 AM) (Source: Application Error)(User: )
Description: Setup.exe_Microsoft Setup Bootstrapper14.0.7011.1000513700afunknown0.0.0.000000000c000000575c02c74150801cefaca49b43101C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exeunknown944c2c98-66bd-11e3-9066-001e8c00353d

Error: (12/17/2013 02:50:14 AM) (Source: Application Error)(User: )
Description: Setup.exe_Microsoft Setup Bootstrapper14.0.7011.1000513700afunknown0.0.0.000000000c000000575c02c74150801cefaca49b43101C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exeunknown91af57dd-66bd-11e3-9066-001e8c00353d

Error: (12/17/2013 00:23:49 AM) (Source: Application Error)(User: )
Description: sdiagnhost.exe6.1.7600.163854a5bc113unknown0.0.0.000000000c0000005762158af14a401cefab5dd695e12C:\Windows\System32\sdiagnhost.exeunknown1de729e5-66a9-11e3-9066-001e8c00353d

Error: (12/12/2013 02:08:32 PM) (Source: Application Hang)(User: )
Description: autoruns.exe11.70.0.0aec01cef73b1304f65616C:\Users\sascha\AppData\Local\Temp\Rar$EX69.141\autoruns.exe7e650c9a-632e-11e3-a596-001e8c00353d

Error: (12/12/2013 02:07:07 PM) (Source: Application Hang)(User: )
Description: autoruns.exe11.70.0.016d401cef70ae364913d16C:\Users\sascha\AppData\Local\Temp\Rar$EX00.038\autoruns.exe4a8c13a3-632e-11e3-a596-001e8c00353d

Error: (12/12/2013 08:21:40 AM) (Source: Application Hang)(User: )
Description: autoruns.exe11.70.0.099401cef708936674cf11C:\Users\sascha\AppData\Local\Temp\Rar$EX00.180\autoruns.exe0939c398-62fe-11e3-a596-001e8c00353d

Error: (12/11/2013 03:56:50 PM) (Source: Application Hang)(User: )
Description: firefox.exe5.0.0.4183121001cef663ddd18dcc124C:\Program Files\Mozilla Firefox\firefox.exe7321d7ce-6274-11e3-a6ce-001e8c00353d

Error: (12/06/2013 08:14:49 PM) (Source: VSS)(User: )
Description: 0x80070005, Zugriff verweigert

Vorgang:
Generatordaten werden gesammelt

Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {e1c05b9c-9d4d-4349-ad7b-aaba08c446b1}

==================== Memory info ===========================

Percentage of memory in use: 35%
Total physical RAM: 3327.12 MB
Available physical RAM: 2135.21 MB
Total Pagefile: 6652.52 MB
Available Pagefile: 5151.91 MB
Total Virtual: 2047.88 MB
Available Virtual: 1897.57 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:69.23 GB) (Free:14.8 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Archive) (Fixed) (Total:26.3 GB) (Free:10.59 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (Filme) (Fixed) (Total:465.76 GB) (Free:54.06 GB) NTFS
Drive g: (Musik) (Fixed) (Total:439.45 GB) (Free:299.85 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 23852384)
Partition 1: (Not Active) - (Size=439 GB) - (Type=OF Extended)
Partition 2: (Active) - (Size=26 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 69 GB) (Disk ID: ABBCFECA)
Partition 1: (Active) - (Size=69 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: 30C20F72)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

ich hatte leider wärend des scans das programm autorun laufen, und hatte dort auch bei einigen prozessen das häkchen entfernt also den ..Zugriff verweigert... ???
ich hoffe das macht nix wegen dem ergebnis...
ich versuche mich nur durch das dickicht der programme und anwendungen zu beissen und diese zu verstehen... also welche anwendung wofür und mache mich ständig in tutorials von semper video schlau... aber ehrlich gesagt blick ich noch nich durch

..
da sind übrigens nich nur gelb markierte prozesse mit file not found, sondern auch rot unterlegte wie zb.

WinRAR c:\program files\winrar\rarext.dll 12.12.2009 11:11

WinRAR c:\program files\winrar\rarext.dll 12.12.2009 11:11

der ist doppelt

{5E4099CE-E7A9-37B5-6D0B-6FB739946CB1} c:\users\sascha\appdata\roaming\vuo\vaovant.exe 08.12.2013 18:05

{5E4099CE-E7A9-37B5-6D0B-6FB739946CB1} c:\users\sascha\appdata\roaming\vuo\vaovant.exe 08.12.2013 18:05

{D3CF336A-82D3-195F-BCF4-DCAF6BCBCB94} c:\users\sascha\appdata\roaming\ocoqti\nepien.exe 03.12.2013 12:57

{D3CF336A-82D3-195F-BCF4-DCAF6BCBCB94} c:\users\sascha\appdata\roaming\ocoqti\nepien.exe 03.12.2013 12:57

der vierfach bzw zweimal doppelt

\Microsoft\Windows\NetTrace\GatherNetworkInfo c:\windows\system32\gathernetworkinfo.vbs 10.06.2009 22:19

einfach

und ein prozess bei dem file not found steht und gelb unterlegt .. lässt sich der hacken aber einfach nicht entfernen weil jedes mal autorun abstürzt....
siehe:

ffdshow Audio Decoder File not found: C:\Program Files\K-Lite Codec Pack\ffdshow\ffdshow.ax

ich habe auch die verschiedensten ausführungen bei suchmaschinen über diese prozesse von ganz gefährlich bis save gefunden... weshalb ich echt sehr verwirrt war...
aber mir kommt das irgendwie echt sehr spanisch vor!!! was kann man da jetzt glauben?

Ich danke dir auf jeden Fall vielmals und bitte habe nachsicht mit mir ich gebe mir die größte mühe mich in das thema einzuarbeiten bin jedoch echt ein laie

danke

schrauber · 18.12.2013, 10:34

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Daniel1988de · 19.12.2013, 03:01

#
Combofix Logfile:

Code:

ATTFilter

ComboFix 13-12-18.01 - sascha 18.12.2013  23:17:08.1.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3327.2204 [GMT 1:00]
ausgeführt von:: c:\users\sascha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0RK2FLYF\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Sunbelt VIPRE *Enabled/Updated* {BE5DD172-7F42-7948-1A60-E6A720288F81}
FW: Sunbelt VIPRE *Enabled* {86665057-352D-7810-313F-4F92DEFBC8FA}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Sunbelt VIPRE *Enabled/Updated* {053C3096-5978-76C6-20D0-DDD55BAFC53C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\dxqzbli.exe
c:\programdata\Local Settings\Temp
c:\programdata\Local Settings\Temp\msqanmlp.com
c:\programdata\Local Settings\Temp\msqeaieki.pif
c:\users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\searchplugins\search.xml
c:\users\sascha\AppData\Roaming\MY9c1.exe
c:\users\sascha\AppData\Roaming\Ocoqti
c:\users\sascha\AppData\Roaming\Ocoqti\nepien.exe
c:\users\sascha\AppData\Roaming\Qexyf
c:\users\sascha\AppData\Roaming\Qexyf\ahukef.exe
c:\users\sascha\AppData\Roaming\Tiin
c:\users\sascha\AppData\Roaming\Tiin\ozadas.exe
c:\users\sascha\AppData\Roaming\Vuo\vaovant.exe
c:\users\sascha\AppData\Roaming\Ykwi
c:\users\sascha\AppData\Roaming\Ykwi\xanyte.exe
c:\windows\XSxS
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-11-18 bis 2013-12-18  ))))))))))))))))))))))))))))))
.
.
2013-12-18 22:22 . 2013-12-18 22:22	62576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F9793F19-3D1A-4D2E-9A06-9E320C671F77}\offreg.dll
2013-12-18 22:21 . 2013-12-18 23:26	--------	d-----w-	c:\users\sascha\AppData\Local\temp
2013-12-18 16:25 . 2013-12-18 16:25	--------	d-----w-	c:\windows\LastGood.Tmp
2013-12-17 17:36 . 2013-12-17 17:36	--------	d-----w-	c:\users\sascha\AppData\Roaming\Esruexx
2013-12-17 17:36 . 2013-12-17 17:36	--------	d-----w-	c:\users\sascha\AppData\Roaming\Afybxo
2013-12-17 17:33 . 2013-12-17 17:33	--------	d-----w-	C:\FRST
2013-12-17 07:02 . 2013-12-17 07:02	--------	d-----w-	c:\users\sascha\AppData\Roaming\PC Cleaner
2013-12-17 07:02 . 2013-12-18 06:47	--------	d-----w-	c:\program files\MyPC Backup
2013-12-17 07:02 . 2013-12-17 07:02	--------	d-----w-	c:\program files\PC Cleaner
2013-12-16 21:59 . 2013-12-16 21:59	--------	d-----w-	c:\users\sascha\AppData\Roaming\Dyxaub
2013-12-15 12:15 . 2013-12-18 22:21	--------	d-----w-	c:\programdata\Local Settings
2013-12-14 20:27 . 2013-12-14 20:27	936448	--sha-w-	c:\users\sascha\AppData\Roaming\93m79w.exe
2013-12-10 12:41 . 2013-12-10 12:41	--------	d-----w-	c:\users\sascha\AppData\Roaming\Poe
2013-12-08 20:41 . 2013-12-08 20:41	--------	d-----w-	c:\users\sascha\AppData\Roaming\Aksuqe
2013-12-08 19:02 . 2013-12-18 22:21	--------	d-----w-	c:\users\sascha\AppData\Roaming\Vuo
2013-12-08 19:02 . 2013-12-17 18:40	--------	d-----w-	c:\users\sascha\AppData\Roaming\Eqsyby
2013-12-07 15:32 . 2013-12-07 15:33	--------	d-----w-	c:\program files\Steam
2013-12-03 15:23 . 2013-12-04 17:43	--------	d-----w-	c:\users\sascha\AppData\Roaming\Ylwye
2013-12-01 20:19 . 2013-12-18 22:12	90	----a-w-	c:\users\sascha\AppData\Roaming\netstat.bat
2013-12-01 11:23 . 2013-12-01 11:23	--------	d-----w-	c:\program files\Microsoft Analysis Services
2013-12-01 11:09 . 2013-11-18 00:28	7772552	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F9793F19-3D1A-4D2E-9A06-9E320C671F77}\mpengine.dll
2013-11-30 23:12 . 2013-11-08 01:15	7772552	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DBA55C95-7AA8-45AC-BF36-CB820F8EC459}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 02:33 . 2011-04-27 16:31	230048	------w-	c:\windows\system32\MpSigStub.exe
2013-11-08 01:15 . 2011-04-28 18:05	7772552	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-10-12 07:03 . 2013-11-14 02:01	1767936	----a-w-	c:\windows\system32\wininet.dll
2013-10-12 07:02 . 2013-11-14 02:07	2877952	----a-w-	c:\windows\system32\jscript9.dll
2013-10-12 07:02 . 2013-11-14 02:06	61440	----a-w-	c:\windows\system32\iesetup.dll
2013-10-12 07:02 . 2013-11-14 02:03	109056	----a-w-	c:\windows\system32\iesysprep.dll
2013-10-12 06:08 . 2013-11-14 02:08	2706432	----a-w-	c:\windows\system32\mshtml.tlb
2013-10-12 05:15 . 2013-11-14 02:03	71680	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2013-10-12 02:03 . 2013-11-13 22:54	656896	----a-w-	c:\windows\system32\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 22:54	679424	----a-w-	c:\windows\system32\IKEEXT.DLL
2013-10-12 02:01 . 2013-11-13 22:54	216576	----a-w-	c:\windows\system32\FWPUCLNT.DLL
2013-10-05 19:57 . 2013-11-13 22:53	1168384	----a-w-	c:\windows\system32\crypt32.dll
2013-10-04 01:58 . 2013-11-13 22:59	152576	----a-w-	c:\windows\system32\SmartcardCredentialProvider.dll
2013-10-04 01:56 . 2013-11-13 22:58	168960	----a-w-	c:\windows\system32\credui.dll
2013-10-04 01:56 . 2013-11-13 22:59	1796096	----a-w-	c:\windows\system32\authui.dll
2013-10-03 01:58 . 2013-11-13 22:55	305152	----a-w-	c:\windows\system32\gdi32.dll
2013-09-25 02:01 . 2013-11-13 22:57	136640	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2013-09-25 02:01 . 2013-11-13 22:57	67520	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2013-09-25 01:57 . 2013-11-13 22:56	99840	----a-w-	c:\windows\system32\sspicli.dll
2013-09-25 01:57 . 2013-11-13 22:56	22016	----a-w-	c:\windows\system32\secur32.dll
2013-09-25 01:57 . 2013-11-13 22:58	247808	----a-w-	c:\windows\system32\schannel.dll
2013-09-25 01:56 . 2013-11-13 22:56	220160	----a-w-	c:\windows\system32\ncrypt.dll
2013-09-25 01:56 . 2013-11-13 22:57	1038848	----a-w-	c:\windows\system32\lsasrv.dll
2013-09-25 00:49 . 2013-11-13 22:56	22016	----a-w-	c:\windows\system32\lsass.exe
2013-09-25 00:49 . 2013-11-13 22:55	15872	----a-w-	c:\windows\system32\sspisrv.dll
2011-06-16 04:32 . 2011-07-26 16:26	142296	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="d:\outputfolder\Skype\Phone\Skype.exe" [2010-04-05 26102056]
"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2013-04-22 720064]
"PC Cleaner"="c:\program files\PC Cleaner\PCCLauncher.exe" [2013-06-03 117048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2011-02-03 115624]
"SBAMTray"="c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe" [2011-05-11 1353040]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2010-10-25 821144]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760]
.
c:\users\sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MyPC Backup.lnk - c:\program files\MyPC Backup\MyPC Backup.exe [2013-9-19 1953320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 1 (0x1)
"HideSCAHealth"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"
.
R2 BackupStack;Computer Backup (MyPC Backup);c:\program files\MyPC Backup\BackupStack.exe [2013-09-19 38440]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys [2011-02-08 69208]
R3 SbHips;SbHips;c:\windows\system32\drivers\sbhips.sys [2011-04-05 94040]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R4 Allin1Convert_8hService;Allin1ConvertService;c:\progra~1\ALLIN1~2\bar\1.bin\8hbarsvc.exe [x]
R4 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R4 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R4 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2011-04-05 221784]
S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2011-04-29 101720]
S1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [2011-04-05 78936]
S2 SBAMSvc;VIPRE Antivirus Premium;c:\program files\Sunbelt Software\VIPRE\SBAMSvc.exe [2011-05-11 2804280]
S2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys [2011-05-11 74968]
S2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\VIPRE\SBPIMSvc.exe [2011-05-11 181584]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
S3 SBFWIMCLMP;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\SBFWIM.sys [2011-02-08 69208]
S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
.
Inhalt des "geplante Tasks" Ordners
.
2013-12-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-27 17:47]
.
2013-12-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-27 17:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.chess.com/home
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\
FF - ExtSQL: 2013-11-28 09:15; 8hffxtbr@Allin1Convert_8h.com; c:\users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\extensions\8hffxtbr@Allin1Convert_8h.com
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-{D3CF336A-82D3-195F-BCF4-DCAF6BCBCB94} - c:\users\sascha\AppData\Roaming\Ocoqti\nepien.exe
HKCU-Run-{5E4099CE-E7A9-37B5-6D0B-6FB739946CB1} - c:\users\sascha\AppData\Roaming\Vuo\vaovant.exe
AddRemove-BSPlayerp - c:\program files\Webteh\BSplayerPro\uninstall.exe
AddRemove-eMule - e:\emule\Uninstall.exe
AddRemove-KLiteCodecPack_is1 - c:\program files\K-Lite Codec Pack\unins000.exe
AddRemove-lvdrivers_11.80 - c:\program files\Common Files\LogiShrd\LogiDriverStore\lvdrivers\11.80.1048\LgDrvInst.exe
AddRemove-Microsoft Security Client - c:\program files\Microsoft Security Client\Setup.exe
AddRemove-PC Speed Maximizer_is1 - c:\program files\PC Speed Maximizer\unins000.exe
AddRemove-sed-4.2.1_is1 - c:\program files\GnuWin326\uninstall\unins000.exe
AddRemove-uTorrent - c:\program files\uTorrent\uTorrent.exe
AddRemove-{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\Google\Google Toolbar\Component\GoogleToolbarManager_08875ABF44579E20.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe
c:\program files\Symantec\Symantec Endpoint Protection\SNAC.EXE
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\windows\system32\taskhost.exe
c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\conhost.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\PC Cleaner\PCCSmartScan.exe
c:\program files\PC Cleaner\PCCReminder.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-12-19  00:29:31 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-12-18 23:29
.
Vor Suchlauf: 7 Verzeichnis(se), 16.647.602.176 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 16.982.786.048 Bytes frei
.
- - End Of File - - F2722EF332763360CD8E55C7299D0B4A

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31#

Es tut mir wirklich sehr leid habe wirklich rumprobiert ... leider schreibt er bei dem # zeichen nicht code.... deshalb hab ichs so gepostet... sry .. was mach ma denn da jetzt am besten?

schrauber · 19.12.2013, 13:18

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Daniel1988de · 23.12.2013, 23:13

Malwarebytes Anti-Malware (Test) 1.75.0.1300
Malwarebytes : Free Anti-Malware

Datenbank Version: v2013.12.23.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16476
sascha :: SASCHA-PC [Administrator]

Schutz: Aktiviert

23.12.2013 21:02:46
mbam-log-2013-12-23 (21-02-46).txt

Art des Suchlaufs: Flash-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: Registrierung | Dateisystem | P2P
Durchsuchte Objekte: 178255
Laufzeit: 1 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.23.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16476
sascha :: SASCHA-PC [Administrator]

Schutz: Aktiviert

23.12.2013 21:54:17
mbam-log-2013-12-23 (21-54-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 458772
Laufzeit: 49 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCR\Typelib\{03119103-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.
HKCR\Interface\{23119123-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Qoobox\Quarantine\C\ProgramData\dxqzbli.exe.vir (Trojan.Agent.NR) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqanmlp.com.vir (Trojan.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqeaieki.pif.vir (Trojan.Agent.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\MY9c1.exe.vir (Trojan.FakeAvast) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ocoqti\nepien.exe.vir (Trojan.Inject.NR) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Tiin\ozadas.exe.vir (Trojan.Agent.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ykwi\xanyte.exe.vir (Trojan.Agent.NR) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\sascha\AppData\Roaming\93m79w.exe (Trojan.Agent.FSA89) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\sascha\AppData\Roaming\Afybxo\ebdyyxd.exe (Trojan.Agent.NR) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

schrauber · 24.12.2013, 11:21

Logs bitte immer in Codetags posten, und den Rest bitte noch

Daniel1988de · 26.12.2013, 14:50

Hallo Schrauber ich versuche es jetzt noch mal in die .--Code.---- einzufügen ich weis nich warum da bei mir kein zeichen für code erscheint... sollte es???
Nun der nächste versuch

und vielen Dank nochmal für deine Hilfe

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.23.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16476
sascha :: SASCHA-PC [Administrator]

Schutz: Aktiviert

23.12.2013 21:54:17
mbam-log-2013-12-23 (20-30-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 458772
Laufzeit: 49 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCR\Typelib\{03119103-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.
HKCR\Interface\{23119123-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Qoobox\Quarantine\C\ProgramData\dxqzbli.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqanmlp.com.vir (Trojan.Zbot) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqeaieki.pif.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\MY9c1.exe.vir (Trojan.FakeAvast) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ocoqti\nepien.exe.vir (Trojan.Inject.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Tiin\ozadas.exe.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ykwi\xanyte.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\93m79w.exe (Trojan.Agent.FSA89) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\Afybxo\ebdyyxd.exe (Trojan.Agent.NR) -> Keine Aktion durchgeführt.

(Ende)

Ich weis nicht warum aber bei mir erscheint da eifnach nix im bildschirm wenn ich auf code gehe... da passiert einfach gar nix.. was nun würde es dir ja gerne so posten ...

bb code ist auch an ... habe auch zu dem thema gelesen weis aber nich was ich da umstellen sollte das ich die logfiles in den codes posten kann

Malwarebytes Anti-Malware (Test) 1.75.0.1300
Malwarebytes : Free Anti-Malware

Datenbank Version: v2013.12.23.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16476
sascha :: SASCHA-PC [Administrator]

Schutz: Aktiviert

23.12.2013 21:54:17
mbam-log-2013-12-23 (20-30-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 458772
Laufzeit: 49 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCR\Typelib\{03119103-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.
HKCR\Interface\{23119123-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Qoobox\Quarantine\C\ProgramData\dxqzbli.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqanmlp.com.vir (Trojan.Zbot) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqeaieki.pif.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\MY9c1.exe.vir (Trojan.FakeAvast) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ocoqti\nepien.exe.vir (Trojan.Inject.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Tiin\ozadas.exe.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ykwi\xanyte.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\93m79w.exe (Trojan.Agent.FSA89) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\Afybxo\ebdyyxd.exe (Trojan.Agent.NR) -> Keine Aktion durchgeführt.

(Ende)

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.016 - Bericht erstellt am 26/12/2013 um 14:04:43
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : sascha - SASCHA-PC
# Gestartet von : C:\Users\sascha\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Maximizer
Ordner Gelöscht : C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\Allin1Convert_8h
Datei Gelöscht : C:\Users\sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Allin1Convert_8h.SkinLauncherSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Allin1Convert_8h.SkinLauncherSettings.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Allin1Convert_8h.ToolbarProtector
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Allin1Convert_8h.ToolbarProtector.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{53F6A516-3DCC-48F4-835C-6C670CB39CEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB797681-40E0-11D2-9BD5-0060082AE372}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7CAEFAFC-9A1E-4BCC-94DD-BC7D8D52717A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{27F49273-DE3A-4111-90F9-6C474C37AEFB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7CAEFAFC-9A1E-4BCC-94DD-BC7D8D52717A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7EB7381C-FB01-47FC-9C42-ED64122C1B92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AF60F89A-4645-4381-8C7F-B8FEAB385445}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E4EF697F-434B-4DC7-A464-4412462206DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F99DDD9A-07D0-47AB-86F1-193533DD2C60}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v5.0 (de)

[ Datei : C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.BUTTON_STRUCTURE", "[{\"b\":220475038,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":220475039,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]

-\\ Google Chrome v

[ Datei : C:\Users\sascha\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [3606 octets] - [26/12/2013 14:03:33]
AdwCleaner[S0].txt - [3531 octets] - [26/12/2013 14:04:43]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3591 octets] ##########

--- --- ---

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.016 - Bericht erstellt am 26/12/2013 um 14:24:39
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : sascha - SASCHA-PC
# Gestartet von : C:\Users\sascha\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v5.0 (de)

[ Datei : C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\prefs.js ]


-\\ Google Chrome v

[ Datei : C:\Users\sascha\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [3606 octets] - [26/12/2013 14:03:33]
AdwCleaner[R1].txt - [1126 octets] - [26/12/2013 14:24:39]
AdwCleaner[S0].txt - [3671 octets] - [26/12/2013 14:04:43]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [1246 octets] ##########

--- --- ---

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.23.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16476
sascha :: SASCHA-PC [Administrator]

Schutz: Aktiviert

23.12.2013 21:54:17
mbam-log-2013-12-23 (20-30-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 458772
Laufzeit: 49 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCR\Typelib\{03119103-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.
HKCR\Interface\{23119123-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Qoobox\Quarantine\C\ProgramData\dxqzbli.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqanmlp.com.vir (Trojan.Zbot) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqeaieki.pif.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\MY9c1.exe.vir (Trojan.FakeAvast) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ocoqti\nepien.exe.vir (Trojan.Inject.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Tiin\ozadas.exe.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ykwi\xanyte.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\93m79w.exe (Trojan.Agent.FSA89) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\Afybxo\ebdyyxd.exe (Trojan.Agent.NR) -> Keine Aktion durchgeführt.

(Ende)

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.23.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16476
sascha :: SASCHA-PC [Administrator]

Schutz: Aktiviert

23.12.2013 21:54:17
mbam-log-2013-12-23 (20-30-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 458772
Laufzeit: 49 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCR\Typelib\{03119103-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.
HKCR\Interface\{23119123-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Qoobox\Quarantine\C\ProgramData\dxqzbli.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqanmlp.com.vir (Trojan.Zbot) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqeaieki.pif.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\MY9c1.exe.vir (Trojan.FakeAvast) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ocoqti\nepien.exe.vir (Trojan.Inject.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Tiin\ozadas.exe.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ykwi\xanyte.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\93m79w.exe (Trojan.Agent.FSA89) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\Afybxo\ebdyyxd.exe (Trojan.Agent.NR) -> Keine Aktion durchgeführt.

(Ende)

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.23.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16476
sascha :: SASCHA-PC [Administrator]

Schutz: Aktiviert

23.12.2013 21:54:17
mbam-log-2013-12-23 (20-30-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 458772
Laufzeit: 49 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCR\Typelib\{03119103-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.
HKCR\Interface\{23119123-0854-469D-807A-171568457991} (PUP.Optional.MyScrapNook.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Qoobox\Quarantine\C\ProgramData\dxqzbli.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqanmlp.com.vir (Trojan.Zbot) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\ProgramData\Local Settings\Temp\msqeaieki.pif.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\MY9c1.exe.vir (Trojan.FakeAvast) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ocoqti\nepien.exe.vir (Trojan.Inject.NR) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Tiin\ozadas.exe.vir (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Ykwi\xanyte.exe.vir (Trojan.Agent.NR) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\93m79w.exe (Trojan.Agent.FSA89) -> Keine Aktion durchgeführt.
C:\Users\sascha\AppData\Roaming\Afybxo\ebdyyxd.exe (Trojan.Agent.NR) -> Keine Aktion durchgeführt.

(Ende)

hallo schrauber
frohe weihnachten wünsch ich dir...
hmm bei dem adw cleaner hat des posten in den codes funktioniert ... obwohl auch nix von codes im editorfeld stand... habs jetzt auch bei dem bericht von malewarebytes probiert dort klappts leider net ...

Combofix Logfile:

Code:

ATTFilter

ComboFix 13-12-18.01 - sascha 26.12.2013  14:38:28.2.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3327.2408 [GMT 1:00]
ausgeführt von:: c:\users\sascha\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Sunbelt VIPRE *Disabled/Outdated* {BE5DD172-7F42-7948-1A60-E6A720288F81}
FW: Sunbelt VIPRE *Disabled* {86665057-352D-7810-313F-4F92DEFBC8FA}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Sunbelt VIPRE *Disabled/Outdated* {053C3096-5978-76C6-20D0-DDD55BAFC53C}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-11-26 bis 2013-12-26  ))))))))))))))))))))))))))))))
.
.
2013-12-26 13:42 . 2013-12-26 13:42	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-12-26 13:03 . 2013-12-26 13:24	--------	d-----w-	C:\AdwCleaner
2013-12-24 05:33 . 2013-12-24 05:33	--------	d-----w-	c:\windows\ERUNT
2013-12-23 19:27 . 2013-12-23 19:27	--------	d-----w-	c:\users\sascha\AppData\Roaming\Malwarebytes
2013-12-23 19:26 . 2013-12-23 19:26	--------	d-----w-	c:\programdata\Malwarebytes
2013-12-23 19:26 . 2013-12-23 19:26	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2013-12-23 19:26 . 2013-04-04 13:50	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-12-23 19:26 . 2013-12-23 19:26	--------	d-----w-	c:\users\sascha\AppData\Local\Programs
2013-12-19 19:59 . 2013-11-26 08:16	4243968	----a-w-	c:\windows\system32\jscript9.dll
2013-12-19 02:04 . 2013-05-10 04:56	12625408	----a-w-	c:\windows\system32\wmploc.DLL
2013-12-19 02:04 . 2013-05-10 03:48	164864	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2013-12-19 00:08 . 2013-10-30 02:19	301568	----a-w-	c:\windows\system32\msieftp.dll
2013-12-19 00:08 . 2013-10-19 01:36	159232	----a-w-	c:\windows\system32\imagehlp.dll
2013-12-19 00:08 . 2013-10-12 02:04	121856	----a-w-	c:\windows\system32\wshom.ocx
2013-12-19 00:08 . 2013-10-12 02:03	163840	----a-w-	c:\windows\system32\scrrun.dll
2013-12-19 00:08 . 2013-10-12 01:15	141824	----a-w-	c:\windows\system32\wscript.exe
2013-12-19 00:08 . 2013-10-12 01:15	126976	----a-w-	c:\windows\system32\cscript.exe
2013-12-19 00:08 . 2013-11-23 18:26	417792	----a-w-	c:\windows\system32\WMPhoto.dll
2013-12-19 00:08 . 2013-11-12 02:07	2048	----a-w-	c:\windows\system32\tzres.dll
2013-12-19 00:08 . 2013-10-30 01:27	2349056	----a-w-	c:\windows\system32\win32k.sys
2013-12-19 00:08 . 2013-10-04 01:49	81408	----a-w-	c:\windows\system32\drivers\drmk.sys
2013-12-19 00:08 . 2013-10-04 01:17	177152	----a-w-	c:\windows\system32\drivers\portcls.sys
2013-12-18 22:22 . 2013-12-18 22:22	62576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F9793F19-3D1A-4D2E-9A06-9E320C671F77}\offreg.dll
2013-12-18 22:21 . 2013-12-26 13:42	--------	d-----w-	c:\users\sascha\AppData\Local\temp
2013-12-17 17:36 . 2013-12-23 22:08	--------	d-----w-	c:\users\sascha\AppData\Roaming\Afybxo
2013-12-17 17:36 . 2013-12-17 17:36	--------	d-----w-	c:\users\sascha\AppData\Roaming\Esruexx
2013-12-17 17:33 . 2013-12-17 17:33	--------	d-----w-	C:\FRST
2013-12-17 07:02 . 2013-12-17 07:02	--------	d-----w-	c:\users\sascha\AppData\Roaming\PC Cleaner
2013-12-16 21:59 . 2013-12-16 21:59	--------	d-----w-	c:\users\sascha\AppData\Roaming\Dyxaub
2013-12-15 12:15 . 2013-12-18 22:21	--------	d-----w-	c:\programdata\Local Settings
2013-12-10 12:41 . 2013-12-10 12:41	--------	d-----w-	c:\users\sascha\AppData\Roaming\Poe
2013-12-08 20:41 . 2013-12-08 20:41	--------	d-----w-	c:\users\sascha\AppData\Roaming\Aksuqe
2013-12-08 19:02 . 2013-12-18 22:21	--------	d-----w-	c:\users\sascha\AppData\Roaming\Vuo
2013-12-08 19:02 . 2013-12-17 18:40	--------	d-----w-	c:\users\sascha\AppData\Roaming\Eqsyby
2013-12-07 15:32 . 2013-12-07 15:33	--------	d-----w-	c:\program files\Steam
2013-12-03 15:23 . 2013-12-04 17:43	--------	d-----w-	c:\users\sascha\AppData\Roaming\Ylwye
2013-12-01 20:19 . 2013-12-18 22:12	90	----a-w-	c:\users\sascha\AppData\Roaming\netstat.bat
2013-12-01 11:23 . 2013-12-01 11:23	--------	d-----w-	c:\program files\Microsoft Analysis Services
2013-12-01 11:09 . 2013-11-18 00:28	7772552	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F9793F19-3D1A-4D2E-9A06-9E320C671F77}\mpengine.dll
2013-11-30 23:12 . 2013-11-08 01:15	7772552	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DBA55C95-7AA8-45AC-BF36-CB820F8EC459}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 02:33 . 2011-04-27 16:31	230048	------w-	c:\windows\system32\MpSigStub.exe
2013-11-08 01:15 . 2011-04-28 18:05	7772552	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-10-12 02:03 . 2013-11-13 22:54	656896	----a-w-	c:\windows\system32\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 22:54	679424	----a-w-	c:\windows\system32\IKEEXT.DLL
2013-10-12 02:01 . 2013-11-13 22:54	216576	----a-w-	c:\windows\system32\FWPUCLNT.DLL
2013-10-05 19:57 . 2013-11-13 22:53	1168384	----a-w-	c:\windows\system32\crypt32.dll
2013-10-04 01:58 . 2013-11-13 22:59	152576	----a-w-	c:\windows\system32\SmartcardCredentialProvider.dll
2013-10-04 01:56 . 2013-11-13 22:58	168960	----a-w-	c:\windows\system32\credui.dll
2013-10-04 01:56 . 2013-11-13 22:59	1796096	----a-w-	c:\windows\system32\authui.dll
2013-10-03 01:58 . 2013-11-13 22:55	305152	----a-w-	c:\windows\system32\gdi32.dll
2011-06-16 04:32 . 2011-07-26 16:26	142296	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="d:\outputfolder\Skype\Phone\Skype.exe" [2010-04-05 26102056]
"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2013-04-22 720064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2011-02-03 115624]
"SBAMTray"="c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe" [2011-05-11 1353040]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2010-10-25 821144]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 1 (0x1)
"HideSCAHealth"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"
.
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2013-11-26 108032]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys [2011-02-08 69208]
R3 SbHips;SbHips;c:\windows\system32\drivers\sbhips.sys [2011-04-05 94040]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R4 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R4 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R4 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2011-04-05 221784]
S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2011-04-29 101720]
S1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [2011-04-05 78936]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 SBAMSvc;VIPRE Antivirus Premium;c:\program files\Sunbelt Software\VIPRE\SBAMSvc.exe [2011-05-11 2804280]
S2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys [2011-05-11 74968]
S2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\VIPRE\SBPIMSvc.exe [2011-05-11 181584]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
S3 SBFWIMCLMP;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\SBFWIM.sys [2011-02-08 69208]
S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
.
Inhalt des "geplante Tasks" Ordners
.
2013-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-27 17:47]
.
2013-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-27 17:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.chess.com/home
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-12-26  14:44:12
ComboFix-quarantined-files.txt  2013-12-26 13:44
ComboFix2.txt  2013-12-18 23:29
.
Vor Suchlauf: 13 Verzeichnis(se), 15.364.030.464 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 16.311.910.400 Bytes frei
.
- - End Of File - - D4E6326747FFDCA9E322BFA320804F0A

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 27.12.2013, 10:41

Da stand nit Combofix nochmal, sondern FRST

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Daniel1988de · 15.01.2014, 02:05

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-01-2014
Ran by sascha (administrator) on SASCHA-PC on 15-01-2014 00:07:30
Running from C:\Users\sascha\Downloads
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official downoad link fo FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) ===================

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
(PowerISO Computing, Inc.) C:\Program Files\PowerISO\PWRISOVM.EXE
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccApp.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Logitech Inc.) C:\Program Files\Logitech\Logitech Vid\Vid.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
() C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PWRISOVM.EXE] - C:\Program Files\PowerISO\PWRISOVM.EXE [180224 2010-04-12] (PowerISO Computing, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.)
HKLM\...\Run: [ccApp] - C:\Program Files\Common Files\Symantec Shared\ccApp.exe [115624 2011-02-03] (Symantec Corporation)
HKLM\...\Run: [SBAMTray] - C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe [1353040 2011-05-11] (Sunbelt Software)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [821144 2010-10-25] (Adobe Systems Inc.)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2010-10-25] (Adobe Systems Incorporated)
HKLM\...\Run: [LogitechQuickCamRibbon] - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [Logitech Vid] - C:\Program Files\Logitech\Logitech Vid\vid.exe [5458704 2009-07-16] (Logitech Inc.)
HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1
Startup: C:\Users\sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk
ShortcutTarget: Logitech . Produktregistrierung.lnk -> C:\Program Files\Logitech\Logitech WebCam Software\eReg.exe (Leader Technologies/Logitech)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.chess.com/home
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9256FFF5FC04CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll No File
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.450 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll No File
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\sascha\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\sascha\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Default Manager - C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\Extensions\DefaultManager@Microsoft [2011-10-17]
FF Extension: GMX MailCheck - C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\Extensions\toolbar@gmx.net.xpi [2011-08-27]
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011-04-26]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\sascha\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Extension: (Google Wallet) - C:\Users\sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0 [2013-11-09]

========================== Services (Whitelisted) =================

R2 ccEvtMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108456 2011-02-03] (Symantec Corporation)
R2 ccSetMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108456 2011-02-03] (Symantec Corporation)
S3 LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093944 2011-01-19] (Symantec Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [11736 2011-04-27] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [208944 2011-04-27] (Microsoft Corporation)
R2 SBAMSvc; C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe [2804280 2011-05-11] (Sunbelt Software)
R2 SBPIMSvc; C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe [181584 2011-05-11] (Sunbelt Software)
R2 SmcService; C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe [1893840 2011-03-07] (Symantec Corporation)
R2 SNAC; C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE [357792 2011-02-18] (Symantec Corporation)
S4 gusvc; "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" [x]
S4 Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe /RunAsService [x]

==================== Drivers (Whitelisted) ====================

R3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25752 2009-10-07] ()
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41752 2008-07-26] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [165648 2011-04-18] (Microsoft Corporation)
S3 MpNWMon; C:\Windows\System32\DRIVERS\MpNWMon.sys [43392 2011-04-18] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
R3 pepifilter; C:\Windows\System32\DRIVERS\lv302af.sys [13848 2008-07-26] (Logitech Inc.)
R3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [2570520 2008-07-26] (Logitech Inc.)
R2 sbapifs; C:\Windows\System32\DRIVERS\sbapifs.sys [74968 2011-05-11] (Sunbelt Software)
R1 SbFw; C:\Windows\System32\drivers\SbFw.sys [221784 2011-04-05] (Sunbelt Software, Inc.)
S3 SBFWIMCL; C:\Windows\System32\DRIVERS\sbfwim.sys [69208 2011-02-08] (Sunbelt Software, Inc.)
R3 SBFWIMCLMP; C:\Windows\System32\DRIVERS\SBFWIM.sys [69208 2011-02-08] (Sunbelt Software, Inc.)
S3 SbHips; C:\Windows\System32\drivers\sbhips.sys [94040 2011-04-05] (Sunbelt Software, Inc.)
R1 SBRE; C:\Windows\system32\drivers\SBREdrv.sys [101720 2011-04-29] (Sunbelt Software)
R1 SbTis; C:\Windows\System32\drivers\sbtis.sys [78936 2011-04-05] (Sunbelt Software, Inc.)
S4 catchme; \??\C:\Users\sascha\AppData\Local\Temp\catchme.sys [x]
S4 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S4 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S4 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S4 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys F81BB7E487EDCEAB630A7EE66CF23913
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\system32\drivers\atikmdag.sys 712D8A95E45B070114C5309ADA7358FF
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 77361D72A04F18809D0EFB6CCEB74D4B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 85449EEBE8F8EBD6481EFBF0F352B4EB
C:\Windows\system32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4.sys B5E479EB83707DD698F66953E922042C
C:\Windows\system32\drivers\Dot4Prt.sys CAEFD09B6A6249C53A67D55A9A9FCABF
C:\Windows\System32\DRIVERS\dot4usb.sys CF491FF38D62143203C065260567E2F7
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 71BC35067CABC02C9453AEAA42B2E43E
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys D909075FA72C090F27AA926C32CB4612
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys F286830298323272260332D6ABC905C1
C:\Windows\System32\Drivers\ksecpkg.sys D7C760D57B1656DD748B9E4AB6CB5A51
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\LVPr2Mon.sys 1A7DB7A00A4B0D8DA24CD691A4547291
C:\Windows\System32\DRIVERS\lvrs.sys B895839B8743E400D7C7DAE156F74E7E
C:\Windows\System32\drivers\LVUSBSta.sys 23F8EF78BB9553E465A476F3CEE5CA18
C:\Windows\system32\drivers\mbam.sys 4470E3C1E0C3378E4CAB137893C12C3A
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpFilter.sys FEE0BADED54222E9F1DAE9541212AAB1
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpNWMon.sys 2C3489660D4A8D514C123C3F0D67DF46
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 21F4B24ACFC79A483515BD986DD9043F
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ASACPI.sys D48659BB24C48345D926ECB45C1EBDF5
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NisDrvWFP.sys 7B01C6172CFD0B10116175E09200D4B4
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 5E43D2B0EE64123D4880DFA6626DEFDE
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lv302af.sys A05F0D7419CF4680EEDD5736E6549E7B
C:\Windows\System32\DRIVERS\LV302V32.SYS 4BB5AC2DD485B8EEFCCB977EE66A68AD
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\revoflt.sys B9BB8E2093C1615AD6EA55AD96214354
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\sbapifs.sys 3D6BA67C758735918E323D4D6F64449A
C:\Windows\System32\drivers\SbFw.sys 9C9BCC79AEF0AA97F16766C498002D36
C:\Windows\System32\DRIVERS\sbfwim.sys F27B38D70B7621378161D6F48BE04D2C
C:\Windows\System32\DRIVERS\SBFWIM.sys F27B38D70B7621378161D6F48BE04D2C
C:\Windows\System32\drivers\sbhips.sys 53E5E7DC26BB920B97F258BBD52ABFDC
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\system32\drivers\SBREdrv.sys 0505DA5D357F18A5D42FC5DEDE6BC9A0
C:\Windows\System32\drivers\sbtis.sys 6468E2973E04525DECC105947DDD0D34
C:\Windows\System32\Drivers\SCDEmu.sys 20B2751CD4C8F3FD989739CA661B9F30
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys CA59F7C570AF70BC174F477CFE2D9EE3
C:\Windows\System32\DRIVERS\tcpip.sys CA59F7C570AF70BC174F477CFE2D9EE3
C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys B37B08F2E5EEB1A37E448E09BACE1101
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl.sys D4FB6ECC60A428564BA8768B0E23C0FC
C:\Windows\System32\drivers\usbaudio.sys A1977C315BF5691DA99235AA4A6907AF
C:\Windows\System32\DRIVERS\usbccgp.sys 71D97F1A3CC47A56728F7A400A3F8295
C:\Windows\system32\drivers\usbcir.sys 2352AB5F9F8F097BF9D41D5A4718A041
C:\Windows\System32\DRIVERS\usbehci.sys C4FB8E7ADEA9B5CEEA885A1B504B7E40
C:\Windows\System32\DRIVERS\usbhub.sys 86AA95ACB611001E26CD2C0145F2225A
C:\Windows\system32\drivers\usbohci.sys DCDF9855145A14DFCA0AB32308871961
C:\Windows\system32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\System32\DRIVERS\usbuhci.sys 8E51D04175BAA14C4F79AA5F6D248770
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 25944D2CC49E0A6C581D02A74B7D6645
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF
C:\Windows\System32\DRIVERS\yk62x86.sys B07C5B7EFDF936FF93D4F540938725BE

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-15 00:05 - 2014-01-15 00:06 - 00025629 _____ C:\Users\sascha\Downloads\Addition.txt
2014-01-15 00:04 - 2014-01-15 00:04 - 00000000 ____D C:\Users\sascha\Downloads\FRST-OlderVersion
2014-01-14 23:07 - 2014-01-14 23:07 - 00000000 ____D C:\Users\sascha\AppData\Local\LogiShrd
2014-01-14 22:59 - 2014-01-14 22:59 - 00002100 _____ C:\Users\Public\Desktop\Logitech-Webkamera-Software.lnk
2014-01-14 22:59 - 2014-01-14 22:59 - 00001030 _____ C:\Users\Public\Desktop\Logitech Vid.lnk
2014-01-14 22:59 - 2014-01-14 22:59 - 00000000 ____D C:\ProgramData\LogiShrd
2014-01-14 22:59 - 2014-01-14 22:59 - 00000000 ____D C:\Program Files\Logitech
2014-01-14 19:14 - 2014-01-14 19:14 - 00002687 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-14 19:14 - 2014-01-14 19:14 - 00000000 ___RD C:\Program Files\Skype
2014-01-14 19:14 - 2014-01-14 19:14 - 00000000 ____D C:\Program Files\Common Files\Skype
2014-01-14 19:13 - 2014-01-14 19:14 - 00000000 ____D C:\ProgramData\Skype
2014-01-14 18:55 - 2014-01-14 18:55 - 01551008 _____ (Skype Technologies S.A.) C:\Users\sascha\Downloads\SkypeSetup.exe
2014-01-10 10:59 - 2014-01-10 10:59 - 00000000 ____D C:\Users\sascha\AppData\Local\{ECCFBFD5-1E35-42E7-B770-B0AA22A4C712}
2014-01-10 10:59 - 2014-01-10 10:59 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2014-01-10 09:09 - 2014-01-10 09:09 - 00131072 ____H C:\Windows\DUMPa4a8.DMP
2014-01-09 23:52 - 2014-01-09 23:52 - 00000626 _____ C:\Users\sascha\Desktop\JRT.txt
2014-01-09 23:46 - 2014-01-09 23:50 - 00000000 ___SD C:\ComboFix
2014-01-09 20:06 - 2014-01-09 20:06 - 00000000 ____D C:\ProgramData\Mozilla
2014-01-09 20:06 - 2014-01-09 20:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-26 14:03 - 2014-01-09 23:21 - 00000000 ____D C:\AdwCleaner
2013-12-26 14:02 - 2013-12-26 14:02 - 01233962 _____ C:\Users\sascha\Downloads\adwcleaner.exe
2013-12-24 06:33 - 2013-12-24 06:33 - 00000000 ____D C:\Windows\ERUNT
2013-12-23 23:19 - 2013-12-23 23:19 - 01034531 _____ (Thisisu) C:\Users\sascha\Downloads\JRT.exe
2013-12-23 23:07 - 2013-12-24 12:50 - 00000000 ____D C:\Users\sascha\Downloads\Logfiles Trayce
2013-12-23 20:27 - 2013-12-23 20:27 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Malwarebytes
2013-12-23 20:26 - 2014-01-10 00:43 - 00001074 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-23 20:26 - 2014-01-10 00:43 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-23 20:26 - 2013-12-23 20:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-23 20:26 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-23 20:12 - 2013-12-23 20:14 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\sascha\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-12-19 21:00 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-19 21:00 - 2013-11-26 10:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-19 21:00 - 2013-11-26 09:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-19 21:00 - 2013-11-26 09:52 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-19 21:00 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-19 21:00 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-19 21:00 - 2013-11-26 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-19 21:00 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-19 21:00 - 2013-11-26 09:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-19 21:00 - 2013-11-26 09:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-19 21:00 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-19 21:00 - 2013-11-26 09:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-19 21:00 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-19 21:00 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-19 21:00 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-19 21:00 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-19 20:59 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-19 20:59 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-19 20:59 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-19 03:04 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-19 03:04 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-19 03:01 - 2013-12-19 03:03 - 00009752 _____ C:\Windows\IE11_main.log
2013-12-19 03:01 - 2013-12-19 03:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-19 03:01 - 2013-12-19 03:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-19 03:01 - 2013-12-19 03:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-19 03:01 - 2013-12-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-19 02:35 - 2013-12-19 02:36 - 05154906 ____R (Swearware) C:\Users\sascha\Downloads\ComboFix.exe
2013-12-19 01:08 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-19 01:08 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-19 01:08 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-19 01:08 - 2013-10-30 02:27 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-19 01:08 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-19 01:08 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-19 01:08 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-19 01:08 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-19 01:08 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-19 01:08 - 2013-10-04 02:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-19 01:08 - 2013-10-04 02:17 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-18 23:16 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-18 23:16 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-18 23:16 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-18 23:04 - 2014-01-09 23:46 - 00000000 ____D C:\Qoobox
2013-12-18 23:04 - 2013-12-19 00:28 - 00000000 ____D C:\Windows\erdnt
2013-12-17 18:38 - 2014-01-15 00:07 - 00033326 _____ C:\Users\sascha\Downloads\FRST.txt
2013-12-17 18:36 - 2013-12-23 23:08 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Afybxo
2013-12-17 18:36 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Esruexx
2013-12-17 18:33 - 2014-01-15 00:04 - 01220608 _____ (Farbar) C:\Users\sascha\Downloads\FRST.exe
2013-12-17 18:33 - 2014-01-15 00:04 - 00000000 ____D C:\FRST
2013-12-17 08:02 - 2013-12-17 18:25 - 00000000 ____D C:\Users\sascha\Documents\PC Cleaner
2013-12-17 08:02 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\PC Cleaner
2013-12-16 22:59 - 2013-12-16 22:59 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Dyxaub

==================== One Month Modified Files and Folders =======

2014-01-15 00:07 - 2013-12-17 18:38 - 00033326 _____ C:\Users\sascha\Downloads\FRST.txt
2014-01-15 00:06 - 2014-01-15 00:05 - 00025629 _____ C:\Users\sascha\Downloads\Addition.txt
2014-01-15 00:04 - 2014-01-15 00:04 - 00000000 ____D C:\Users\sascha\Downloads\FRST-OlderVersion
2014-01-15 00:04 - 2013-12-17 18:33 - 01220608 _____ (Farbar) C:\Users\sascha\Downloads\FRST.exe
2014-01-15 00:04 - 2013-12-17 18:33 - 00000000 ____D C:\FRST
2014-01-15 00:02 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2014-01-14 23:14 - 2009-07-14 05:34 - 00014368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-14 23:14 - 2009-07-14 05:34 - 00014368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-14 23:11 - 2011-04-26 18:42 - 01627612 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-14 23:11 - 2011-04-26 17:47 - 01342365 _____ C:\Windows\WindowsUpdate.log
2014-01-14 23:10 - 2011-04-27 18:47 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-14 23:07 - 2014-01-14 23:07 - 00000000 ____D C:\Users\sascha\AppData\Local\LogiShrd
2014-01-14 23:07 - 2011-07-28 15:15 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2014-01-14 23:07 - 2011-04-27 18:47 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-14 23:07 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-14 23:07 - 2009-07-14 05:39 - 00087064 _____ C:\Windows\setupact.log
2014-01-14 22:59 - 2014-01-14 22:59 - 00002100 _____ C:\Users\Public\Desktop\Logitech-Webkamera-Software.lnk
2014-01-14 22:59 - 2014-01-14 22:59 - 00001030 _____ C:\Users\Public\Desktop\Logitech Vid.lnk
2014-01-14 22:59 - 2014-01-14 22:59 - 00000000 ____D C:\ProgramData\LogiShrd
2014-01-14 22:59 - 2014-01-14 22:59 - 00000000 ____D C:\Program Files\Logitech
2014-01-14 22:59 - 2011-09-27 13:34 - 00000000 ____D C:\Program Files\Common Files\LogiShrd
2014-01-14 22:59 - 2011-09-24 17:03 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Skype
2014-01-14 19:35 - 2013-09-04 13:34 - 00010333 _____ C:\Windows\system32\lvcoinst.log
2014-01-14 19:14 - 2014-01-14 19:14 - 00002687 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-14 19:14 - 2014-01-14 19:14 - 00000000 ___RD C:\Program Files\Skype
2014-01-14 19:14 - 2014-01-14 19:14 - 00000000 ____D C:\Program Files\Common Files\Skype
2014-01-14 19:14 - 2014-01-14 19:13 - 00000000 ____D C:\ProgramData\Skype
2014-01-14 18:55 - 2014-01-14 18:55 - 01551008 _____ (Skype Technologies S.A.) C:\Users\sascha\Downloads\SkypeSetup.exe
2014-01-14 17:22 - 2011-07-26 17:26 - 00000000 ____D C:\Program Files\Mozilla Firefox
2014-01-10 10:59 - 2014-01-10 10:59 - 00000000 ____D C:\Users\sascha\AppData\Local\{ECCFBFD5-1E35-42E7-B770-B0AA22A4C712}
2014-01-10 10:59 - 2014-01-10 10:59 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2014-01-10 09:09 - 2014-01-10 09:09 - 00131072 ____H C:\Windows\DUMPa4a8.DMP
2014-01-10 01:53 - 2011-04-26 21:12 - 00084820 _____ C:\Windows\PFRO.log
2014-01-10 01:43 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF
2014-01-10 00:43 - 2013-12-23 20:26 - 00001074 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-10 00:43 - 2013-12-23 20:26 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-09 23:52 - 2014-01-09 23:52 - 00000626 _____ C:\Users\sascha\Desktop\JRT.txt
2014-01-09 23:50 - 2014-01-09 23:46 - 00000000 ___SD C:\ComboFix
2014-01-09 23:46 - 2013-12-18 23:04 - 00000000 ____D C:\Qoobox
2014-01-09 23:21 - 2013-12-26 14:03 - 00000000 ____D C:\AdwCleaner
2014-01-09 20:06 - 2014-01-09 20:06 - 00000000 ____D C:\ProgramData\Mozilla
2014-01-09 20:06 - 2014-01-09 20:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-26 14:42 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-12-26 14:02 - 2013-12-26 14:02 - 01233962 _____ C:\Users\sascha\Downloads\adwcleaner.exe
2013-12-24 12:50 - 2013-12-23 23:07 - 00000000 ____D C:\Users\sascha\Downloads\Logfiles Trayce
2013-12-24 06:33 - 2013-12-24 06:33 - 00000000 ____D C:\Windows\ERUNT
2013-12-24 03:07 - 2009-07-14 09:47 - 00000000 ____D C:\Windows\de-DE
2013-12-24 03:07 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Cursors
2013-12-23 23:19 - 2013-12-23 23:19 - 01034531 _____ (Thisisu) C:\Users\sascha\Downloads\JRT.exe
2013-12-23 23:08 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Afybxo
2013-12-23 20:27 - 2013-12-23 20:27 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Malwarebytes
2013-12-23 20:26 - 2013-12-23 20:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-23 20:14 - 2013-12-23 20:12 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\sascha\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-12-19 20:21 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-12-19 18:27 - 2009-07-14 05:33 - 00433432 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-19 03:13 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-12-19 03:05 - 2011-04-26 20:59 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-19 03:03 - 2013-12-19 03:01 - 00009752 _____ C:\Windows\IE11_main.log
2013-12-19 03:01 - 2013-12-19 03:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-19 03:01 - 2013-12-19 03:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-19 03:01 - 2013-12-19 03:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-19 03:01 - 2013-12-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-19 02:36 - 2013-12-19 02:35 - 05154906 ____R (Swearware) C:\Users\sascha\Downloads\ComboFix.exe
2013-12-19 00:29 - 2011-04-27 16:20 - 00000000 ____D C:\Users\lll
2013-12-19 00:29 - 2009-07-14 03:37 - 00000000 __RHD C:\Users\Default
2013-12-19 00:29 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2013-12-19 00:28 - 2013-12-18 23:04 - 00000000 ____D C:\Windows\erdnt
2013-12-18 23:21 - 2013-12-08 20:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Vuo
2013-12-18 23:12 - 2013-12-01 21:19 - 00000090 _____ C:\Users\sascha\AppData\Roaming\netstat.bat
2013-12-17 19:40 - 2013-12-08 20:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Eqsyby
2013-12-17 18:36 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Esruexx
2013-12-17 18:25 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\Documents\PC Cleaner
2013-12-17 08:02 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\PC Cleaner
2013-12-17 04:04 - 2011-04-26 20:27 - 00114584 _____ C:\Users\sascha\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-17 02:50 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-17 02:50 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-12-17 02:50 - 2009-07-14 03:04 - 00000557 _____ C:\Windows\win.ini
2013-12-16 22:59 - 2013-12-16 22:59 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Dyxaub

Files to move or delete:
====================
C:\Users\sascha\winx-hd-converter-deluxe.exe


Some content of TEMP:
====================
C:\Users\sascha\AppData\Local\temp\catchme.dll
C:\Users\sascha\AppData\Local\temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=C:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {current}
resumeobject            {801ab860-7072-11e0-a112-cc8b9be26a7d}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows-Startladeprogramm
-------------------------
Bezeichner              {801ab85e-7072-11e0-a112-cc8b9be26a7d}
device                  ramdisk=[C:]\Recovery\801ab85e-7072-11e0-a112-cc8b9be26a7d\Winre.wim,{801ab85f-7072-11e0-a112-cc8b9be26a7d}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\801ab85e-7072-11e0-a112-cc8b9be26a7d\Winre.wim,{801ab85f-7072-11e0-a112-cc8b9be26a7d}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {801ab862-7072-11e0-a112-cc8b9be26a7d}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {801ab860-7072-11e0-a112-cc8b9be26a7d}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {801ab862-7072-11e0-a112-cc8b9be26a7d}
device                  ramdisk=[C:]\Recovery\801ab862-7072-11e0-a112-cc8b9be26a7d\Winre.wim,{801ab863-7072-11e0-a112-cc8b9be26a7d}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\801ab862-7072-11e0-a112-cc8b9be26a7d\Winre.wim,{801ab863-7072-11e0-a112-cc8b9be26a7d}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {801ab860-7072-11e0-a112-cc8b9be26a7d}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                     Yes
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Geräteoptionen
--------------
Bezeichner              {801ab85f-7072-11e0-a112-cc8b9be26a7d}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\801ab85e-7072-11e0-a112-cc8b9be26a7d\boot.sdi

Geräteoptionen
--------------
Bezeichner              {801ab863-7072-11e0-a112-cc8b9be26a7d}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\801ab862-7072-11e0-a112-cc8b9be26a7d\boot.sdi



LastRegBack: 2014-01-09 04:12

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-01-2014
Ran by sascha at 2014-01-15 00:08:00
Running from C:\Users\sascha\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Disabled - Up to date) {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Sunbelt VIPRE (Enabled - Out of date) {BE5DD172-7F42-7948-1A60-E6A720288F81}
AS: Microsoft Security Essentials (Disabled - Up to date) {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sunbelt VIPRE (Enabled - Out of date) {053C3096-5978-76C6-20D0-DDD55BAFC53C}
FW: Sunbelt VIPRE (Enabled) {86665057-352D-7810-313F-4F92DEFBC8FA}

==================== Installed Programs ======================

Adobe Acrobat X Pro - English, Français, Deutsch (Version: 10.0.0 - Adobe Systems)
Adobe Flash Player 10 ActiveX (Version: 10.3.181.34 - Adobe Systems Incorporated)
Adobe Flash Player 10 Plugin (Version: 10.3.183.5 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05 - Adobe Systems Incorporated)
Any Video Converter Professional 3.0.7 (Version:  - Any-Video-Converter.com)
Apple Application Support (Version: 1.5.0 - Apple Inc.)
Apple Mobile Device Support (Version: 3.4.0.25 - Apple Inc.)
Apple Software Update (Version: 2.1.3.127 - Apple Inc.)
Bonjour (Version: 2.0.4.0 - Apple Inc.)
ChessBase 11 (Version: 11.0.0.0 - ChessBase GmbH)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
De-Ascend 1.0 (Version: 1.0 - )
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (Version:  - Microsoft)
Deutschland Spielt - Spiele Post (Version: 1.0.3.0 - INTENIUM GmbH)
DEUTSCHLAND SPIELT GAME CENTER (Version: 1.0.0.46 - INTENIUM GmbH)
DivX Web Player (Version: 1.4.1 - DivX,Inc.)
Feedback Tool (Version: 1.2.0 - Microsoft Corporation)
Fritz 12 (Version: 12.0.0 - ChessBase)
Fritz 12 (Version: 12.0.0 - ChessBase) Hidden
'Full Speed' Internet Booster + Performance Tests (Version: 3.3 - Versis)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.21.165 - Google Inc.) Hidden
HPSSupply (Version: 140.0.212.0 - Hewlett-Packard) Hidden
iTunes (Version: 10.2.1.1 - Apple Inc.)
Java Auto Updater (Version: 2.0.5.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 26 (Version: 6.0.260 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LiveUpdate 3.3 (Symantec Corporation) (Version: 3.3.0.101 - Symantec Corporation)
Logitech Vid (Version: 1.10.1009 - Logitech Inc.)
Logitech Webcam Software (Version: 12.10.1113 - Logitech Inc.)
Luxor Evolved (Version: 1.0.0.0 - INTENIUM GmbH)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Antimalware (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2010 - German/Deutsch (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2010 - Russian/русский (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office O MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office O MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Ukrainian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office X MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 12.0 (x86 de) (Version: 12.0 - Mozilla)
Mozilla Maintenance Service (Version: 12.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
PokerStars (Version:  - PokerStars)
PowerISO (Version: 4.7 - PowerISO Computing, Inc.)
QuickTime (Version: 7.69.80.9 - Apple Inc.)
Revo Uninstaller Pro 2.4.3 (Version: 2.4.3 - VS Revo Group, Ltd.)
Ritter Arthur II - Collectors Edition (Version: 1.0.0.0 - INTENIUM GmbH)
Safari (Version: 5.33.16.0 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition (Version:  - Microsoft) Hidden
Shop for HP Supplies (Version: 14.0 - HP)
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Symantec Network Access Control (Version: 11.0.6300.803 - Symantec Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (Version:  - Microsoft)
VIPRE Antivirus Premium (Version: 4.0.4194 - Sunbelt Software) Hidden
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (Version: 1.0.0.8 - Microsoft Corp)
WinRAR (Version:  - )
WinUtilities 9.8 Professional Edition (Version:  - YL Computing, Inc)
WinX HD Video Converter Deluxe 3.1 (Version:  - Digiarty Software,Inc.)

==================== Restore Points  =========================

11-01-2014 04:05:45 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 03:04 - 2013-12-19 00:26 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {50926B4C-A8D1-40D0-80D1-4B3C7B4BD5E1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-27] (Google Inc.)
Task: {5709B914-45A5-47F0-8143-B2130DA54826} - System32\Tasks\{8C4F21C0-43AD-4FBE-9B90-771C4E8A6CC2} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.11.0.102/de/eula?source=lightinstaller
Task: {6E9B2A62-8062-4B50-A816-BC9E76DAF196} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation)
Task: {FD6C23A0-2829-42FE-BE78-E71067D9D438} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-27] (Google Inc.)
Task: {FEB8D712-3C19-461A-967C-7D17E4677FCD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-25 14:15 - 2010-10-25 14:15 - 00019968 _____ () C:\Program Files\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2011-01-19 10:20 - 2011-01-19 10:20 - 00308560 _____ () C:\Program Files\Sunbelt Software\VIPRE\Vipre.dll
2011-07-26 18:35 - 2013-10-01 14:16 - 00190752 _____ () C:\Program Files\Sunbelt Software\VIPRE\Definitions\libBase64.dll
2011-07-26 18:35 - 2013-10-01 14:16 - 00178464 _____ () C:\Program Files\Sunbelt Software\VIPRE\Definitions\libMachoUniv.dll
2005-12-22 16:28 - 2005-12-22 16:28 - 00160768 _____ () C:\Program Files\Sunbelt Software\VIPRE\unrar.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 02140944 _____ () C:\Program Files\Logitech\Logitech Vid\QtCore4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 07704336 _____ () C:\Program Files\Logitech\Logitech Vid\QtGui4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00968976 _____ () C:\Program Files\Logitech\Logitech Vid\QtNetwork4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00475408 _____ () C:\Program Files\Logitech\Logitech Vid\QtOpenGL4.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 00363792 _____ () C:\Program Files\Logitech\Logitech Vid\QtXml4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00199952 _____ () C:\Program Files\Logitech\Logitech Vid\QtSql4.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 00027408 _____ () C:\Program Files\Logitech\Logitech Vid\SDL.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 11311888 _____ () C:\Program Files\Logitech\Logitech Vid\QtWebKit4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00291600 _____ () C:\Program Files\Logitech\Logitech Vid\phonon4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00028944 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00035088 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00138000 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
2009-10-14 13:36 - 2009-10-14 13:36 - 00181592 _____ () C:\Program Files\Common Files\LogiShrd\LvApi11\LvApi11.dll
2011-04-26 20:06 - 2009-12-12 14:12 - 00141824 _____ () C:\Program Files\WinRAR\rarext.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:98181191

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SBAMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SBPIMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SmcService => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/14/2014 10:59:16 PM) (Source: Microsoft-Windows-RestartManager) (User: sascha-PC)
Description: Die Anwendung oder der Dienst "LVCOMSer" konnte nicht neu gestartet werden.


System errors:
=============
Error: (01/14/2014 11:09:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update Service (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/14/2014 11:09:46 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update Service (gupdate) erreicht.

Error: (01/14/2014 11:08:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Microsoft Antimalware Service" wurde mit folgendem Fehler beendet: 
%%-2147017840

Error: (01/14/2014 11:08:05 PM) (Source: Microsoft Antimalware) (User: )
Description: %%860 Real-Time Protection feature has encountered an error and failed.

	Feature: %%835

	Error Code: 0x80004005

	Error description: Unbekannter Fehler 

	Reason: %%842

Error: (01/14/2014 11:07:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/14/2014 11:07:37 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.

Error: (01/14/2014 11:07:36 PM) (Source: Microsoft Antimalware) (User: )
Description: %%860 grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.

	Expiration Reason: %%873

	Expiration Date (UTC): ‎14.‎01.‎2014 22:07:36

	Error Code: 0x80092003

	Error Description: Beim Lesen oder Schreiben einer Datei ist ein Fehler aufgetreten.

Error: (01/14/2014 04:59:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update Service (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/14/2014 04:59:25 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update Service (gupdate) erreicht.

Error: (01/14/2014 04:57:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Microsoft Antimalware Service" wurde mit folgendem Fehler beendet: 
%%-2147017840


Microsoft Office Sessions:
=========================
Error: (01/14/2014 10:59:16 PM) (Source: Microsoft-Windows-RestartManager)(User: sascha-PC)
Description: 0LVComSer.exeLVCOMSer03026217823280


==================== Memory info =========================== 

Percentage of memory in use: 28%
Total physical RAM: 3327.12 MB
Available physical RAM: 2375.66 MB
Total Pagefile: 6652.52 MB
Available Pagefile: 5432.92 MB
Total Virtual: 2047.88 MB
Available Virtual: 1902.32 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:69.23 GB) (Free:14.2 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Archive) (Fixed) (Total:26.3 GB) (Free:10.59 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (Filme) (Fixed) (Total:465.76 GB) (Free:70.49 GB) NTFS
Drive g: (Musik) (Fixed) (Total:439.45 GB) (Free:299.85 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: 30C20F72)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 23852384)
Partition 1: (Not Active) - (Size=439 GB) - (Type=OF Extended)
Partition 2: (Active) - (Size=26 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 69 GB) (Disk ID: ABBCFECA)
Partition 1: (Active) - (Size=69 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 466 GB) (Disk ID: 79C62893)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Hallo Schrauber,
ich hoffe du bist gut ins neue Jahr gekommen :=),
ich war kurz im Urlaub jetzt bin ich wieder daheim in München... ich kann dir gar nicht genug danken was du bisher schon für mich getan hast...
hiermit möchte ich dir auf jeden fall nochmal ein dickes DANKESCHÖN ausprechen...
so jetzt klappt es komisc herweise auch mit dem Code zeichen ... das erste mal seit du mir hilfst. Aber ich hab echt nix anderes gemacht als vorher, angeklicktz und jetzt erscheinen sie auch bei mir. Nun gut hier ein frisches FRST log
beste grüße Daniel

Jetzt lass ich noch kurz den ESET Online Scanner durchlaufen.

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=8afa49bb6c3ed74ca3a51faabe6d7e61
# engine=16655
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-15 12:43:51
# local_time=2014-01-15 01:43:51 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=258 16777085 20 95 12969 254484911 0 0
# compatibility_mode=5893 16776574 100 94 2344897 141377822 0 0
# scanned=251025
# found=4
# cleaned=0
# scan_time=3839
sh=0C6E1200DA9201FC85926ED45AB6506185205BAA ft=1 fh=7cfcec5bd19c9ce8 vn="a variant of Win32/Injector.ASZE trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Qexyf\ahukef.exe.vir"
sh=F173D05DC855D320AC138B3D8D72EB5E14B00DEE ft=1 fh=a7bc66cbd19c9ce8 vn="a variant of Win32/Injector.ASZE trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\sascha\AppData\Roaming\Vuo\vaovant.exe.vir"
sh=D5C2FABAA57BDB7F7CDA3BE31BCAE3662F51F599 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.QHT trojan" ac=I fn="C:\Users\sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\4343439a-4cfe5fb9"
sh=486A9F27914328397A3552762A4D000381F6BACE ft=1 fh=ddfcd7748d05d6bf vn="Win32/TrojanDownloader.Autoit.NDV trojan" ac=I fn="D:\WinXHDVideoConverterDeluxe3.1B2010031\winx-hd-converter-deluxe.exe"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.78  
 Windows 7 Service Pack 1 x86 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Microsoft Security Essentials   
Sunbelt VIPRE                   
  (On Access scanning disabled!) 
 Error obtaining update status for antivirus!  
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java(TM) 6 Update 26  
 Java version out of Date! 
 Adobe Flash Player 10 Flash Player out of Date! 
  Adobe Flash Player 	10.3.183.5 Flash Player out of Date!  
 Adobe Reader XI  
 Mozilla Firefox 12.0 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Norton ccSvcHst.exe 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Daniel1988de · 15.01.2014, 02:14

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-01-2014
Ran by sascha (administrator) on SASCHA-PC on 15-01-2014 02:07:01
Running from C:\Users\sascha\Downloads
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official downoad link fo FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) ===================

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
(PowerISO Computing, Inc.) C:\Program Files\PowerISO\PWRISOVM.EXE
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccApp.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Logitech Inc.) C:\Program Files\Logitech\Logitech Vid\Vid.exe
(Sunbelt Software) C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
() C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PWRISOVM.EXE] - C:\Program Files\PowerISO\PWRISOVM.EXE [180224 2010-04-12] (PowerISO Computing, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.)
HKLM\...\Run: [ccApp] - C:\Program Files\Common Files\Symantec Shared\ccApp.exe [115624 2011-02-03] (Symantec Corporation)
HKLM\...\Run: [SBAMTray] - C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe [1353040 2011-05-11] (Sunbelt Software)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [821144 2010-10-25] (Adobe Systems Inc.)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2010-10-25] (Adobe Systems Incorporated)
HKLM\...\Run: [LogitechQuickCamRibbon] - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [Logitech Vid] - C:\Program Files\Logitech\Logitech Vid\vid.exe [5458704 2009-07-16] (Logitech Inc.)
HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1
Startup: C:\Users\sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk
ShortcutTarget: Logitech . Produktregistrierung.lnk -> C:\Program Files\Logitech\Logitech WebCam Software\eReg.exe (Leader Technologies/Logitech)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.chess.com/home
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9256FFF5FC04CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll No File
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.450 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll No File
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\sascha\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\sascha\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Default Manager - C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\Extensions\DefaultManager@Microsoft [2011-10-17]
FF Extension: GMX MailCheck - C:\Users\sascha\AppData\Roaming\Mozilla\Firefox\Profiles\eygw9nn9.default\Extensions\toolbar@gmx.net.xpi [2011-08-27]
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011-04-26]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\sascha\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\sascha\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Extension: (Google Wallet) - C:\Users\sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0 [2013-11-09]

========================== Services (Whitelisted) =================

R2 ccEvtMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108456 2011-02-03] (Symantec Corporation)
R2 ccSetMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108456 2011-02-03] (Symantec Corporation)
S3 LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093944 2011-01-19] (Symantec Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [11736 2011-04-27] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [208944 2011-04-27] (Microsoft Corporation)
R2 SBAMSvc; C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe [2804280 2011-05-11] (Sunbelt Software)
R2 SBPIMSvc; C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe [181584 2011-05-11] (Sunbelt Software)
R2 SmcService; C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe [1893840 2011-03-07] (Symantec Corporation)
R2 SNAC; C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE [357792 2011-02-18] (Symantec Corporation)
S4 gusvc; "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" [x]
S4 Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe /RunAsService [x]

==================== Drivers (Whitelisted) ====================

R3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25752 2009-10-07] ()
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41752 2008-07-26] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [165648 2011-04-18] (Microsoft Corporation)
S3 MpNWMon; C:\Windows\System32\DRIVERS\MpNWMon.sys [43392 2011-04-18] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
R3 pepifilter; C:\Windows\System32\DRIVERS\lv302af.sys [13848 2008-07-26] (Logitech Inc.)
R3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [2570520 2008-07-26] (Logitech Inc.)
R2 sbapifs; C:\Windows\System32\DRIVERS\sbapifs.sys [74968 2011-05-11] (Sunbelt Software)
R1 SbFw; C:\Windows\System32\drivers\SbFw.sys [221784 2011-04-05] (Sunbelt Software, Inc.)
S3 SBFWIMCL; C:\Windows\System32\DRIVERS\sbfwim.sys [69208 2011-02-08] (Sunbelt Software, Inc.)
R3 SBFWIMCLMP; C:\Windows\System32\DRIVERS\SBFWIM.sys [69208 2011-02-08] (Sunbelt Software, Inc.)
S3 SbHips; C:\Windows\System32\drivers\sbhips.sys [94040 2011-04-05] (Sunbelt Software, Inc.)
R1 SBRE; C:\Windows\system32\drivers\SBREdrv.sys [101720 2011-04-29] (Sunbelt Software)
R1 SbTis; C:\Windows\System32\drivers\sbtis.sys [78936 2011-04-05] (Sunbelt Software, Inc.)
S4 catchme; \??\C:\Users\sascha\AppData\Local\Temp\catchme.sys [x]
S4 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S4 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S4 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S4 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys F81BB7E487EDCEAB630A7EE66CF23913
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\system32\drivers\atikmdag.sys 712D8A95E45B070114C5309ADA7358FF
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 77361D72A04F18809D0EFB6CCEB74D4B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 85449EEBE8F8EBD6481EFBF0F352B4EB
C:\Windows\system32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4.sys B5E479EB83707DD698F66953E922042C
C:\Windows\system32\drivers\Dot4Prt.sys CAEFD09B6A6249C53A67D55A9A9FCABF
C:\Windows\System32\DRIVERS\dot4usb.sys CF491FF38D62143203C065260567E2F7
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 71BC35067CABC02C9453AEAA42B2E43E
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys D909075FA72C090F27AA926C32CB4612
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys F286830298323272260332D6ABC905C1
C:\Windows\System32\Drivers\ksecpkg.sys D7C760D57B1656DD748B9E4AB6CB5A51
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\LVPr2Mon.sys 1A7DB7A00A4B0D8DA24CD691A4547291
C:\Windows\System32\DRIVERS\lvrs.sys B895839B8743E400D7C7DAE156F74E7E
C:\Windows\System32\drivers\LVUSBSta.sys 23F8EF78BB9553E465A476F3CEE5CA18
C:\Windows\system32\drivers\mbam.sys 4470E3C1E0C3378E4CAB137893C12C3A
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpFilter.sys FEE0BADED54222E9F1DAE9541212AAB1
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpNWMon.sys 2C3489660D4A8D514C123C3F0D67DF46
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 21F4B24ACFC79A483515BD986DD9043F
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ASACPI.sys D48659BB24C48345D926ECB45C1EBDF5
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NisDrvWFP.sys 7B01C6172CFD0B10116175E09200D4B4
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 5E43D2B0EE64123D4880DFA6626DEFDE
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lv302af.sys A05F0D7419CF4680EEDD5736E6549E7B
C:\Windows\System32\DRIVERS\LV302V32.SYS 4BB5AC2DD485B8EEFCCB977EE66A68AD
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\revoflt.sys B9BB8E2093C1615AD6EA55AD96214354
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\sbapifs.sys 3D6BA67C758735918E323D4D6F64449A
C:\Windows\System32\drivers\SbFw.sys 9C9BCC79AEF0AA97F16766C498002D36
C:\Windows\System32\DRIVERS\sbfwim.sys F27B38D70B7621378161D6F48BE04D2C
C:\Windows\System32\DRIVERS\SBFWIM.sys F27B38D70B7621378161D6F48BE04D2C
C:\Windows\System32\drivers\sbhips.sys 53E5E7DC26BB920B97F258BBD52ABFDC
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\system32\drivers\SBREdrv.sys 0505DA5D357F18A5D42FC5DEDE6BC9A0
C:\Windows\System32\drivers\sbtis.sys 6468E2973E04525DECC105947DDD0D34
C:\Windows\System32\Drivers\SCDEmu.sys 20B2751CD4C8F3FD989739CA661B9F30
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys CA59F7C570AF70BC174F477CFE2D9EE3
C:\Windows\System32\DRIVERS\tcpip.sys CA59F7C570AF70BC174F477CFE2D9EE3
C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys B37B08F2E5EEB1A37E448E09BACE1101
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl.sys D4FB6ECC60A428564BA8768B0E23C0FC
C:\Windows\System32\drivers\usbaudio.sys A1977C315BF5691DA99235AA4A6907AF
C:\Windows\System32\DRIVERS\usbccgp.sys 71D97F1A3CC47A56728F7A400A3F8295
C:\Windows\system32\drivers\usbcir.sys 2352AB5F9F8F097BF9D41D5A4718A041
C:\Windows\System32\DRIVERS\usbehci.sys C4FB8E7ADEA9B5CEEA885A1B504B7E40
C:\Windows\System32\DRIVERS\usbhub.sys 86AA95ACB611001E26CD2C0145F2225A
C:\Windows\system32\drivers\usbohci.sys DCDF9855145A14DFCA0AB32308871961
C:\Windows\system32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\System32\DRIVERS\usbuhci.sys 8E51D04175BAA14C4F79AA5F6D248770
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 25944D2CC49E0A6C581D02A74B7D6645
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF
C:\Windows\System32\DRIVERS\yk62x86.sys B07C5B7EFDF936FF93D4F540938725BE

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-15 02:01 - 2014-01-15 02:01 - 00987410 _____ C:\Users\sascha\Downloads\SecurityCheck.exe
2014-01-15 01:00 - 2014-01-15 01:00 - 00000000 _____ C:\Windows\system32\SBRC.dat
2014-01-15 00:27 - 2014-01-15 00:28 - 02347384 _____ (ESET) C:\Users\sascha\Downloads\esetsmartinstaller_enu.exe
2014-01-15 00:05 - 2014-01-15 00:08 - 00025980 _____ C:\Users\sascha\Downloads\Addition.txt
2014-01-15 00:04 - 2014-01-15 00:04 - 00000000 ____D C:\Users\sascha\Downloads\FRST-OlderVersion
2014-01-14 23:07 - 2014-01-14 23:07 - 00000000 ____D C:\Users\sascha\AppData\Local\LogiShrd
2014-01-14 22:59 - 2014-01-14 22:59 - 00002100 _____ C:\Users\Public\Desktop\Logitech-Webkamera-Software.lnk
2014-01-14 22:59 - 2014-01-14 22:59 - 00001030 _____ C:\Users\Public\Desktop\Logitech Vid.lnk
2014-01-14 22:59 - 2014-01-14 22:59 - 00000000 ____D C:\ProgramData\LogiShrd
2014-01-14 22:59 - 2014-01-14 22:59 - 00000000 ____D C:\Program Files\Logitech
2014-01-14 19:14 - 2014-01-14 19:14 - 00002687 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-14 19:14 - 2014-01-14 19:14 - 00000000 ___RD C:\Program Files\Skype
2014-01-14 19:14 - 2014-01-14 19:14 - 00000000 ____D C:\Program Files\Common Files\Skype
2014-01-14 19:13 - 2014-01-14 19:14 - 00000000 ____D C:\ProgramData\Skype
2014-01-14 18:55 - 2014-01-14 18:55 - 01551008 _____ (Skype Technologies S.A.) C:\Users\sascha\Downloads\SkypeSetup.exe
2014-01-10 10:59 - 2014-01-10 10:59 - 00000000 ____D C:\Users\sascha\AppData\Local\{ECCFBFD5-1E35-42E7-B770-B0AA22A4C712}
2014-01-10 10:59 - 2014-01-10 10:59 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2014-01-10 09:09 - 2014-01-10 09:09 - 00131072 ____H C:\Windows\DUMPa4a8.DMP
2014-01-09 23:52 - 2014-01-09 23:52 - 00000626 _____ C:\Users\sascha\Desktop\JRT.txt
2014-01-09 23:46 - 2014-01-09 23:50 - 00000000 ___SD C:\ComboFix
2014-01-09 20:06 - 2014-01-09 20:06 - 00000000 ____D C:\ProgramData\Mozilla
2014-01-09 20:06 - 2014-01-09 20:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-26 14:03 - 2014-01-09 23:21 - 00000000 ____D C:\AdwCleaner
2013-12-26 14:02 - 2013-12-26 14:02 - 01233962 _____ C:\Users\sascha\Downloads\adwcleaner.exe
2013-12-24 06:33 - 2013-12-24 06:33 - 00000000 ____D C:\Windows\ERUNT
2013-12-23 23:19 - 2013-12-23 23:19 - 01034531 _____ (Thisisu) C:\Users\sascha\Downloads\JRT.exe
2013-12-23 23:07 - 2013-12-24 12:50 - 00000000 ____D C:\Users\sascha\Downloads\Logfiles Trayce
2013-12-23 20:27 - 2013-12-23 20:27 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Malwarebytes
2013-12-23 20:26 - 2014-01-10 00:43 - 00001074 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-23 20:26 - 2014-01-10 00:43 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-23 20:26 - 2013-12-23 20:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-23 20:26 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-23 20:12 - 2013-12-23 20:14 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\sascha\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-12-19 21:00 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-19 21:00 - 2013-11-26 10:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-19 21:00 - 2013-11-26 09:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-19 21:00 - 2013-11-26 09:52 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-19 21:00 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-19 21:00 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-19 21:00 - 2013-11-26 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-19 21:00 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-19 21:00 - 2013-11-26 09:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-19 21:00 - 2013-11-26 09:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-19 21:00 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-19 21:00 - 2013-11-26 09:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-19 21:00 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-19 21:00 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-19 21:00 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-19 21:00 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-19 20:59 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-19 20:59 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-19 20:59 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-19 03:04 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-19 03:04 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-19 03:01 - 2013-12-19 03:03 - 00009752 _____ C:\Windows\IE11_main.log
2013-12-19 03:01 - 2013-12-19 03:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-19 03:01 - 2013-12-19 03:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-19 03:01 - 2013-12-19 03:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-19 03:01 - 2013-12-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-19 02:35 - 2013-12-19 02:36 - 05154906 ____R (Swearware) C:\Users\sascha\Downloads\ComboFix.exe
2013-12-19 01:08 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-19 01:08 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-19 01:08 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-19 01:08 - 2013-10-30 02:27 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-19 01:08 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-19 01:08 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-19 01:08 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-19 01:08 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-19 01:08 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-19 01:08 - 2013-10-04 02:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-19 01:08 - 2013-10-04 02:17 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-18 23:16 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-18 23:16 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-18 23:16 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-18 23:16 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-18 23:04 - 2014-01-09 23:46 - 00000000 ____D C:\Qoobox
2013-12-18 23:04 - 2013-12-19 00:28 - 00000000 ____D C:\Windows\erdnt
2013-12-17 18:38 - 2014-01-15 02:07 - 00033269 _____ C:\Users\sascha\Downloads\FRST.txt
2013-12-17 18:36 - 2013-12-23 23:08 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Afybxo
2013-12-17 18:36 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Esruexx
2013-12-17 18:33 - 2014-01-15 00:04 - 01220608 _____ (Farbar) C:\Users\sascha\Downloads\FRST.exe
2013-12-17 18:33 - 2014-01-15 00:04 - 00000000 ____D C:\FRST
2013-12-17 08:02 - 2013-12-17 18:25 - 00000000 ____D C:\Users\sascha\Documents\PC Cleaner
2013-12-17 08:02 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\PC Cleaner
2013-12-16 22:59 - 2013-12-16 22:59 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Dyxaub

==================== One Month Modified Files and Folders =======

2014-01-15 02:07 - 2013-12-17 18:38 - 00033269 _____ C:\Users\sascha\Downloads\FRST.txt
2014-01-15 02:01 - 2014-01-15 02:01 - 00987410 _____ C:\Users\sascha\Downloads\SecurityCheck.exe
2014-01-15 02:00 - 2011-04-26 17:47 - 01378257 _____ C:\Windows\WindowsUpdate.log
2014-01-15 01:53 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2014-01-15 01:10 - 2011-04-27 18:47 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-15 01:00 - 2014-01-15 01:00 - 00000000 _____ C:\Windows\system32\SBRC.dat
2014-01-15 00:28 - 2014-01-15 00:27 - 02347384 _____ (ESET) C:\Users\sascha\Downloads\esetsmartinstaller_enu.exe
2014-01-15 00:27 - 2011-04-26 18:42 - 01627612 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-15 00:08 - 2014-01-15 00:05 - 00025980 _____ C:\Users\sascha\Downloads\Addition.txt
2014-01-15 00:04 - 2014-01-15 00:04 - 00000000 ____D C:\Users\sascha\Downloads\FRST-OlderVersion
2014-01-15 00:04 - 2013-12-17 18:33 - 01220608 _____ (Farbar) C:\Users\sascha\Downloads\FRST.exe
2014-01-15 00:04 - 2013-12-17 18:33 - 00000000 ____D C:\FRST
2014-01-14 23:14 - 2009-07-14 05:34 - 00014368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-14 23:14 - 2009-07-14 05:34 - 00014368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-14 23:07 - 2014-01-14 23:07 - 00000000 ____D C:\Users\sascha\AppData\Local\LogiShrd
2014-01-14 23:07 - 2011-07-28 15:15 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2014-01-14 23:07 - 2011-04-27 18:47 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-14 23:07 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-14 23:07 - 2009-07-14 05:39 - 00087064 _____ C:\Windows\setupact.log
2014-01-14 22:59 - 2014-01-14 22:59 - 00002100 _____ C:\Users\Public\Desktop\Logitech-Webkamera-Software.lnk
2014-01-14 22:59 - 2014-01-14 22:59 - 00001030 _____ C:\Users\Public\Desktop\Logitech Vid.lnk
2014-01-14 22:59 - 2014-01-14 22:59 - 00000000 ____D C:\ProgramData\LogiShrd
2014-01-14 22:59 - 2014-01-14 22:59 - 00000000 ____D C:\Program Files\Logitech
2014-01-14 22:59 - 2011-09-27 13:34 - 00000000 ____D C:\Program Files\Common Files\LogiShrd
2014-01-14 22:59 - 2011-09-24 17:03 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Skype
2014-01-14 19:35 - 2013-09-04 13:34 - 00010333 _____ C:\Windows\system32\lvcoinst.log
2014-01-14 19:14 - 2014-01-14 19:14 - 00002687 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-14 19:14 - 2014-01-14 19:14 - 00000000 ___RD C:\Program Files\Skype
2014-01-14 19:14 - 2014-01-14 19:14 - 00000000 ____D C:\Program Files\Common Files\Skype
2014-01-14 19:14 - 2014-01-14 19:13 - 00000000 ____D C:\ProgramData\Skype
2014-01-14 18:55 - 2014-01-14 18:55 - 01551008 _____ (Skype Technologies S.A.) C:\Users\sascha\Downloads\SkypeSetup.exe
2014-01-14 17:22 - 2011-07-26 17:26 - 00000000 ____D C:\Program Files\Mozilla Firefox
2014-01-10 10:59 - 2014-01-10 10:59 - 00000000 ____D C:\Users\sascha\AppData\Local\{ECCFBFD5-1E35-42E7-B770-B0AA22A4C712}
2014-01-10 10:59 - 2014-01-10 10:59 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2014-01-10 09:09 - 2014-01-10 09:09 - 00131072 ____H C:\Windows\DUMPa4a8.DMP
2014-01-10 01:53 - 2011-04-26 21:12 - 00084820 _____ C:\Windows\PFRO.log
2014-01-10 01:43 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF
2014-01-10 00:43 - 2013-12-23 20:26 - 00001074 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-10 00:43 - 2013-12-23 20:26 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-09 23:52 - 2014-01-09 23:52 - 00000626 _____ C:\Users\sascha\Desktop\JRT.txt
2014-01-09 23:50 - 2014-01-09 23:46 - 00000000 ___SD C:\ComboFix
2014-01-09 23:46 - 2013-12-18 23:04 - 00000000 ____D C:\Qoobox
2014-01-09 23:21 - 2013-12-26 14:03 - 00000000 ____D C:\AdwCleaner
2014-01-09 20:06 - 2014-01-09 20:06 - 00000000 ____D C:\ProgramData\Mozilla
2014-01-09 20:06 - 2014-01-09 20:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-26 14:42 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-12-26 14:02 - 2013-12-26 14:02 - 01233962 _____ C:\Users\sascha\Downloads\adwcleaner.exe
2013-12-24 12:50 - 2013-12-23 23:07 - 00000000 ____D C:\Users\sascha\Downloads\Logfiles Trayce
2013-12-24 06:33 - 2013-12-24 06:33 - 00000000 ____D C:\Windows\ERUNT
2013-12-24 03:07 - 2009-07-14 09:47 - 00000000 ____D C:\Windows\de-DE
2013-12-24 03:07 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Cursors
2013-12-23 23:19 - 2013-12-23 23:19 - 01034531 _____ (Thisisu) C:\Users\sascha\Downloads\JRT.exe
2013-12-23 23:08 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Afybxo
2013-12-23 20:27 - 2013-12-23 20:27 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Malwarebytes
2013-12-23 20:26 - 2013-12-23 20:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-23 20:14 - 2013-12-23 20:12 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\sascha\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-12-19 20:21 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-12-19 18:27 - 2009-07-14 05:33 - 00433432 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-19 03:13 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-12-19 03:05 - 2011-04-26 20:59 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-19 03:03 - 2013-12-19 03:01 - 00009752 _____ C:\Windows\IE11_main.log
2013-12-19 03:01 - 2013-12-19 03:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-19 03:01 - 2013-12-19 03:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-19 03:01 - 2013-12-19 03:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-19 03:01 - 2013-12-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-19 03:01 - 2013-12-19 03:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-19 03:01 - 2013-12-19 03:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-19 02:36 - 2013-12-19 02:35 - 05154906 ____R (Swearware) C:\Users\sascha\Downloads\ComboFix.exe
2013-12-19 00:29 - 2011-04-27 16:20 - 00000000 ____D C:\Users\lll
2013-12-19 00:29 - 2009-07-14 03:37 - 00000000 __RHD C:\Users\Default
2013-12-19 00:29 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2013-12-19 00:28 - 2013-12-18 23:04 - 00000000 ____D C:\Windows\erdnt
2013-12-18 23:21 - 2013-12-08 20:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Vuo
2013-12-18 23:12 - 2013-12-01 21:19 - 00000090 _____ C:\Users\sascha\AppData\Roaming\netstat.bat
2013-12-17 19:40 - 2013-12-08 20:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Eqsyby
2013-12-17 18:36 - 2013-12-17 18:36 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Esruexx
2013-12-17 18:25 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\Documents\PC Cleaner
2013-12-17 08:02 - 2013-12-17 08:02 - 00000000 ____D C:\Users\sascha\AppData\Roaming\PC Cleaner
2013-12-17 04:04 - 2011-04-26 20:27 - 00114584 _____ C:\Users\sascha\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-17 02:50 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-17 02:50 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-12-17 02:50 - 2009-07-14 03:04 - 00000557 _____ C:\Windows\win.ini
2013-12-16 22:59 - 2013-12-16 22:59 - 00000000 ____D C:\Users\sascha\AppData\Roaming\Dyxaub

Files to move or delete:
====================
C:\Users\sascha\winx-hd-converter-deluxe.exe


Some content of TEMP:
====================
C:\Users\sascha\AppData\Local\temp\catchme.dll
C:\Users\sascha\AppData\Local\temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=C:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {current}
resumeobject            {801ab860-7072-11e0-a112-cc8b9be26a7d}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows-Startladeprogramm
-------------------------
Bezeichner              {801ab85e-7072-11e0-a112-cc8b9be26a7d}
device                  ramdisk=[C:]\Recovery\801ab85e-7072-11e0-a112-cc8b9be26a7d\Winre.wim,{801ab85f-7072-11e0-a112-cc8b9be26a7d}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\801ab85e-7072-11e0-a112-cc8b9be26a7d\Winre.wim,{801ab85f-7072-11e0-a112-cc8b9be26a7d}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {801ab862-7072-11e0-a112-cc8b9be26a7d}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {801ab860-7072-11e0-a112-cc8b9be26a7d}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {801ab862-7072-11e0-a112-cc8b9be26a7d}
device                  ramdisk=[C:]\Recovery\801ab862-7072-11e0-a112-cc8b9be26a7d\Winre.wim,{801ab863-7072-11e0-a112-cc8b9be26a7d}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\801ab862-7072-11e0-a112-cc8b9be26a7d\Winre.wim,{801ab863-7072-11e0-a112-cc8b9be26a7d}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {801ab860-7072-11e0-a112-cc8b9be26a7d}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                     Yes
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Geräteoptionen
--------------
Bezeichner              {801ab85f-7072-11e0-a112-cc8b9be26a7d}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\801ab85e-7072-11e0-a112-cc8b9be26a7d\boot.sdi

Geräteoptionen
--------------
Bezeichner              {801ab863-7072-11e0-a112-cc8b9be26a7d}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\801ab862-7072-11e0-a112-cc8b9be26a7d\boot.sdi



LastRegBack: 2014-01-09 04:12

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-01-2014
Ran by sascha at 2014-01-15 02:07:53
Running from C:\Users\sascha\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Disabled - Up to date) {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Sunbelt VIPRE (Disabled - Out of date) {BE5DD172-7F42-7948-1A60-E6A720288F81}
AS: Microsoft Security Essentials (Disabled - Up to date) {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sunbelt VIPRE (Disabled - Out of date) {053C3096-5978-76C6-20D0-DDD55BAFC53C}
FW: Sunbelt VIPRE (Disabled) {86665057-352D-7810-313F-4F92DEFBC8FA}

==================== Installed Programs ======================

Adobe Acrobat X Pro - English, Français, Deutsch (Version: 10.0.0 - Adobe Systems)
Adobe Flash Player 10 ActiveX (Version: 10.3.181.34 - Adobe Systems Incorporated)
Adobe Flash Player 10 Plugin (Version: 10.3.183.5 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05 - Adobe Systems Incorporated)
Any Video Converter Professional 3.0.7 (Version:  - Any-Video-Converter.com)
Apple Application Support (Version: 1.5.0 - Apple Inc.)
Apple Mobile Device Support (Version: 3.4.0.25 - Apple Inc.)
Apple Software Update (Version: 2.1.3.127 - Apple Inc.)
Bonjour (Version: 2.0.4.0 - Apple Inc.)
ChessBase 11 (Version: 11.0.0.0 - ChessBase GmbH)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
De-Ascend 1.0 (Version: 1.0 - )
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (Version:  - Microsoft)
Deutschland Spielt - Spiele Post (Version: 1.0.3.0 - INTENIUM GmbH)
DEUTSCHLAND SPIELT GAME CENTER (Version: 1.0.0.46 - INTENIUM GmbH)
DivX Web Player (Version: 1.4.1 - DivX,Inc.)
Feedback Tool (Version: 1.2.0 - Microsoft Corporation)
Fritz 12 (Version: 12.0.0 - ChessBase)
Fritz 12 (Version: 12.0.0 - ChessBase) Hidden
'Full Speed' Internet Booster + Performance Tests (Version: 3.3 - Versis)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.21.165 - Google Inc.) Hidden
HPSSupply (Version: 140.0.212.0 - Hewlett-Packard) Hidden
iTunes (Version: 10.2.1.1 - Apple Inc.)
Java Auto Updater (Version: 2.0.5.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 26 (Version: 6.0.260 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LiveUpdate 3.3 (Symantec Corporation) (Version: 3.3.0.101 - Symantec Corporation)
Logitech Vid (Version: 1.10.1009 - Logitech Inc.)
Logitech Webcam Software (Version: 12.10.1113 - Logitech Inc.)
Luxor Evolved (Version: 1.0.0.0 - INTENIUM GmbH)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Antimalware (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2010 - German/Deutsch (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Language Pack 2010 - Russian/русский (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office O MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office O MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Ukrainian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office X MUI (Russian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 12.0 (x86 de) (Version: 12.0 - Mozilla)
Mozilla Maintenance Service (Version: 12.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
PokerStars (Version:  - PokerStars)
PowerISO (Version: 4.7 - PowerISO Computing, Inc.)
QuickTime (Version: 7.69.80.9 - Apple Inc.)
Revo Uninstaller Pro 2.4.3 (Version: 2.4.3 - VS Revo Group, Ltd.)
Ritter Arthur II - Collectors Edition (Version: 1.0.0.0 - INTENIUM GmbH)
Safari (Version: 5.33.16.0 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft) Hidden
Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition (Version:  - Microsoft) Hidden
Shop for HP Supplies (Version: 14.0 - HP)
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Symantec Network Access Control (Version: 11.0.6300.803 - Symantec Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (Version:  - Microsoft)
VIPRE Antivirus Premium (Version: 4.0.4194 - Sunbelt Software) Hidden
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (Version: 1.0.0.8 - Microsoft Corp)
WinRAR (Version:  - )
WinUtilities 9.8 Professional Edition (Version:  - YL Computing, Inc)
WinX HD Video Converter Deluxe 3.1 (Version:  - Digiarty Software,Inc.)

==================== Restore Points  =========================

11-01-2014 04:05:45 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 03:04 - 2013-12-19 00:26 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {50926B4C-A8D1-40D0-80D1-4B3C7B4BD5E1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-27] (Google Inc.)
Task: {5709B914-45A5-47F0-8143-B2130DA54826} - System32\Tasks\{8C4F21C0-43AD-4FBE-9B90-771C4E8A6CC2} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.11.0.102/de/eula?source=lightinstaller
Task: {6E9B2A62-8062-4B50-A816-BC9E76DAF196} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation)
Task: {FD6C23A0-2829-42FE-BE78-E71067D9D438} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-27] (Google Inc.)
Task: {FEB8D712-3C19-461A-967C-7D17E4677FCD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-25 14:15 - 2010-10-25 14:15 - 00019968 _____ () C:\Program Files\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2009-07-16 15:34 - 2009-07-16 15:34 - 02140944 _____ () C:\Program Files\Logitech\Logitech Vid\QtCore4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 07704336 _____ () C:\Program Files\Logitech\Logitech Vid\QtGui4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00968976 _____ () C:\Program Files\Logitech\Logitech Vid\QtNetwork4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00475408 _____ () C:\Program Files\Logitech\Logitech Vid\QtOpenGL4.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 00363792 _____ () C:\Program Files\Logitech\Logitech Vid\QtXml4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00199952 _____ () C:\Program Files\Logitech\Logitech Vid\QtSql4.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 00027408 _____ () C:\Program Files\Logitech\Logitech Vid\SDL.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 11311888 _____ () C:\Program Files\Logitech\Logitech Vid\QtWebKit4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00291600 _____ () C:\Program Files\Logitech\Logitech Vid\phonon4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00028944 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00035088 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00138000 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
2009-10-14 13:36 - 2009-10-14 13:36 - 00181592 _____ () C:\Program Files\Common Files\LogiShrd\LvApi11\LvApi11.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:98181191

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SBAMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SBPIMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SmcService => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/14/2014 10:59:16 PM) (Source: Microsoft-Windows-RestartManager) (User: sascha-PC)
Description: Die Anwendung oder der Dienst "LVCOMSer" konnte nicht neu gestartet werden.


System errors:
=============
Error: (01/14/2014 11:09:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update Service (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/14/2014 11:09:46 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update Service (gupdate) erreicht.

Error: (01/14/2014 11:08:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Microsoft Antimalware Service" wurde mit folgendem Fehler beendet: 
%%-2147017840

Error: (01/14/2014 11:08:05 PM) (Source: Microsoft Antimalware) (User: )
Description: %%860 Real-Time Protection feature has encountered an error and failed.

	Feature: %%835

	Error Code: 0x80004005

	Error description: Unbekannter Fehler 

	Reason: %%842

Error: (01/14/2014 11:07:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/14/2014 11:07:37 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.

Error: (01/14/2014 11:07:36 PM) (Source: Microsoft Antimalware) (User: )
Description: %%860 grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.

	Expiration Reason: %%873

	Expiration Date (UTC): ‎14.‎01.‎2014 22:07:36

	Error Code: 0x80092003

	Error Description: Beim Lesen oder Schreiben einer Datei ist ein Fehler aufgetreten.

Error: (01/14/2014 04:59:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update Service (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/14/2014 04:59:25 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update Service (gupdate) erreicht.

Error: (01/14/2014 04:57:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Microsoft Antimalware Service" wurde mit folgendem Fehler beendet: 
%%-2147017840


Microsoft Office Sessions:
=========================
Error: (01/14/2014 10:59:16 PM) (Source: Microsoft-Windows-RestartManager)(User: sascha-PC)
Description: 0LVComSer.exeLVCOMSer03026217823280


==================== Memory info =========================== 

Percentage of memory in use: 44%
Total physical RAM: 3327.12 MB
Available physical RAM: 1849.48 MB
Total Pagefile: 6652.52 MB
Available Pagefile: 5196.96 MB
Total Virtual: 2047.88 MB
Available Virtual: 1894.33 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:69.23 GB) (Free:14.19 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Archive) (Fixed) (Total:26.3 GB) (Free:10.59 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (Filme) (Fixed) (Total:465.76 GB) (Free:70.49 GB) NTFS
Drive g: (Musik) (Fixed) (Total:439.45 GB) (Free:299.85 GB) NTFS
Drive k: (INTENSO) (Removable) (Total:7.26 GB) (Free:6 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: 30C20F72)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 23852384)
Partition 1: (Not Active) - (Size=439 GB) - (Type=OF Extended)
Partition 2: (Active) - (Size=26 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 69 GB) (Disk ID: ABBCFECA)
Partition 1: (Active) - (Size=69 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 466 GB) (Disk ID: 79C62893)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 4 (Size: 7 GB) (Disk ID: F3CC7CFA)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================

Hallo Schrauber,

irgendwie siehts immer noch mau aus, der eset o line scanner hat 4 trojaner gefunde.
was is da los die sind aber auch sau hartnäckig die hunde... ;( des gibts ja net.
mai oh mai die machen mich noch irre.
was mach ma denn jetzt am gscheitsten?
mfg dani

schrauber · 15.01.2014, 14:56

Java, Flash und Firefox updaten. Locker, die ESET Funde sind doch schon in Quarantäne oder nur in den Temps

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

24.12.2013, 11:21	#8
schrauber /// the machine /// TB-Ausbilder	Windows 7 , PC stürzt immer wieder ab, nach säuberung mit Vipre immer noch viele verdächtig Datein im Autorun Logs bitte immer in Codetags posten, und den Rest bitte noch __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 7 , PC stürzt immer wieder ab, nach säuberung mit Vipre immer noch viele verdächtig Datein im Autorun

Log-Analyse und Auswertung: Windows 7 , PC stürzt immer wieder ab, nach säuberung mit Vipre immer noch viele verdächtig Datein im Autorun