Redirection IE10, Windows 8

Cliff-Gallup · 30.12.2013, 17:04

Hallo Trojaner-Board!

Mein Anliegen:

Ich spiele oft Schach bei chess.com. Etwa alle 10-15 Minuten werde ich von dort umgeleitet
auf eine (fake) Java Update Website. Die Betreiber der Webseite haben mir versichert, daß
der Fehler nicht bei ihnen liegt. chess.com ist eine große Community, seriös, aber die Werbung die von ihnen geschaltet wird, ist nicht immer seriös.

Ich benutze ein Asus-Notebook mit Windows 8 und IE 10. Scans mit avast, malwarebyte und GMER brachten keine Ergebnisse.
(Bis auf den Umstand, daß gmer öfters einen Bluescreen erzeugt, bzw. in den Scan-Ergebnissen sind manchmal Einträge mit chinesischen oder arabischen
Schriftzeichen, spätestens wenn ich versuche die zu "killen" kommt der Bluescreen.

Meine Fragen:

1. Ist es normal, daß gmer unter Windows 8 einen Absturz erzeugt?
2.Sind chinesische/arabische Einträge bei GMER ein Hinweis auf eine Infizierung, die von keinem der o. g. Scanner erkannt wird?
3. Wie ist es möglich, daß mein IE nur und ausschließlich beim Besuch der Website chess.com umgeleitet wird, ansonsten aber einwandfrei funktioniert?
Ist dies ein Hinweis auf eine Infizierung der Website oder meines Notebooks?

Ich eröffne diesen Thread, um Euch evtl. unnötige Arbeit zu ersparen. Wenn die freundlichen Helfer vom Trojaner-Board es aber für möglich halten,
daß mein Notebook infiziert ist, werde ich gern einen Thread unter Beachtung der von Euch geposteten Anweisungen und Hinweisen eröffnen.

Herzlichen Dank im voraus für Eure Hilfe,
viele Grüße

Cliff

schrauber · 30.12.2013, 17:23

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Cliff-Gallup · 30.12.2013, 19:58

Hallo Schrauber,

danke für Deine Antwort und Hilfe. Ich habe mit frst gescannt.

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013 01
Ran by Olvija (ATTENTION: The logged in user is not administrator) on OSCAR on 30-12-2013 19:32:09
Running from C:\Users\Olvija\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [ACMON] - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [107192 2012-08-24] (ASUS)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5264016 2012-08-16] (VIA)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe [3417984 2012-08-28] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-29] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [439488 2013-07-09] (Microsoft Corporation)
HKLM-x32\...\RunOnce: [20131224] - C:\Program Files\AVAST Software\Avast\setup\emupdate\6a0aa59b-fe9b-4eaf-a6ae-c8099c456000.exe /check [181136 2013-12-30] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

==================== Internet (Whitelisted) ====================

ProxyServer: 189.90.254.68:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://duckduckgo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.13.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) =================

R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-29] (AVAST Software)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [219480 2013-07-22] (Garmin Ltd or its subsidiaries)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-08] (NVIDIA Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-14] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-29] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-29] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [89304 2013-12-29] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [x]
U0 msahci; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-30 19:32 - 2013-12-30 19:32 - 00008020 _____ C:\Users\Olvija\Downloads\FRST.txt
2013-12-30 19:31 - 2013-12-30 19:31 - 00000000 ____D C:\FRST
2013-12-30 12:05 - 2013-12-30 12:05 - 01931302 _____ (Farbar) C:\Users\Olvija\Downloads\FRST64.exe
2013-12-30 11:03 - 2013-12-30 11:03 - 416631944 _____ C:\Windows\MEMORY.DMP
2013-12-29 11:54 - 2013-12-29 12:03 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-29 11:54 - 2013-12-29 11:54 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-29 11:52 - 2013-12-29 11:52 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Django\Downloads\mbar-1.07.0.1008.exe
2013-12-29 04:31 - 2013-12-29 04:31 - 04645232 _____ (Piriform Ltd) C:\Users\Django\Downloads\ccsetup409.exe
2013-12-29 04:12 - 2013-12-30 11:03 - 00000000 ____D C:\Windows\Minidump
2013-12-29 04:10 - 2013-12-29 04:10 - 00377856 _____ C:\Users\Django\Downloads\fgqwxlyu.exe
2013-12-13 22:46 - 2013-12-13 22:46 - 00320544 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 17:01 - 2013-12-13 17:01 - 00000943 _____ C:\Users\Olvija\Desktop\King Men.lnk
2013-12-11 22:41 - 2013-12-11 22:41 - 00000000 ____D C:\Users\Olvija\.tuxguitar-1.2
2013-12-11 22:38 - 2013-12-11 22:38 - 00000000 ____D C:\Users\Django\.tuxguitar-1.2
2013-12-11 22:37 - 2013-12-11 22:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Sun
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Oracle
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-11 22:35 - 2013-12-11 22:35 - 00915368 _____ (Oracle Corporation) C:\Users\Django\Downloads\JavaSetup7u45.exe
2013-12-11 09:24 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 09:24 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 09:24 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-11 09:24 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 09:24 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 09:24 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-11 09:24 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 09:24 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 09:23 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 09:23 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 09:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 09:23 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 09:23 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 09:23 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 09:23 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2013-12-11 09:23 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 09:23 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 09:23 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 09:23 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2013-12-11 09:23 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 09:23 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-12-11 09:23 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-12-11 09:23 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-12-11 09:23 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-12-11 09:23 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2013-12-11 09:23 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml
2013-12-11 09:23 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2013-12-11 09:23 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-12-11 09:23 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-12-11 09:23 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-11 09:23 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-12-11 09:23 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll
2013-12-11 09:23 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2013-12-11 09:23 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2013-12-11 09:23 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2013-12-02 16:18 - 2013-12-02 16:18 - 00000000 ____D C:\Users\Django\AppData\Roaming\AVAST Software

==================== One Month Modified Files and Folders =======

2013-12-30 19:32 - 2013-12-30 19:32 - 00008020 _____ C:\Users\Olvija\Downloads\FRST.txt
2013-12-30 19:31 - 2013-12-30 19:31 - 00000000 ____D C:\FRST
2013-12-30 19:26 - 2013-02-23 16:48 - 00694784 ___SH C:\Users\Olvija\Desktop\Thumbs.db
2013-12-30 19:25 - 2013-02-23 16:42 - 00000408 _____ C:\Users\Olvija\AppData\Roaming\sp_data.sys
2013-12-30 19:02 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2013-12-30 12:05 - 2013-12-30 12:05 - 01931302 _____ (Farbar) C:\Users\Olvija\Downloads\FRST64.exe
2013-12-30 11:46 - 2012-08-03 00:02 - 00753134 _____ C:\Windows\system32\perfh007.dat
2013-12-30 11:46 - 2012-08-03 00:02 - 00155826 _____ C:\Windows\system32\perfc007.dat
2013-12-30 11:46 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-30 11:03 - 2013-12-30 11:03 - 416631944 _____ C:\Windows\MEMORY.DMP
2013-12-30 11:03 - 2013-12-29 04:12 - 00000000 ____D C:\Windows\Minidump
2013-12-30 11:03 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-30 10:37 - 2013-02-23 13:51 - 00000408 _____ C:\Users\Django\AppData\Roaming\sp_data.sys
2013-12-29 12:03 - 2013-12-29 11:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-29 11:54 - 2013-12-29 11:54 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-29 11:52 - 2013-12-29 11:52 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Django\Downloads\mbar-1.07.0.1008.exe
2013-12-29 04:32 - 2013-02-23 14:41 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-29 04:32 - 2013-02-23 14:41 - 00000000 ____D C:\Program Files\CCleaner
2013-12-29 04:31 - 2013-12-29 04:31 - 04645232 _____ (Piriform Ltd) C:\Users\Django\Downloads\ccsetup409.exe
2013-12-29 04:10 - 2013-12-29 04:10 - 00377856 _____ C:\Users\Django\Downloads\fgqwxlyu.exe
2013-12-27 05:11 - 2013-07-07 03:26 - 00000000 ____D C:\Users\Olvija\AppData\Roaming\vlc
2013-12-26 17:49 - 2013-02-24 03:41 - 00000000 ____D C:\Program Files (x86)\No23 Recorder
2013-12-26 00:18 - 2013-08-08 16:56 - 00000000 ____D C:\Movies 2
2013-12-22 08:14 - 2013-05-31 19:19 - 00000000 ____D C:\pic 2
2013-12-14 10:10 - 2013-07-20 15:29 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 10:09 - 2013-02-23 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-13 22:46 - 2013-12-13 22:46 - 00320544 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 17:01 - 2013-12-13 17:01 - 00000943 _____ C:\Users\Olvija\Desktop\King Men.lnk
2013-12-12 00:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-12-11 22:41 - 2013-12-11 22:41 - 00000000 ____D C:\Users\Olvija\.tuxguitar-1.2
2013-12-11 22:41 - 2013-02-23 16:41 - 00000000 ____D C:\Users\Olvija
2013-12-11 22:38 - 2013-12-11 22:38 - 00000000 ____D C:\Users\Django\.tuxguitar-1.2
2013-12-11 22:38 - 2013-02-23 13:47 - 00000000 ____D C:\Users\Django
2013-12-11 22:37 - 2013-12-11 22:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Sun
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Oracle
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-11 22:35 - 2013-12-11 22:35 - 00915368 _____ (Oracle Corporation) C:\Users\Django\Downloads\JavaSetup7u45.exe
2013-12-11 21:20 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2013-12-11 09:31 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2013-12-11 02:14 - 2013-08-08 02:46 - 00000000 ____D C:\Users\Django\AppData\Roaming\vlc
2013-12-04 01:53 - 2013-11-14 23:06 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-04 01:53 - 2013-11-14 23:06 - 00078304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-02 16:18 - 2013-12-02 16:18 - 00000000 ____D C:\Users\Django\AppData\Roaming\AVAST Software

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-12-2013 01
Ran by Olvija at 2013-12-30 19:32:41
Running from C:\Users\Olvija\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.)
Arena 3.0 (x32 Version: - )
ASUS Instant Connect (x32 Version: 1.2.8 - ASUS)
ASUS InstantOn (x32 Version: 3.0.2 - ASUS)
ASUS LifeFrame3 (x32 Version: 3.1.4 - ASUS)
ASUS Live Update (x32 Version: 3.1.9 - ASUS)
ASUS Power4Gear Hybrid (Version: 2.0.4 - ASUS)
ASUS Smart Gesture (x32 Version: 1.0.35 - ASUS)
ASUS Splendid Video Enhancement Technology (x32 Version: 1.03.0004 - ASUS)
ASUS Tutor (x32 Version: 1.0.7 - ASUS)
ASUS USB Charger Plus (x32 Version: 2.1.4 - ASUS)
ASUS WebStorage Sync Agent (x32 Version: 1.1.9.120 - ASUS Cloud Corporation)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.)
AsusVibe2.0 (x32 Version: 2.0.10.168 - ASUSTEK)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.7 - Atheros Communications Inc.)
ATK Package (x32 Version: 1.0.0023 - ASUS)
avast! Free Antivirus (x32 Version: 9.0.2008 - Avast Software)
BestPractice (remove only) (x32 Version: - )
CCleaner (Version: 4.09 - Piriform)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
Elevated Installer (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries)
ElsterFormular (x32 Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
Garmin Express (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries)
Garmin Express Tray (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries)
Garmin Update Service (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation)
IrfanView (remove only) (x32 Version: 4.35 - Irfan Skiljan)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation)
No23 Recorder (x32 Version: 2.1.0.3 - No23)
NVIDIA GeForce Experience 1.7 (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 320.49 (Version: 320.49 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation)
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation)
NVIDIA Optimus 9.3.16 (Version: 9.3.16 - NVIDIA Corporation)
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation)
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation)
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation)
NVIDIA Update Components (Version: 9.3.21 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.9 (Version: 1.2.9 - NVIDIA Corporation)
OpenOffice 4.0.0 (x32 Version: 4.00.9702 - Apache Software Foundation)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.)
Ralink RT2860 Wireless LAN Card (x32 Version: 1.2.0.40 - Ralink)
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation)
Skype™ 6.5 (x32 Version: 6.5.158 - Skype Technologies S.A.)
StreamTransport version: 1.0.2.2171 (x32 Version: - )
System Requirements Lab for Intel (x32 Version: 4.5.13.0 - Husdawg, LLC)
ToneLabSE SoundEditor for Windows (x32 Version: 1.01.0000 - KORG INC.)
TuxGuitar (x32 Version: 1.2 - Herac)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc)
VIA Platform Device Manager (x32 Version: 1.39 - VIA Technologies, Inc.)
VLC media player 1.1.10 (x32 Version: 1.1.10 - VideoLAN)
Windows 8 Desktop Gadgets (Version: 1.1 - PainteR)
Windows-Treiberpaket - ASUS (ATP) Mouse (10/29/2012 1.0.0.148) (Version: 10/29/2012 1.0.0.148 - ASUS)
WinFlash (x32 Version: 2.41.1 - ASUS)

==================== Restore Points =========================

Could not list Restore Points. Check WMI.

==================== Hosts content: ==========================

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

==================== Loaded Modules (whitelisted) =============

2012-09-21 03:56 - 2012-08-15 18:52 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2012-11-01 11:39 - 2012-08-16 11:04 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2012-11-01 11:39 - 2012-08-16 11:04 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

==================== Faulty Device Manager Devices =============

Name: 802.11n Wireless LAN Card
Description: 802.11n Wireless LAN Card
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Ralink Technology, Corp.
Service: netr28x
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================
Error: (12/30/2013 05:26:20 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.0.7.0, Zeitstempel: 0x51b24edb
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000daa3c
ID des fehlerhaften Prozesses: 0x17c4
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Vollständiger Name des fehlerhaften Pakets: vlc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: vlc.exe5

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.

Details:
Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an. (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung

Details:
Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an. (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog

Details:
Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an. (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog

Details:
Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an. (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Der Plug-In-Manager <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung

Details:
(HRESULT : 0x8e5e0210) (0x8e5e0210)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.

Details:
Der Inhaltsindexkatalog ist fehlerhaft. 0xc0041801 (0xc0041801)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4810 - enduser\mssearch2\search\ytrip\common\util\jetutil.cpp (167)} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.

Details:
0x8e5e0210 (0x8e5e0210)

Error: (12/30/2013 11:04:12 AM) (Source: ESENT) (User: )
Description: SearchIndexer (4312) Windows: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb0000E.log.

Error: (12/29/2013 07:14:33 PM) (Source: ESENT) (User: )
Description: taskhostex (1976) WebCacheLocal: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\Users\Olvija\AppData\Local\Microsoft\Windows\WebCache\V0100132.log.

System errors:
=============
Error: (12/30/2013 11:04:42 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (12/30/2013 11:04:40 AM) (Source: DCOM) (User: Oscar)
Description: 1053WSearchNicht verfügbar{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (12/30/2013 11:04:40 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (12/30/2013 11:04:40 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (12/30/2013 11:04:12 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/30/2013 11:04:12 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde mit dem folgenden dienstspezifischen Fehler beendet:
%%2147749126

Error: (12/30/2013 11:03:49 AM) (Source: BugCheck) (User: )
Description: 0x00000124 (0x0000000000000000, 0xfffffa80076cc028, 0x00000000fe200000, 0x0000000000041136)C:\Windows\MEMORY.DMP123013-49921-01

Error: (12/30/2013 11:02:59 AM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (12/30/2013 11:03:41 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎30.‎12.‎2013 um 11:01:31 unerwartet heruntergefahren.

Error: (12/30/2013 10:37:14 AM) (Source: BugCheck) (User: )
Description: 0x00000124 (0x0000000000000000, 0xfffffa80076cc028, 0x00000000fe200000, 0x0000000000041136)C:\Windows\MEMORY.DMP123013-50562-01

Microsoft Office Sessions:
=========================
Error: (12/30/2013 05:26:20 PM) (Source: Application Error)(User: )
Description: vlc.exe2.0.7.051b24edbntdll.dll6.2.9200.16578515fac6ec0000374000daa3c17c401cf057bbc933e80C:\Program Files (x86)\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll1ce62d5c-716f-11e3-beea-50465d973a5a

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an. (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung

Details:
Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an. (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog

Details:
Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an. (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog

Details:
Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an. (HRESULT : 0x80040d06) (0x80040d06)
Search.TripoliIndexer

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung

Details:
(HRESULT : 0x8e5e0210) (0x8e5e0210)
Search.TripoliIndexer

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. 0xc0041801 (0xc0041801)
The catalog is corrupt

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description:
Details:
0x8e5e0210 (0x8e5e0210)
4810 - enduser\mssearch2\search\ytrip\common\util\jetutil.cpp (167)

Error: (12/30/2013 11:04:12 AM) (Source: ESENT)(User: )
Description: SearchIndexer4312Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb0000E.log-1811 (0xfffff8ed)

Error: (12/29/2013 07:14:33 PM) (Source: ESENT)(User: )
Description: taskhostex1976WebCacheLocal: C:\Users\Olvija\AppData\Local\Microsoft\Windows\WebCache\V0100132.log-1811 (0xfffff8ed)

==================== Memory info ===========================

Percentage of memory in use: 22%
Total physical RAM: 6029.71 MB
Available physical RAM: 4670.11 MB
Total Pagefile: 12173.71 MB
Available Pagefile: 10743.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.76 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:21.83 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:398.17 GB) (Free:12.07 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================

Gruß Cliff

schrauber · 31.12.2013, 15:12

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Unsere Tools brauchen immer Adminrechte!!!

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Cliff-Gallup · 01.01.2014, 12:44

Hallo Schrauber,

gutes neues Jahr!

Zuerst die frst logs als Administrator:

frst

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013 01
Ran by Django (administrator) on OSCAR on 01-01-2014 11:42:54
Running from C:\Users\Django\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [ACMON] - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [107192 2012-08-24] (ASUS)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5264016 2012-08-16] (VIA)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe [3417984 2012-08-28] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-29] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1093464 2013-07-22] (Garmin Ltd or its subsidiaries)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.13.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) =================

R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-29] (AVAST Software)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [219480 2013-07-22] (Garmin Ltd or its subsidiaries)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-08] (NVIDIA Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-14] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-29] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-29] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [89304 2013-12-29] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [x]
U0 msahci; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-01 11:42 - 2014-01-01 11:42 - 00009440 _____ C:\Users\Django\Desktop\FRST.txt
2014-01-01 11:23 - 2014-01-01 11:23 - 05160176 _____ (Swearware) C:\Users\Django\Desktop\ComboFix.exe
2013-12-30 19:31 - 2013-12-30 19:31 - 00000000 ____D C:\FRST
2013-12-30 12:05 - 2013-12-30 12:05 - 01931302 _____ (Farbar) C:\Users\Django\Desktop\FRST64.exe
2013-12-29 11:54 - 2013-12-29 12:03 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-29 11:54 - 2013-12-29 11:54 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-29 11:53 - 2013-12-29 12:03 - 00000000 ____D C:\Users\Django\Desktop\mbar
2013-12-29 11:52 - 2013-12-29 11:52 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Django\Downloads\mbar-1.07.0.1008.exe
2013-12-29 04:31 - 2013-12-29 04:31 - 04645232 _____ (Piriform Ltd) C:\Users\Django\Downloads\ccsetup409.exe
2013-12-29 04:12 - 2014-01-01 11:42 - 00000000 ____D C:\Windows\Minidump
2013-12-29 04:10 - 2013-12-29 04:10 - 00377856 _____ C:\Users\Django\Downloads\fgqwxlyu.exe
2013-12-13 22:46 - 2013-12-13 22:46 - 00320544 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 17:01 - 2013-12-13 17:01 - 00000943 _____ C:\Users\Olvija\Desktop\King Men.lnk
2013-12-11 22:41 - 2013-12-11 22:41 - 00000000 ____D C:\Users\Olvija\.tuxguitar-1.2
2013-12-11 22:38 - 2013-12-11 22:38 - 00000000 ____D C:\Users\Django\.tuxguitar-1.2
2013-12-11 22:37 - 2013-12-11 22:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Sun
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Oracle
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-11 22:35 - 2013-12-11 22:35 - 00915368 _____ (Oracle Corporation) C:\Users\Django\Downloads\JavaSetup7u45.exe
2013-12-11 09:24 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 09:24 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 09:24 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-11 09:24 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 09:24 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 09:24 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-11 09:24 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 09:24 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 09:23 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 09:23 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 09:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 09:23 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 09:23 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 09:23 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 09:23 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2013-12-11 09:23 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 09:23 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 09:23 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 09:23 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2013-12-11 09:23 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 09:23 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-12-11 09:23 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-12-11 09:23 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-12-11 09:23 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-12-11 09:23 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2013-12-11 09:23 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml
2013-12-11 09:23 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2013-12-11 09:23 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-12-11 09:23 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-12-11 09:23 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-11 09:23 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-12-11 09:23 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll
2013-12-11 09:23 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2013-12-11 09:23 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2013-12-11 09:23 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2013-12-02 16:18 - 2013-12-02 16:18 - 00000000 ____D C:\Users\Django\AppData\Roaming\AVAST Software

==================== One Month Modified Files and Folders =======

2014-01-01 11:42 - 2014-01-01 11:42 - 00009440 _____ C:\Users\Django\Desktop\FRST.txt
2014-01-01 11:42 - 2013-12-29 04:12 - 00000000 ____D C:\Windows\Minidump
2014-01-01 11:23 - 2014-01-01 11:23 - 05160176 _____ (Swearware) C:\Users\Django\Desktop\ComboFix.exe
2014-01-01 11:22 - 2013-02-23 13:51 - 00000408 _____ C:\Users\Django\AppData\Roaming\sp_data.sys
2014-01-01 11:21 - 2013-02-23 16:48 - 00694784 ___SH C:\Users\Olvija\Desktop\Thumbs.db
2014-01-01 11:13 - 2013-02-23 16:42 - 00000408 _____ C:\Users\Olvija\AppData\Roaming\sp_data.sys
2014-01-01 11:12 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-01 04:57 - 2013-05-31 19:19 - 00000000 ____D C:\pic 2
2014-01-01 04:50 - 2012-08-03 00:02 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-01 04:50 - 2012-08-03 00:02 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-01 04:50 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-01 04:48 - 2013-07-07 03:26 - 00000000 ____D C:\Users\Olvija\AppData\Roaming\vlc
2014-01-01 03:17 - 2013-08-08 16:56 - 00000000 ____D C:\Movies 2
2013-12-31 19:46 - 2013-03-05 11:33 - 00000000 ____D C:\Users\Olvija\AppData\Roaming\dvdcss
2013-12-31 11:55 - 2013-02-23 18:58 - 00164864 ___SH C:\Users\Django\Desktop\Thumbs.db
2013-12-30 19:31 - 2013-12-30 19:31 - 00000000 ____D C:\FRST
2013-12-30 12:05 - 2013-12-30 12:05 - 01931302 _____ (Farbar) C:\Users\Django\Desktop\FRST64.exe
2013-12-30 11:03 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-30 10:40 - 2013-02-23 14:41 - 00002776 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-12-29 12:03 - 2013-12-29 11:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-29 12:03 - 2013-12-29 11:53 - 00000000 ____D C:\Users\Django\Desktop\mbar
2013-12-29 11:54 - 2013-12-29 11:54 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-29 11:52 - 2013-12-29 11:52 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Django\Downloads\mbar-1.07.0.1008.exe
2013-12-29 04:32 - 2013-02-23 14:41 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-29 04:32 - 2013-02-23 14:41 - 00000000 ____D C:\Program Files\CCleaner
2013-12-29 04:31 - 2013-12-29 04:31 - 04645232 _____ (Piriform Ltd) C:\Users\Django\Downloads\ccsetup409.exe
2013-12-29 04:10 - 2013-12-29 04:10 - 00377856 _____ C:\Users\Django\Downloads\fgqwxlyu.exe
2013-12-27 18:27 - 2013-02-23 13:56 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-164380009-2066086905-4240964568-1002
2013-12-27 11:25 - 2013-02-23 16:47 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-164380009-2066086905-4240964568-1005
2013-12-27 00:28 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-12-26 17:49 - 2013-02-24 03:41 - 00000000 ____D C:\Program Files (x86)\No23 Recorder
2013-12-19 03:03 - 2013-02-23 15:03 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-14 10:10 - 2013-07-20 15:29 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 10:09 - 2013-02-23 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-13 22:46 - 2013-12-13 22:46 - 00320544 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 17:01 - 2013-12-13 17:01 - 00000943 _____ C:\Users\Olvija\Desktop\King Men.lnk
2013-12-12 00:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-12-11 22:41 - 2013-12-11 22:41 - 00000000 ____D C:\Users\Olvija\.tuxguitar-1.2
2013-12-11 22:41 - 2013-02-23 16:41 - 00000000 ____D C:\Users\Olvija
2013-12-11 22:38 - 2013-12-11 22:38 - 00000000 ____D C:\Users\Django\.tuxguitar-1.2
2013-12-11 22:38 - 2013-02-23 13:47 - 00000000 ____D C:\Users\Django
2013-12-11 22:37 - 2013-12-11 22:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Sun
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Oracle
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-11 22:35 - 2013-12-11 22:35 - 00915368 _____ (Oracle Corporation) C:\Users\Django\Downloads\JavaSetup7u45.exe
2013-12-11 21:20 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2013-12-11 09:31 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2013-12-11 02:14 - 2013-08-08 02:46 - 00000000 ____D C:\Users\Django\AppData\Roaming\vlc
2013-12-04 01:53 - 2013-11-14 23:06 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-04 01:53 - 2013-11-14 23:06 - 00078304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-02 16:18 - 2013-12-02 16:18 - 00000000 ____D C:\Users\Django\AppData\Roaming\AVAST Software

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-28 11:55

==================== End Of Log ============================

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-12-2013 01
Ran by Django at 2014-01-01 11:45:43
Running from C:\Users\Django\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.)
Arena 3.0 (x32 Version:  - )
ASUS Instant Connect (x32 Version: 1.2.8 - ASUS)
ASUS InstantOn (x32 Version: 3.0.2 - ASUS)
ASUS LifeFrame3 (x32 Version: 3.1.4 - ASUS)
ASUS Live Update (x32 Version: 3.1.9 - ASUS)
ASUS Power4Gear Hybrid (Version: 2.0.4 - ASUS)
ASUS Smart Gesture (x32 Version: 1.0.35 - ASUS)
ASUS Splendid Video Enhancement Technology (x32 Version: 1.03.0004 - ASUS)
ASUS Tutor (x32 Version: 1.0.7 - ASUS)
ASUS USB Charger Plus (x32 Version: 2.1.4 - ASUS)
ASUS WebStorage Sync Agent (x32 Version: 1.1.9.120 - ASUS Cloud Corporation)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.)
AsusVibe2.0 (x32 Version: 2.0.10.168 - ASUSTEK)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.7 - Atheros Communications Inc.)
ATK Package (x32 Version: 1.0.0023 - ASUS)
avast! Free Antivirus (x32 Version: 9.0.2008 - Avast Software)
BestPractice (remove only) (x32 Version:  - )
CCleaner (Version: 4.09 - Piriform)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
Elevated Installer (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries)
ElsterFormular (x32 Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
Garmin Express (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries)
Garmin Express Tray (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries)
Garmin Update Service (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation)
IrfanView (remove only) (x32 Version: 4.35 - Irfan Skiljan)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation)
No23 Recorder (x32 Version: 2.1.0.3 - No23)
NVIDIA GeForce Experience 1.7 (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 320.49 (Version: 320.49 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation)
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation)
NVIDIA Optimus 9.3.16 (Version: 9.3.16 - NVIDIA Corporation)
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation)
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation)
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation)
NVIDIA Update Components (Version: 9.3.21 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.9 (Version: 1.2.9 - NVIDIA Corporation)
OpenOffice 4.0.0 (x32 Version: 4.00.9702 - Apache Software Foundation)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.)
Ralink RT2860 Wireless LAN Card (x32 Version: 1.2.0.40 - Ralink)
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation)
Skype™ 6.5 (x32 Version: 6.5.158 - Skype Technologies S.A.)
StreamTransport version: 1.0.2.2171 (x32 Version:  - )
System Requirements Lab for Intel (x32 Version: 4.5.13.0 - Husdawg, LLC)
ToneLabSE SoundEditor for Windows (x32 Version: 1.01.0000 - KORG INC.)
TuxGuitar (x32 Version: 1.2 - Herac)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc)
VIA Platform Device Manager (x32 Version: 1.39 - VIA Technologies, Inc.)
VLC media player 1.1.10 (x32 Version: 1.1.10 - VideoLAN)
Windows 8 Desktop Gadgets (Version: 1.1 - PainteR)
Windows-Treiberpaket - ASUS (ATP) Mouse  (10/29/2012 1.0.0.148) (Version: 10/29/2012 1.0.0.148 - ASUS)
WinFlash (x32 Version: 2.41.1 - ASUS)

==================== Restore Points  =========================

11-12-2013 21:36:13 Installed Java 7 Update 45
22-12-2013 00:15:23 Geplanter Prüfpunkt
31-12-2013 02:10:20 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {01206804-D630-40EF-A50B-3603FEBA427B} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-11-29] (AVAST Software)
Task: {196A9296-914F-4AEA-8467-83867E678A7A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {34A00163-42F9-4BC0-8868-94E08AC935A4} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)
Task: {492F7490-BA15-4E08-8BB7-DC699D55737D} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {4CC959CC-AD8F-4AE6-B285-7F0B87C68359} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {565BB633-6C8C-4421-8D4E-A19E47AE1B26} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {8D53155D-4C63-422B-8D27-662165D2262B} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {9F4734B1-8AF6-42CC-9F53-9146D52BF818} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AE9C914B-113B-413A-8A06-BF481A7ABAD2} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-10-31] (AsusTek)
Task: {C687CD98-AB42-4100-8D0A-E560A2F59035} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D10EA283-3516-4C92-A34D-5694E7F9ACF6} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\MouseKeyboardCenter.exe [2013-05-13] (Microsoft)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {FE7E1AA9-9F9C-46CB-9B86-1A33C3EB0E46} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)

==================== Loaded Modules (whitelisted) =============

2012-08-24 18:26 - 2012-08-24 18:26 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2012-09-21 03:56 - 2012-08-15 18:52 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2012-11-01 11:39 - 2012-08-16 11:04 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2012-11-01 11:39 - 2012-08-16 11:04 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2013-12-31 20:26 - 2013-12-31 18:55 - 02152960 _____ () C:\Program Files\AVAST Software\Avast\defs\13123101\algo.dll
2012-11-01 11:36 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-08-24 18:17 - 2012-08-24 18:17 - 00009216 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
2013-02-23 16:34 - 2013-02-10 04:25 - 00004096 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-11-29 22:45 - 2013-11-29 22:45 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: 802.11n Wireless LAN Card
Description: 802.11n Wireless LAN Card
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Ralink Technology, Corp.
Service: netr28x
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/31/2013 11:46:31 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.2.9200.16628, Zeitstempel: 0x51a94434
Name des fehlerhaften Moduls: explorerframe.dll, Version: 6.2.9200.16384, Zeitstempel: 0x50108d4c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000000bcf8
ID des fehlerhaften Prozesses: 0x5100
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5

Error: (12/30/2013 05:26:20 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.0.7.0, Zeitstempel: 0x51b24edb
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000daa3c
ID des fehlerhaften Prozesses: 0x17c4
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Vollständiger Name des fehlerhaften Pakets: vlc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: vlc.exe5

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an.  (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an.  (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an.  (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an.  (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Der Plug-In-Manager <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	(HRESULT : 0x8e5e0210) (0x8e5e0210)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.   0xc0041801 (0xc0041801)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4810 - enduser\mssearch2\search\ytrip\common\util\jetutil.cpp (167)} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	 0x8e5e0210 (0x8e5e0210)

Error: (12/30/2013 11:04:12 AM) (Source: ESENT) (User: )
Description: SearchIndexer (4312) Windows: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb0000E.log.


System errors:
=============
Error: (12/30/2013 07:55:53 PM) (Source: DCOM) (User: Oscar)
Description: AnwendungsspezifischLokalAktivierung{B77C4C36-0154-4C52-AB49-FAA03837E47F}{EA022610-0748-4C24-B229-6C507EBDFDBB}OscarOlvijaS-1-5-21-164380009-2066086905-4240964568-1005LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/30/2013 07:55:35 PM) (Source: DCOM) (User: Oscar)
Description: AnwendungsspezifischLokalAktivierung{B77C4C36-0154-4C52-AB49-FAA03837E47F}{EA022610-0748-4C24-B229-6C507EBDFDBB}OscarOlvijaS-1-5-21-164380009-2066086905-4240964568-1005LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/30/2013 11:04:42 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (12/30/2013 11:04:40 AM) (Source: DCOM) (User: Oscar)
Description: 1053WSearchNicht verfügbar{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (12/30/2013 11:04:40 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (12/30/2013 11:04:40 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (12/30/2013 11:04:12 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/30/2013 11:04:12 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde mit dem folgenden dienstspezifischen Fehler beendet: 
%%2147749126

Error: (12/30/2013 11:03:49 AM) (Source: BugCheck) (User: )
Description: 0x00000124 (0x0000000000000000, 0xfffffa80076cc028, 0x00000000fe200000, 0x0000000000041136)C:\Windows\MEMORY.DMP123013-49921-01

Error: (12/30/2013 11:02:59 AM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0xc000014d0


Microsoft Office Sessions:
=========================
Error: (12/31/2013 11:46:31 AM) (Source: Application Error)(User: )
Description: Explorer.EXE6.2.9200.1662851a94434explorerframe.dll6.2.9200.1638450108d4cc0000005000000000000bcf8510001cf061165b67640C:\Windows\Explorer.EXEC:\Windows\system32\explorerframe.dllcec8dd90-7208-11e3-beea-50465d973a5a

Error: (12/30/2013 05:26:20 PM) (Source: Application Error)(User: )
Description: vlc.exe2.0.7.051b24edbntdll.dll6.2.9200.16578515fac6ec0000374000daa3c17c401cf057bbc933e80C:\Program Files (x86)\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll1ce62d5c-716f-11e3-beea-50465d973a5a

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: 
Details:
	Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an.  (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung


Details:
	Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an.  (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an.  (HRESULT : 0x80040d06) (0x80040d06)

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Das angegebene Objekt wurde nicht gefunden. Geben Sie den Namen eines vorhandenen Objekts an.  (HRESULT : 0x80040d06) (0x80040d06)
Search.TripoliIndexer

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung


Details:
	(HRESULT : 0x8e5e0210) (0x8e5e0210)
Search.TripoliIndexer

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.   0xc0041801 (0xc0041801)
The catalog is corrupt

Error: (12/30/2013 11:04:12 AM) (Source: Windows Search Service)(User: )
Description: 
Details:
	 0x8e5e0210 (0x8e5e0210)
4810 - enduser\mssearch2\search\ytrip\common\util\jetutil.cpp (167)

Error: (12/30/2013 11:04:12 AM) (Source: ESENT)(User: )
Description: SearchIndexer4312Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb0000E.log-1811 (0xfffff8ed)


==================== Memory info =========================== 

Percentage of memory in use: 21%
Total physical RAM: 6029.71 MB
Available physical RAM: 4725.86 MB
Total Pagefile: 12173.71 MB
Available Pagefile: 10721.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:13.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:398.17 GB) (Free:17.34 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 944CB54D)

Partition: GPT Partition Type
==================== End Of Log ============================

Combofix:

Code:

ATTFilter

ComboFix 13-12-31.01 - Django 01.01.2014  11:52:47.1.4 - x64
Microsoft Windows 8  6.2.9200.0.1252.49.1031.18.6030.4636 [GMT 1:00]
ausgeführt von:: c:\users\Django\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Setup.exe
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-12-01 bis 2014-01-01  ))))))))))))))))))))))))))))))
.
.
2014-01-01 10:57 . 2014-01-01 10:57	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2014-01-01 10:57 . 2014-01-01 10:57	--------	d-----w-	c:\users\Django\AppData\Local\temp
2013-12-30 18:31 . 2013-12-30 18:31	--------	d-----w-	C:\FRST
2013-12-29 10:54 . 2013-12-29 11:03	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-12-29 10:54 . 2013-12-29 10:54	89304	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2013-12-14 06:15 . 2013-11-01 01:45	23350272	----a-w-	c:\program files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2013-12-14 06:15 . 2013-11-01 01:16	22615040	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2013-12-11 21:41 . 2013-12-11 21:41	--------	d-----w-	c:\users\Olvija\.tuxguitar-1.2
2013-12-11 21:38 . 2013-12-11 21:38	--------	d-----w-	c:\users\Django\.tuxguitar-1.2
2013-12-11 21:37 . 2013-12-11 21:37	--------	d-----w-	c:\programdata\Oracle
2013-12-11 21:37 . 2013-12-11 21:37	--------	d-----w-	c:\program files (x86)\Common Files\Java
2013-12-11 21:37 . 2013-12-11 21:37	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-12-11 21:37 . 2013-12-11 21:37	--------	d-----w-	c:\program files (x86)\Java
2013-12-11 08:23 . 2013-10-08 22:30	628736	----a-w-	c:\windows\SysWow64\wuapi.dll
2013-12-02 15:18 . 2013-12-02 15:18	--------	d-----w-	c:\users\Django\AppData\Roaming\AVAST Software
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-01 10:22 . 2013-02-23 12:51	408	----a-w-	c:\users\Django\AppData\Roaming\sp_data.sys
2014-01-01 10:13 . 2013-02-23 15:42	408	----a-w-	c:\users\Olvija\AppData\Roaming\sp_data.sys
2013-12-14 09:09 . 2013-02-23 14:50	90708896	----a-w-	c:\windows\system32\MRT.exe
2013-12-04 00:53 . 2013-11-14 22:06	78304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-04 00:53 . 2013-11-14 22:06	694240	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-29 21:45 . 2013-03-07 11:44	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2013-11-29 21:45 . 2013-03-07 11:44	205320	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-11-29 21:45 . 2013-02-23 14:03	409832	----a-w-	c:\windows\system32\drivers\aswSP.sys
2013-11-29 21:45 . 2013-02-23 14:03	38984	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2013-11-29 21:45 . 2013-02-23 14:03	92544	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2013-11-29 21:45 . 2013-02-23 14:03	1032416	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-11-29 21:45 . 2013-02-23 14:03	84328	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2013-11-29 21:45 . 2013-02-23 14:03	334648	----a-w-	c:\windows\system32\aswBoot.exe
2013-11-29 21:45 . 2013-02-23 14:02	43152	----a-w-	c:\windows\avastSS.scr
2013-10-18 01:36 . 2013-10-31 18:20	1063200	----a-w-	c:\windows\system32\nvspcap64.dll
2013-10-18 01:36 . 2013-10-31 18:20	955168	----a-w-	c:\windows\SysWow64\nvspcap.dll
2013-10-10 11:53 . 2013-11-14 08:09	96600	----a-w-	c:\windows\system32\drivers\wfplwfs.sys
2013-10-10 09:21 . 2013-11-14 08:09	1160192	----a-w-	c:\windows\system32\IKEEXT.DLL
2013-10-10 09:20 . 2013-11-14 08:09	723968	----a-w-	c:\windows\system32\BFE.DLL
2013-07-16 13:40 . 2013-07-16 13:40	2269184	----a-w-	c:\program files (x86)\openoffice400.msi
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GarminExpressTrayApp"="c:\program files (x86)\Garmin\Express Tray\ExpressTray.exe" [2013-07-22 1093464]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-09-03 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2012-08-16 5264016]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2012-03-28 91432]
"ASUSWebStorage"="c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe" [2012-08-28 3417984]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-11-29 3568312]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2012-11-1 549040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
R3 RTL8168;Realtek 8168 NT-Treiber;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe;c:\program files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]
S3 ATP;ASUS PS/2 Port Input Device;c:\windows\System32\drivers\AsusTP.sys;c:\windows\SYSNATIVE\drivers\AsusTP.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\System32\drivers\dc3d.sys;c:\windows\SYSNATIVE\drivers\dc3d.sys [x]
S3 HIDSwitch;ASUS Wireless Radio Control;c:\windows\System32\drivers\AsHIDSwitch64.sys;c:\windows\SYSNATIVE\drivers\AsHIDSwitch64.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C63x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C63x64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\System32\drivers\point64.sys;c:\windows\SYSNATIVE\drivers\point64.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-11-29 21:45	326944	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2012-03-13 09:23	1500672	----a-w-	c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2012-03-13 09:23	1500672	----a-w-	c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_U]
@="{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D}"
[HKEY_CLASSES_ROOT\CLSID\{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D}]
2012-03-13 09:23	1500672	----a-w-	c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-08-16 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-08-16 398656]
"ACMON"="c:\program files (x86)\ASUS\Splendid\ACMON.exe" [2012-08-24 107192]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-10-18 1028384]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.4.0/GarminAxControl_32.CAB
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2014-01-01  11:59:36
ComboFix-quarantined-files.txt  2014-01-01 10:59
.
Vor Suchlauf: 15 Verzeichnis(se), 13.924.298.752 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 13.778.292.736 Bytes frei
.
- - End Of File - - D21A047B9D787D1B892E39FEF1CCC955

Seit dem Combofix-Scan ist mein Desktophintergrundbild verschwunden.

Gratis dazu noch ein GMER log:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-01 12:17:38
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000003b ST750LM022_HN-M750MBB rev.2AR10001 698,64GB
Running: fgqwxlyu.exe; Driver: C:\Users\Django\AppData\Local\Temp\uxloapow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\system32\csrss.exe[512] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163                                                                                                 000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\wininit.exe[588] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\csrss.exe[604] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163                                                                                                 000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\winlogon.exe[648] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\services.exe[692] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\lsass.exe[708] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                 000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[828] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\nvvsvc.exe[896] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[932] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Windows\System32\svchost.exe[976] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                  000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                        000007feed29257c 8 bytes JMP 000007ffea5c03b0
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                      000007feed296b10 9 bytes JMP 000007ffea5c0308
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW                                                                                               000007feed315658 7 bytes JMP 000007ffea5c0260
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                               000007feed315778 7 bytes JMP 000007ffea5c02d0
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                       000007feed331564 7 bytes JMP 000007ffea5c0340
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                 000007feed3440e4 7 bytes JMP 000007ffea5c0298
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                               000007feed344178 8 bytes JMP 000007ffea5c0228
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                        000007feed34479c 8 bytes JMP 000007ffea5c0378
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                    000007feea5d28a0 7 bytes JMP 000007ffea5c00d8
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                         000007feea5d28e8 5 bytes JMP 000007ffea5c0180
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                      000007feea5ef590 6 bytes JMP 000007ffea5c0148
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                  000007feea5ef8ac 5 bytes JMP 000007ffea5c0110
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                                         000007feecf5c5b0 7 bytes JMP 000007ffea5c0490
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                              000007feecf631f0 9 bytes JMP 000007ffea5c03e8
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                                     000007feecf633e0 5 bytes JMP 000007ffea5c0458
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                                     000007feecf67160 5 bytes JMP 000007ffea5c0420
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                   000007feed0a1070 8 bytes JMP 000007ffea5c01f0
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                 000007feed0c0c10 8 bytes JMP 000007ffea5c01b8
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                                                        000007fee7f26d10 5 bytes JMP 000007ffe7f10110
.text   C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                                                         000007fee7f2d060 5 bytes JMP 000007ffe7f100d8
.text   C:\Windows\system32\svchost.exe[328] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[432] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[960] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                      000007feed28f7eb 1 byte [62]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[960] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                         000007fee5dd1532 4 bytes [DD, E5, FE, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[960] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                         000007fee5dd153a 4 bytes [DD, E5, FE, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[960] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                       000007fee5dd165a 4 bytes [DD, E5, FE, 07]
.text   C:\Windows\system32\nvvsvc.exe[1004] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\nvvsvc.exe[1004] C:\Windows\system32\MSIMG32.dll!GradientFill + 690                                                                                                  000007fee5dd1532 4 bytes [DD, E5, FE, 07]
.text   C:\Windows\system32\nvvsvc.exe[1004] C:\Windows\system32\MSIMG32.dll!GradientFill + 698                                                                                                  000007fee5dd153a 4 bytes [DD, E5, FE, 07]
.text   C:\Windows\system32\nvvsvc.exe[1004] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246                                                                                                000007fee5dd165a 4 bytes [DD, E5, FE, 07]
.text   C:\Windows\system32\nvvsvc.exe[1004] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                                                                        000007feed27177a 4 bytes [27, ED, FE, 07]
.text   C:\Windows\system32\nvvsvc.exe[1004] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                                                                        000007feed271782 4 bytes [27, ED, FE, 07]
.text   C:\Windows\System32\svchost.exe[420] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1256] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\System32\spoolsv.exe[1580] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1608] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1644] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Program Files\Intel\iCLS Client\HeciServer.exe[1100] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                            000007feed28f7eb 1 byte [62]
.text   C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1976] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[2228] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\viakaraokesrv.exe[2264] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                        000007feed28f7eb 1 byte [62]
.text   C:\Program Files\ASUS\P4G\BatteryLife.exe[2876] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                    000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\taskhostex.exe[2892] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                           000007feed28f7eb 1 byte [62]
.text   c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2904] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                               000007feed28f7eb 1 byte [62]
.text   c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[2928] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\Explorer.EXE[3052] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                      000007feed28f7eb 1 byte [62]
.text   C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1488] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\conhost.exe[1484] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\wbem\wmiprvse.exe[1820] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                        000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\wbem\wmiprvse.exe[3808] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                        000007feed28f7eb 1 byte [62]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3992] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                       000007feed28f7eb 1 byte [62]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3992] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                                          000007fee5dd1532 4 bytes [DD, E5, FE, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3992] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                                          000007fee5dd153a 4 bytes [DD, E5, FE, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3992] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                                        000007fee5dd165a 4 bytes [DD, E5, FE, 07]
.text   C:\Windows\servicing\TrustedInstaller.exe[4260] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                    000007feed28f7eb 1 byte [62]
.text   C:\Windows\System32\svchost.exe[4624] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                              000007feed28f7eb 1 byte [62]
.text   C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16683_none_62280e15510f8e79\TiWorker.exe[4752] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163  000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\DllHost.exe[996] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                               000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\SearchIndexer.exe[4700] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                        000007feed28f7eb 1 byte [62]
.text   C:\Windows\System32\hkcmd.exe[2460] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                                000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\igfxpers.exe[3280] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                                             000007feed28f7eb 1 byte [62]
.text   C:\Windows\system32\igfxpers.exe[3280] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                                                                      000007feed27177a 4 bytes [27, ED, FE, 07]
.text   C:\Windows\system32\igfxpers.exe[3280] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                                                                      000007feed271782 4 bytes [27, ED, FE, 07]
.text   C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe[4828] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                                                          000007feed28f7eb 1 byte [62]

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\csrss.exe [604:628]                                                                                                                                                  fffff960009bc5e8

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                                                                                    unknown MBR code

---- EOF - GMER 2.1 ----

gmer zeigt nach dem Scan unter "Prozesse" einen Eintrag mit chinesischen/arabischen oder sonstigen Hieroglyphen, den Eintrag kann ich aber nicht speichern oder kopieren.

Danke für Deine Zeit und Hilfe,

Gruß Cliff

schrauber · 02.01.2014, 08:54

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Cliff-Gallup · 02.01.2014, 15:53

Hallo Schrauber,

Malwarebytes log:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.02.01

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16750
Django :: OSCAR [Administrator]

02.01.2014 12:18:22
mbam-log-2014-01-02 (12-18-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 399056
Laufzeit: 36 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Adwcleaner log R:

Code:

ATTFilter

# AdwCleaner v3.016 - Bericht erstellt am 02/01/2014 um 13:10:29
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Django - OSCAR
# Gestartet von : C:\Users\Olvija\Desktop\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gefunden C:\Users\Olvija\AppData\LocalLow\boost_interprocess

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : [x64] HKCU\Software\Conduit

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


*************************

AdwCleaner[R0].txt - [663 octets] - [02/01/2014 13:10:29]

########## EOF - \AdwCleaner\AdwCleaner[R0].txt - [722 octets] ##########

Adwcleaner log S:

Code:

ATTFilter

# AdwCleaner v3.016 - Bericht erstellt am 02/01/2014 um 13:12:27
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Django - OSCAR
# Gestartet von : C:\Users\Olvija\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Olvija\AppData\LocalLow\boost_interprocess

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Conduit

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


*************************

AdwCleaner[R0].txt - [803 octets] - [02/01/2014 13:10:29]
AdwCleaner[S0].txt - [679 octets] - [02/01/2014 13:12:27]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [738 octets] ##########

Adwcleaner Quarantine:

Code:

ATTFilter

C:\Users\Olvija\AppData\LocalLow\boost_interprocess\DDM0serviceCmdLock->\AdwCleaner\Quarantine\C\Users\Olvija\AppData\LocalLow\boost_interprocess\DDM0serviceCmdLock.vir
C:\Users\Olvija\AppData\LocalLow\boost_interprocess\DDM0serviceCmdSerializeLock->\AdwCleaner\Quarantine\C\Users\Olvija\AppData\LocalLow\boost_interprocess\DDM0serviceCmdSerializeLock.vir
C:\Users\Olvija\AppData\LocalLow\boost_interprocess\DDM0serviceCmdShared->\AdwCleaner\Quarantine\C\Users\Olvija\AppData\LocalLow\boost_interprocess\DDM0serviceCmdShared.vir
C:\Users\Olvija\AppData\LocalLow\boost_interprocess\DDM0serviceLock->\AdwCleaner\Quarantine\C\Users\Olvija\AppData\LocalLow\boost_interprocess\DDM0serviceLock.vir

Jrt log:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.9 (01.01.2014:1)
OS: Windows 8 x64
Ran by Django on 02.01.2014 at 13:33:25,05
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.01.2014 at 13:37:54,46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Den Jrt Scan habe ich 2-mal durchgeführt, nach Ende des Scans kam beide Male ein Bluescreen.

Neuer frst log:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-01-2014 01
Ran by Django (administrator) on OSCAR on 02-01-2014 13:48:01
Running from C:\Users\Django\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ACMON] - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [107192 2012-08-24] (ASUS)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5264016 2012-08-16] (VIA)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe [3417984 2012-08-28] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-29] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1093464 2013-07-22] (Garmin Ltd or its subsidiaries)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.13.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) =================

R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-29] (AVAST Software)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [219480 2013-07-22] (Garmin Ltd or its subsidiaries)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-08] (NVIDIA Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-14] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-29] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-29] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [89304 2013-12-29] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [x]
U0 msahci; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-02 13:47 - 2014-01-02 13:47 - 00000000 ____D C:\Users\Django\Desktop\FRST-OlderVersion
2014-01-02 13:37 - 2014-01-02 13:45 - 00000613 _____ C:\Users\Django\Desktop\JRT.txt
2014-01-02 13:25 - 2014-01-02 13:25 - 00000000 ____D C:\Windows\ERUNT
2014-01-02 13:22 - 2014-01-02 13:22 - 01036305 _____ (Thisisu) C:\Users\Olvija\Desktop\JRT.exe
2014-01-02 13:08 - 2014-01-02 13:12 - 00000000 ____D C:\AdwCleaner
2014-01-02 13:07 - 2014-01-02 13:07 - 01233962 _____ C:\Users\Olvija\Desktop\adwcleaner.exe
2014-01-02 11:59 - 2014-01-02 13:24 - 00023293 _____ C:\Windows\WindowsUpdate.log
2014-01-01 12:17 - 2014-01-01 12:17 - 00018065 _____ C:\Users\Django\Desktop\gmer log.log
2014-01-01 11:59 - 2014-01-01 11:59 - 00013524 _____ C:\Users\Django\Desktop\ComboFix.txt
2014-01-01 11:51 - 2014-01-01 11:59 - 00000000 ____D C:\Qoobox
2014-01-01 11:51 - 2014-01-01 11:58 - 00000000 ____D C:\Windows\erdnt
2014-01-01 11:51 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-01 11:51 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-01 11:51 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-01 11:45 - 2014-01-01 11:48 - 00020354 _____ C:\Users\Django\Desktop\Addition.txt
2014-01-01 11:42 - 2014-01-02 13:48 - 00011005 _____ C:\Users\Django\Desktop\FRST.txt
2014-01-01 11:23 - 2014-01-01 11:23 - 05160176 ____R (Swearware) C:\Users\Django\Desktop\ComboFix.exe
2013-12-30 19:31 - 2014-01-02 13:47 - 00000000 ____D C:\FRST
2013-12-30 12:05 - 2014-01-02 13:47 - 01931426 _____ (Farbar) C:\Users\Django\Desktop\FRST64.exe
2013-12-29 11:54 - 2013-12-29 12:03 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-29 11:54 - 2013-12-29 11:54 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-29 11:53 - 2013-12-29 12:03 - 00000000 ____D C:\Users\Django\Desktop\mbar
2013-12-29 11:52 - 2013-12-29 11:52 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Django\Downloads\mbar-1.07.0.1008.exe
2013-12-29 04:31 - 2013-12-29 04:31 - 04645232 _____ (Piriform Ltd) C:\Users\Django\Downloads\ccsetup409.exe
2013-12-29 04:12 - 2014-01-01 12:48 - 00000000 ____D C:\Windows\Minidump
2013-12-29 04:10 - 2013-12-29 04:10 - 00377856 _____ C:\Users\Django\Desktop\fgqwxlyu.exe
2013-12-13 22:46 - 2013-12-13 22:46 - 00320544 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 17:01 - 2013-12-13 17:01 - 00000943 _____ C:\Users\Olvija\Desktop\King Men.lnk
2013-12-11 22:41 - 2013-12-11 22:41 - 00000000 ____D C:\Users\Olvija\.tuxguitar-1.2
2013-12-11 22:38 - 2013-12-11 22:38 - 00000000 ____D C:\Users\Django\.tuxguitar-1.2
2013-12-11 22:37 - 2013-12-11 22:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Sun
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Oracle
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-11 22:35 - 2013-12-11 22:35 - 00915368 _____ (Oracle Corporation) C:\Users\Django\Downloads\JavaSetup7u45.exe
2013-12-11 09:24 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 09:24 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 09:24 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-11 09:24 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 09:24 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 09:24 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-11 09:24 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 09:24 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 09:23 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 09:23 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 09:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 09:23 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 09:23 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 09:23 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 09:23 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2013-12-11 09:23 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 09:23 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 09:23 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 09:23 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2013-12-11 09:23 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 09:23 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-12-11 09:23 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-12-11 09:23 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-12-11 09:23 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-12-11 09:23 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2013-12-11 09:23 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml
2013-12-11 09:23 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2013-12-11 09:23 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-12-11 09:23 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-12-11 09:23 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-11 09:23 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-12-11 09:23 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll
2013-12-11 09:23 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2013-12-11 09:23 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2013-12-11 09:23 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll

==================== One Month Modified Files and Folders =======

2014-01-02 13:48 - 2014-01-01 11:42 - 00011005 _____ C:\Users\Django\Desktop\FRST.txt
2014-01-02 13:47 - 2014-01-02 13:47 - 00000000 ____D C:\Users\Django\Desktop\FRST-OlderVersion
2014-01-02 13:47 - 2013-12-30 19:31 - 00000000 ____D C:\FRST
2014-01-02 13:47 - 2013-12-30 12:05 - 01931426 _____ (Farbar) C:\Users\Django\Desktop\FRST64.exe
2014-01-02 13:46 - 2013-02-23 16:42 - 00000408 _____ C:\Users\Olvija\AppData\Roaming\sp_data.sys
2014-01-02 13:46 - 2013-02-23 13:51 - 00000408 _____ C:\Users\Django\AppData\Roaming\sp_data.sys
2014-01-02 13:45 - 2014-01-02 13:37 - 00000613 _____ C:\Users\Django\Desktop\JRT.txt
2014-01-02 13:45 - 2013-02-23 18:58 - 00164352 ___SH C:\Users\Django\Desktop\Thumbs.db
2014-01-02 13:31 - 2013-02-23 16:48 - 00694784 ___SH C:\Users\Olvija\Desktop\Thumbs.db
2014-01-02 13:25 - 2014-01-02 13:25 - 00000000 ____D C:\Windows\ERUNT
2014-01-02 13:24 - 2014-01-02 11:59 - 00023293 _____ C:\Windows\WindowsUpdate.log
2014-01-02 13:22 - 2014-01-02 13:22 - 01036305 _____ (Thisisu) C:\Users\Olvija\Desktop\JRT.exe
2014-01-02 13:14 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-02 13:12 - 2014-01-02 13:08 - 00000000 ____D C:\AdwCleaner
2014-01-02 13:07 - 2014-01-02 13:07 - 01233962 _____ C:\Users\Olvija\Desktop\adwcleaner.exe
2014-01-02 13:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-01 12:48 - 2013-12-29 04:12 - 00000000 ____D C:\Windows\Minidump
2014-01-01 12:17 - 2014-01-01 12:17 - 00018065 _____ C:\Users\Django\Desktop\gmer log.log
2014-01-01 11:59 - 2014-01-01 11:59 - 00013524 _____ C:\Users\Django\Desktop\ComboFix.txt
2014-01-01 11:59 - 2014-01-01 11:51 - 00000000 ____D C:\Qoobox
2014-01-01 11:59 - 2012-07-26 06:37 - 00000000 __RHD C:\Users\Default
2014-01-01 11:58 - 2014-01-01 11:51 - 00000000 ____D C:\Windows\erdnt
2014-01-01 11:57 - 2012-07-26 06:26 - 00000215 _____ C:\Windows\system.ini
2014-01-01 11:48 - 2014-01-01 11:45 - 00020354 _____ C:\Users\Django\Desktop\Addition.txt
2014-01-01 11:23 - 2014-01-01 11:23 - 05160176 ____R (Swearware) C:\Users\Django\Desktop\ComboFix.exe
2014-01-01 04:57 - 2013-05-31 19:19 - 00000000 ____D C:\pic 2
2014-01-01 04:50 - 2012-08-03 00:02 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-01 04:50 - 2012-08-03 00:02 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-01 04:50 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-01 04:48 - 2013-07-07 03:26 - 00000000 ____D C:\Users\Olvija\AppData\Roaming\vlc
2014-01-01 03:17 - 2013-08-08 16:56 - 00000000 ____D C:\Movies 2
2013-12-31 19:46 - 2013-03-05 11:33 - 00000000 ____D C:\Users\Olvija\AppData\Roaming\dvdcss
2013-12-30 10:40 - 2013-02-23 14:41 - 00002776 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-12-29 12:03 - 2013-12-29 11:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-29 12:03 - 2013-12-29 11:53 - 00000000 ____D C:\Users\Django\Desktop\mbar
2013-12-29 11:54 - 2013-12-29 11:54 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-29 11:52 - 2013-12-29 11:52 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Django\Downloads\mbar-1.07.0.1008.exe
2013-12-29 04:32 - 2013-02-23 14:41 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-29 04:32 - 2013-02-23 14:41 - 00000000 ____D C:\Program Files\CCleaner
2013-12-29 04:31 - 2013-12-29 04:31 - 04645232 _____ (Piriform Ltd) C:\Users\Django\Downloads\ccsetup409.exe
2013-12-29 04:10 - 2013-12-29 04:10 - 00377856 _____ C:\Users\Django\Desktop\fgqwxlyu.exe
2013-12-27 18:27 - 2013-02-23 13:56 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-164380009-2066086905-4240964568-1002
2013-12-27 11:25 - 2013-02-23 16:47 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-164380009-2066086905-4240964568-1005
2013-12-27 00:28 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-12-26 17:49 - 2013-02-24 03:41 - 00000000 ____D C:\Program Files (x86)\No23 Recorder
2013-12-19 03:03 - 2013-02-23 15:03 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-14 10:10 - 2013-07-20 15:29 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 10:09 - 2013-02-23 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-13 22:46 - 2013-12-13 22:46 - 00320544 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 17:01 - 2013-12-13 17:01 - 00000943 _____ C:\Users\Olvija\Desktop\King Men.lnk
2013-12-12 00:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-12-11 22:41 - 2013-12-11 22:41 - 00000000 ____D C:\Users\Olvija\.tuxguitar-1.2
2013-12-11 22:41 - 2013-02-23 16:41 - 00000000 ____D C:\Users\Olvija
2013-12-11 22:38 - 2013-12-11 22:38 - 00000000 ____D C:\Users\Django\.tuxguitar-1.2
2013-12-11 22:38 - 2013-02-23 13:47 - 00000000 ____D C:\Users\Django
2013-12-11 22:37 - 2013-12-11 22:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Sun
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Oracle
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-11 22:35 - 2013-12-11 22:35 - 00915368 _____ (Oracle Corporation) C:\Users\Django\Downloads\JavaSetup7u45.exe
2013-12-11 21:20 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2013-12-11 09:31 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2013-12-11 02:14 - 2013-08-08 02:46 - 00000000 ____D C:\Users\Django\AppData\Roaming\vlc
2013-12-04 01:53 - 2013-11-14 23:06 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-04 01:53 - 2013-11-14 23:06 - 00078304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-28 11:55

==================== End Of Log ============================

--- --- ---

Addition log:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-01-2014 01
Ran by Django at 2014-01-02 13:50:57
Running from C:\Users\Django\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.) Hidden
Arena 3.0 (x32 Version:  - )
ASUS Instant Connect (x32 Version: 1.2.8 - ASUS)
ASUS InstantOn (x32 Version: 3.0.2 - ASUS)
ASUS LifeFrame3 (x32 Version: 3.1.4 - ASUS)
ASUS Live Update (x32 Version: 3.1.9 - ASUS)
ASUS Power4Gear Hybrid (Version: 2.0.4 - ASUS)
ASUS Smart Gesture (x32 Version: 1.0.35 - ASUS)
ASUS Splendid Video Enhancement Technology (x32 Version: 1.03.0004 - ASUS)
ASUS Tutor (x32 Version: 1.0.7 - ASUS)
ASUS USB Charger Plus (x32 Version: 2.1.4 - ASUS)
ASUS WebStorage Sync Agent (x32 Version: 1.1.9.120 - ASUS Cloud Corporation)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
AsusVibe2.0 (x32 Version: 2.0.10.168 - ASUSTEK)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.7 - Atheros Communications Inc.)
ATK Package (x32 Version: 1.0.0023 - ASUS)
avast! Free Antivirus (x32 Version: 9.0.2008 - Avast Software)
BestPractice (remove only) (x32 Version:  - )
CCleaner (Version: 4.09 - Piriform)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
Elevated Installer (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries) Hidden
ElsterFormular (x32 Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
Garmin Express (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries) Hidden
Garmin Update Service (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
IrfanView (remove only) (x32 Version: 4.35 - Irfan Skiljan)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
No23 Recorder (x32 Version: 2.1.0.3 - No23)
No23 Recorder (x32 Version: 2.1.0.3 - No23) Hidden
NVIDIA GeForce Experience 1.7 (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 320.49 (Version: 320.49 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation) Hidden
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 9.3.21 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.9 (Version: 1.2.9 - NVIDIA Corporation)
OpenOffice 4.0.0 (x32 Version: 4.00.9702 - Apache Software Foundation)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Ralink RT2860 Wireless LAN Card (x32 Version: 1.2.0.40 - Ralink)
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation) Hidden
Skype™ 6.5 (x32 Version: 6.5.158 - Skype Technologies S.A.)
StreamTransport version: 1.0.2.2171 (x32 Version:  - )
System Requirements Lab for Intel (x32 Version: 4.5.13.0 - Husdawg, LLC)
ToneLabSE SoundEditor for Windows (x32 Version: 1.01.0000 - KORG INC.)
TuxGuitar (x32 Version: 1.2 - Herac)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VIA Platform Device Manager (x32 Version: 1.39 - VIA Technologies, Inc.)
VLC media player 1.1.10 (x32 Version: 1.1.10 - VideoLAN)
Windows 8 Desktop Gadgets (Version: 1.1 - PainteR)
Windows-Treiberpaket - ASUS (ATP) Mouse  (10/29/2012 1.0.0.148) (Version: 10/29/2012 1.0.0.148 - ASUS)
WinFlash (x32 Version: 2.41.1 - ASUS)

==================== Restore Points  =========================

11-12-2013 21:36:13 Installed Java 7 Update 45
22-12-2013 00:15:23 Geplanter Prüfpunkt
31-12-2013 02:10:20 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2012-07-26 06:26 - 2014-01-01 11:57 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {01206804-D630-40EF-A50B-3603FEBA427B} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-11-29] (AVAST Software)
Task: {196A9296-914F-4AEA-8467-83867E678A7A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {34A00163-42F9-4BC0-8868-94E08AC935A4} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)
Task: {492F7490-BA15-4E08-8BB7-DC699D55737D} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {4CC959CC-AD8F-4AE6-B285-7F0B87C68359} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {565BB633-6C8C-4421-8D4E-A19E47AE1B26} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {8D53155D-4C63-422B-8D27-662165D2262B} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {9F4734B1-8AF6-42CC-9F53-9146D52BF818} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AE9C914B-113B-413A-8A06-BF481A7ABAD2} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-10-31] (AsusTek)
Task: {C687CD98-AB42-4100-8D0A-E560A2F59035} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D10EA283-3516-4C92-A34D-5694E7F9ACF6} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\MouseKeyboardCenter.exe [2013-05-13] (Microsoft)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {FE7E1AA9-9F9C-46CB-9B86-1A33C3EB0E46} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)

==================== Loaded Modules (whitelisted) =============

2012-08-24 18:26 - 2012-08-24 18:26 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2012-09-21 03:56 - 2012-08-15 18:52 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2012-11-01 11:39 - 2012-08-16 11:04 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2012-11-01 11:39 - 2012-08-16 11:04 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2014-01-02 12:48 - 2014-01-02 11:43 - 02152960 _____ () C:\Program Files\AVAST Software\Avast\defs\14010200\algo.dll
2012-11-01 11:36 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-08-24 18:17 - 2012-08-24 18:17 - 00009216 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
2013-02-23 16:34 - 2013-02-10 04:25 - 00004096 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-11-29 22:45 - 2013-11-29 22:45 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: 802.11n Wireless LAN Card
Description: 802.11n Wireless LAN Card
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Ralink Technology, Corp.
Service: netr28x
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-01-01 11:57:01.558
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Percentage of memory in use: 22%
Total physical RAM: 6029.71 MB
Available physical RAM: 4692.54 MB
Total Pagefile: 12173.71 MB
Available Pagefile: 10767.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:11.53 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:398.17 GB) (Free:16.19 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 944CB54D)

Partition: GPT Partition Type
==================== End Of Log ============================

Noch Combofix Quarantine Log:

Code:

ATTFilter

2014-01-01 10:58:49 . 2014-01-01 10:58:49               92 ----a-w-  C:\Qoobox\Quarantine\Registry_backups\Toolbar-Locked.reg.dat
2014-01-01 10:58:37 . 2014-01-01 10:58:37              104 ----a-w-  C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-Toolbar-Locked.reg.dat
2014-01-01 10:55:52 . 2014-01-01 10:55:52            9,225 ----a-w-  C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2014-01-01 10:51:42 . 2014-01-01 10:51:42               51 ----a-w-  C:\Qoobox\Quarantine\catchme.log
2013-07-16 13:40:58 . 2013-07-16 13:40:58          475,136 ----a-w-  C:\Qoobox\Quarantine\C\Program Files (x86)\Setup.exe.vir
2012-07-13 14:17:22 . 2012-07-13 14:17:22          348,160 ----a-w-  C:\Qoobox\Quarantine\C\Windows\msvcr71.dll.vir

Danke und Gruß

Cliff

schrauber · 03.01.2014, 12:17

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Cliff-Gallup · 03.01.2014, 17:07

Hallo Schrauber,

ESET log:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a7cdcdd961500245985839521a87f4fb
# engine=16499
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-03 01:00:36
# local_time=2014-01-03 02:00:36 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT 
# compatibility_mode=774 16777213 85 83 2992415 165463908 0 0
# compatibility_mode=5893 16776574 100 94 12276939 48260147 0 0
# scanned=150385
# found=0
# cleaned=0
# scan_time=4690

Security Check log:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.78  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
avast! Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java 7 Update 45  
 Adobe Reader 10.1.8 Adobe Reader out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

Der Eintrag: "Adobe Reader out of Date!" stimmt nicht, wenn ich den Adobe Update starte, kommt die Meldung: Keine Updates verfügbar.
Und mein IE ist auch aktuell, habe automatische Updates aktiviert.

FRST log:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-01-2014
Ran by Django (administrator) on OSCAR on 03-01-2014 16:23:58
Running from C:\Users\Django\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ACMON] - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [107192 2012-08-24] (ASUS)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5264016 2012-08-16] (VIA)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe [3417984 2012-08-28] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2014-01-03] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1093464 2013-07-22] (Garmin Ltd or its subsidiaries)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.13.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) =================

R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-01-03] (AVAST Software)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [219480 2013-07-22] (Garmin Ltd or its subsidiaries)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-08] (NVIDIA Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-14] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-01-03] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2014-01-03] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2014-01-03] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-03] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-03] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [89304 2013-12-29] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [x]
U0 msahci; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-03 14:15 - 2014-01-03 14:15 - 00000827 _____ C:\Users\Django\Desktop\checkup.txt
2014-01-03 14:07 - 2014-01-03 14:08 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-01-03 14:03 - 2014-01-03 14:03 - 00987410 _____ C:\Users\Django\Desktop\SecurityCheck.exe
2014-01-03 12:39 - 2014-01-03 12:39 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-03 12:37 - 2014-01-03 12:37 - 02347384 _____ (ESET) C:\Users\Django\Downloads\esetsmartinstaller_enu.exe
2014-01-02 14:29 - 2014-01-03 16:20 - 00046011 _____ C:\Windows\WindowsUpdate.log
2014-01-02 13:47 - 2014-01-03 16:23 - 00000000 ____D C:\Users\Django\Desktop\FRST-OlderVersion
2014-01-02 13:37 - 2014-01-02 13:45 - 00000613 _____ C:\Users\Django\Desktop\JRT.txt
2014-01-02 13:25 - 2014-01-02 13:25 - 00000000 ____D C:\Windows\ERUNT
2014-01-02 13:22 - 2014-01-02 13:22 - 01036305 _____ (Thisisu) C:\Users\Olvija\Desktop\JRT.exe
2014-01-02 13:08 - 2014-01-02 13:12 - 00000000 ____D C:\AdwCleaner
2014-01-02 13:07 - 2014-01-02 13:07 - 01233962 _____ C:\Users\Olvija\Desktop\adwcleaner.exe
2014-01-01 12:17 - 2014-01-01 12:17 - 00018065 _____ C:\Users\Django\Desktop\gmer log.log
2014-01-01 11:59 - 2014-01-01 11:59 - 00013524 _____ C:\Users\Django\Desktop\ComboFix.txt
2014-01-01 11:51 - 2014-01-01 11:59 - 00000000 ____D C:\Qoobox
2014-01-01 11:51 - 2014-01-01 11:58 - 00000000 ____D C:\Windows\erdnt
2014-01-01 11:51 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-01 11:51 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-01 11:51 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-01 11:51 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-01 11:45 - 2014-01-02 13:53 - 00012860 _____ C:\Users\Django\Desktop\Addition.txt
2014-01-01 11:42 - 2014-01-03 16:24 - 00009678 _____ C:\Users\Django\Desktop\FRST.txt
2014-01-01 11:23 - 2014-01-01 11:23 - 05160176 ____R (Swearware) C:\Users\Django\Desktop\ComboFix.exe
2013-12-30 19:31 - 2014-01-03 16:23 - 00000000 ____D C:\FRST
2013-12-30 12:05 - 2014-01-03 16:23 - 01931750 _____ (Farbar) C:\Users\Django\Desktop\FRST64.exe
2013-12-29 11:54 - 2013-12-29 12:03 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-29 11:54 - 2013-12-29 11:54 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-29 11:53 - 2013-12-29 12:03 - 00000000 ____D C:\Users\Django\Desktop\mbar
2013-12-29 11:52 - 2013-12-29 11:52 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Django\Downloads\mbar-1.07.0.1008.exe
2013-12-29 04:31 - 2013-12-29 04:31 - 04645232 _____ (Piriform Ltd) C:\Users\Django\Downloads\ccsetup409.exe
2013-12-29 04:12 - 2014-01-01 12:48 - 00000000 ____D C:\Windows\Minidump
2013-12-29 04:10 - 2013-12-29 04:10 - 00377856 _____ C:\Users\Django\Desktop\fgqwxlyu.exe
2013-12-13 22:46 - 2013-12-13 22:46 - 00320544 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 17:01 - 2013-12-13 17:01 - 00000943 _____ C:\Users\Olvija\Desktop\King Men.lnk
2013-12-11 22:41 - 2013-12-11 22:41 - 00000000 ____D C:\Users\Olvija\.tuxguitar-1.2
2013-12-11 22:38 - 2013-12-11 22:38 - 00000000 ____D C:\Users\Django\.tuxguitar-1.2
2013-12-11 22:37 - 2013-12-11 22:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Sun
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Oracle
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-11 22:35 - 2013-12-11 22:35 - 00915368 _____ (Oracle Corporation) C:\Users\Django\Downloads\JavaSetup7u45.exe
2013-12-11 09:24 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-12-11 09:24 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 09:24 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 09:24 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 09:24 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-11 09:24 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 09:24 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 09:24 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-11 09:24 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-11 09:24 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 09:24 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 09:23 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 09:23 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 09:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 09:23 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 09:23 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 09:23 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 09:23 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2013-12-11 09:23 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 09:23 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 09:23 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 09:23 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2013-12-11 09:23 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 09:23 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-12-11 09:23 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-12-11 09:23 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-12-11 09:23 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-12-11 09:23 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-12-11 09:23 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-12-11 09:23 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2013-12-11 09:23 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml
2013-12-11 09:23 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2013-12-11 09:23 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-12-11 09:23 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-12-11 09:23 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-11 09:23 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-12-11 09:23 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll
2013-12-11 09:23 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2013-12-11 09:23 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2013-12-11 09:23 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll

==================== One Month Modified Files and Folders =======

2014-01-03 16:24 - 2014-01-01 11:42 - 00009678 _____ C:\Users\Django\Desktop\FRST.txt
2014-01-03 16:23 - 2014-01-02 13:47 - 00000000 ____D C:\Users\Django\Desktop\FRST-OlderVersion
2014-01-03 16:23 - 2013-12-30 19:31 - 00000000 ____D C:\FRST
2014-01-03 16:23 - 2013-12-30 12:05 - 01931750 _____ (Farbar) C:\Users\Django\Desktop\FRST64.exe
2014-01-03 16:22 - 2013-02-23 18:58 - 00164864 ___SH C:\Users\Django\Desktop\Thumbs.db
2014-01-03 16:22 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-03 16:21 - 2013-02-23 13:51 - 00000408 _____ C:\Users\Django\AppData\Roaming\sp_data.sys
2014-01-03 16:20 - 2014-01-02 14:29 - 00046011 _____ C:\Windows\WindowsUpdate.log
2014-01-03 14:15 - 2014-01-03 14:15 - 00000827 _____ C:\Users\Django\Desktop\checkup.txt
2014-01-03 14:09 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-03 14:08 - 2014-01-03 14:07 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-01-03 14:08 - 2013-02-23 15:03 - 00001968 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-01-03 14:07 - 2013-03-07 12:44 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2014-01-03 14:07 - 2013-02-23 15:03 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-01-03 14:07 - 2013-02-23 15:03 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-01-03 14:07 - 2013-02-23 15:03 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-01-03 14:07 - 2013-02-23 15:03 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-01-03 14:07 - 2013-02-23 15:03 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-03 14:07 - 2013-02-23 15:02 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-01-03 14:03 - 2014-01-03 14:03 - 00987410 _____ C:\Users\Django\Desktop\SecurityCheck.exe
2014-01-03 12:39 - 2014-01-03 12:39 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-03 12:37 - 2014-01-03 12:37 - 02347384 _____ (ESET) C:\Users\Django\Downloads\esetsmartinstaller_enu.exe
2014-01-03 11:36 - 2013-02-23 16:48 - 00690176 ___SH C:\Users\Olvija\Desktop\Thumbs.db
2014-01-03 11:36 - 2013-02-23 16:42 - 00000408 _____ C:\Users\Olvija\AppData\Roaming\sp_data.sys
2014-01-03 03:14 - 2013-07-07 03:26 - 00000000 ____D C:\Users\Olvija\AppData\Roaming\vlc
2014-01-03 00:53 - 2013-08-08 16:56 - 00000000 ____D C:\Movies 2
2014-01-02 16:18 - 2012-08-03 00:02 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-02 16:18 - 2012-08-03 00:02 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-02 16:18 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-02 13:53 - 2014-01-01 11:45 - 00012860 _____ C:\Users\Django\Desktop\Addition.txt
2014-01-02 13:45 - 2014-01-02 13:37 - 00000613 _____ C:\Users\Django\Desktop\JRT.txt
2014-01-02 13:25 - 2014-01-02 13:25 - 00000000 ____D C:\Windows\ERUNT
2014-01-02 13:22 - 2014-01-02 13:22 - 01036305 _____ (Thisisu) C:\Users\Olvija\Desktop\JRT.exe
2014-01-02 13:12 - 2014-01-02 13:08 - 00000000 ____D C:\AdwCleaner
2014-01-02 13:07 - 2014-01-02 13:07 - 01233962 _____ C:\Users\Olvija\Desktop\adwcleaner.exe
2014-01-01 12:48 - 2013-12-29 04:12 - 00000000 ____D C:\Windows\Minidump
2014-01-01 12:17 - 2014-01-01 12:17 - 00018065 _____ C:\Users\Django\Desktop\gmer log.log
2014-01-01 11:59 - 2014-01-01 11:59 - 00013524 _____ C:\Users\Django\Desktop\ComboFix.txt
2014-01-01 11:59 - 2014-01-01 11:51 - 00000000 ____D C:\Qoobox
2014-01-01 11:59 - 2012-07-26 06:37 - 00000000 __RHD C:\Users\Default
2014-01-01 11:58 - 2014-01-01 11:51 - 00000000 ____D C:\Windows\erdnt
2014-01-01 11:57 - 2012-07-26 06:26 - 00000215 _____ C:\Windows\system.ini
2014-01-01 11:23 - 2014-01-01 11:23 - 05160176 ____R (Swearware) C:\Users\Django\Desktop\ComboFix.exe
2014-01-01 04:57 - 2013-05-31 19:19 - 00000000 ____D C:\pic 2
2013-12-31 19:46 - 2013-03-05 11:33 - 00000000 ____D C:\Users\Olvija\AppData\Roaming\dvdcss
2013-12-30 10:40 - 2013-02-23 14:41 - 00002776 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-12-29 12:03 - 2013-12-29 11:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-29 12:03 - 2013-12-29 11:53 - 00000000 ____D C:\Users\Django\Desktop\mbar
2013-12-29 11:54 - 2013-12-29 11:54 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-29 11:52 - 2013-12-29 11:52 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Django\Downloads\mbar-1.07.0.1008.exe
2013-12-29 04:32 - 2013-02-23 14:41 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-29 04:32 - 2013-02-23 14:41 - 00000000 ____D C:\Program Files\CCleaner
2013-12-29 04:31 - 2013-12-29 04:31 - 04645232 _____ (Piriform Ltd) C:\Users\Django\Downloads\ccsetup409.exe
2013-12-29 04:10 - 2013-12-29 04:10 - 00377856 _____ C:\Users\Django\Desktop\fgqwxlyu.exe
2013-12-27 18:27 - 2013-02-23 13:56 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-164380009-2066086905-4240964568-1002
2013-12-27 11:25 - 2013-02-23 16:47 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-164380009-2066086905-4240964568-1005
2013-12-27 00:28 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-12-26 17:49 - 2013-02-24 03:41 - 00000000 ____D C:\Program Files (x86)\No23 Recorder
2013-12-14 10:10 - 2013-07-20 15:29 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 10:09 - 2013-02-23 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-13 22:46 - 2013-12-13 22:46 - 00320544 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 17:01 - 2013-12-13 17:01 - 00000943 _____ C:\Users\Olvija\Desktop\King Men.lnk
2013-12-12 00:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-12-11 22:41 - 2013-12-11 22:41 - 00000000 ____D C:\Users\Olvija\.tuxguitar-1.2
2013-12-11 22:41 - 2013-02-23 16:41 - 00000000 ____D C:\Users\Olvija
2013-12-11 22:38 - 2013-12-11 22:38 - 00000000 ____D C:\Users\Django\.tuxguitar-1.2
2013-12-11 22:38 - 2013-02-23 13:47 - 00000000 ____D C:\Users\Django
2013-12-11 22:37 - 2013-12-11 22:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-12-11 22:37 - 2013-12-11 22:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Sun
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\ProgramData\Oracle
2013-12-11 22:37 - 2013-12-11 22:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-11 22:35 - 2013-12-11 22:35 - 00915368 _____ (Oracle Corporation) C:\Users\Django\Downloads\JavaSetup7u45.exe
2013-12-11 21:20 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2013-12-11 09:31 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2013-12-11 02:14 - 2013-08-08 02:46 - 00000000 ____D C:\Users\Django\AppData\Roaming\vlc
2013-12-04 01:53 - 2013-11-14 23:06 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-04 01:53 - 2013-11-14 23:06 - 00078304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-28 11:55

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition log:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-01-2014
Ran by Django at 2014-01-03 16:27:08
Running from C:\Users\Django\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.) Hidden
Arena 3.0 (x32 Version:  - )
ASUS Instant Connect (x32 Version: 1.2.8 - ASUS)
ASUS InstantOn (x32 Version: 3.0.2 - ASUS)
ASUS LifeFrame3 (x32 Version: 3.1.4 - ASUS)
ASUS Live Update (x32 Version: 3.1.9 - ASUS)
ASUS Power4Gear Hybrid (Version: 2.0.4 - ASUS)
ASUS Smart Gesture (x32 Version: 1.0.35 - ASUS)
ASUS Splendid Video Enhancement Technology (x32 Version: 1.03.0004 - ASUS)
ASUS Tutor (x32 Version: 1.0.7 - ASUS)
ASUS USB Charger Plus (x32 Version: 2.1.4 - ASUS)
ASUS WebStorage Sync Agent (x32 Version: 1.1.9.120 - ASUS Cloud Corporation)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
AsusVibe2.0 (x32 Version: 2.0.10.168 - ASUSTEK)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.7 - Atheros Communications Inc.)
ATK Package (x32 Version: 1.0.0023 - ASUS)
avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)
BestPractice (remove only) (x32 Version:  - )
CCleaner (Version: 4.09 - Piriform)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
Elevated Installer (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries) Hidden
ElsterFormular (x32 Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
ESET Online Scanner v3 (x32 Version:  - )
Garmin Express (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries) Hidden
Garmin Update Service (x32 Version: 2.2.17 - Garmin Ltd or its subsidiaries) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
IrfanView (remove only) (x32 Version: 4.35 - Irfan Skiljan)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
No23 Recorder (x32 Version: 2.1.0.3 - No23)
No23 Recorder (x32 Version: 2.1.0.3 - No23) Hidden
NVIDIA GeForce Experience 1.7 (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 320.49 (Version: 320.49 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation) Hidden
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 9.3.21 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.9 (Version: 1.2.9 - NVIDIA Corporation)
OpenOffice 4.0.0 (x32 Version: 4.00.9702 - Apache Software Foundation)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Ralink RT2860 Wireless LAN Card (x32 Version: 1.2.0.40 - Ralink)
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation) Hidden
Skype™ 6.5 (x32 Version: 6.5.158 - Skype Technologies S.A.)
StreamTransport version: 1.0.2.2171 (x32 Version:  - )
System Requirements Lab for Intel (x32 Version: 4.5.13.0 - Husdawg, LLC)
ToneLabSE SoundEditor for Windows (x32 Version: 1.01.0000 - KORG INC.)
TuxGuitar (x32 Version: 1.2 - Herac)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VIA Platform Device Manager (x32 Version: 1.39 - VIA Technologies, Inc.)
VLC media player 1.1.10 (x32 Version: 1.1.10 - VideoLAN)
Windows 8 Desktop Gadgets (Version: 1.1 - PainteR)
Windows-Treiberpaket - ASUS (ATP) Mouse  (10/29/2012 1.0.0.148) (Version: 10/29/2012 1.0.0.148 - ASUS)
WinFlash (x32 Version: 2.41.1 - ASUS)

==================== Restore Points  =========================

11-12-2013 21:36:13 Installed Java 7 Update 45
22-12-2013 00:15:23 Geplanter Prüfpunkt
31-12-2013 02:10:20 Geplanter Prüfpunkt
03-01-2014 13:05:59 avast! antivirus system restore point

==================== Hosts content: ==========================

2012-07-26 06:26 - 2014-01-01 11:57 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {196A9296-914F-4AEA-8467-83867E678A7A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {34A00163-42F9-4BC0-8868-94E08AC935A4} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)
Task: {492F7490-BA15-4E08-8BB7-DC699D55737D} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {4CC959CC-AD8F-4AE6-B285-7F0B87C68359} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {565BB633-6C8C-4421-8D4E-A19E47AE1B26} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {57EDF433-2E01-46C2-B915-043FCB8D5EC3} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-01-03] (AVAST Software)
Task: {8D53155D-4C63-422B-8D27-662165D2262B} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {9F4734B1-8AF6-42CC-9F53-9146D52BF818} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AE9C914B-113B-413A-8A06-BF481A7ABAD2} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-10-31] (AsusTek)
Task: {C687CD98-AB42-4100-8D0A-E560A2F59035} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D10EA283-3516-4C92-A34D-5694E7F9ACF6} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\MouseKeyboardCenter.exe [2013-05-13] (Microsoft)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {FE7E1AA9-9F9C-46CB-9B86-1A33C3EB0E46} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)

==================== Loaded Modules (whitelisted) =============

2012-08-24 18:26 - 2012-08-24 18:26 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2012-11-01 11:39 - 2012-08-16 11:04 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2012-11-01 11:39 - 2012-08-16 11:04 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2012-09-21 03:56 - 2012-08-15 18:52 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2014-01-03 00:30 - 2014-01-02 19:10 - 02152960 _____ () C:\Program Files\AVAST Software\Avast\defs\14010201\algo.dll
2012-11-01 11:36 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-08-24 18:17 - 2012-08-24 18:17 - 00009216 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
2013-02-23 16:34 - 2013-02-10 04:25 - 00004096 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-11-29 22:45 - 2013-11-29 22:45 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: 802.11n Wireless LAN Card
Description: 802.11n Wireless LAN Card
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Ralink Technology, Corp.
Service: netr28x
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/03/2014 02:02:55 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:41:22 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:41:20 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:41:17 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:39:45 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:39:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:39:39 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:39:39 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:39:39 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/03/2014 00:38:05 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.


System errors:
=============
Error: (01/03/2014 02:09:10 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (01/02/2014 02:34:03 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0xc000014d0


Microsoft Office Sessions:
=========================
Error: (01/03/2014 02:02:55 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:41:22 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:41:20 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:41:17 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:39:45 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:39:43 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:39:39 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:39:39 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:39:39 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe

Error: (01/03/2014 00:38:05 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Django\Downloads\esetsmartinstaller_enu.exe


CodeIntegrity Errors:
===================================
  Date: 2014-01-01 11:57:01.558
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Percentage of memory in use: 16%
Total physical RAM: 6029.71 MB
Available physical RAM: 5018.55 MB
Total Pagefile: 12173.71 MB
Available Pagefile: 11060.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:20.76 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:398.17 GB) (Free:15.66 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 944CB54D)

Partition: GPT Partition Type
==================== End Of Log ============================

Noch Probleme? Ich weiß nicht...
Gestern hatte ich im IE 3 Tabs geöffnet. 2 davon wurden umgeleitet auf "Flashplayer update".

Es sind immer die 2 gleichen Seiten, eines ist chess.com, das andere ist eine Seite von der ich Filme runterlade. Beide Websites benutzen wahrscheinlich Java oder Javascript, kann das was damit zu tun haben? Die Filmseite ist so.... mittelseriös, chess.com ist eigentlich korrekt.
Alle anderen Websites funktionieren ohne Probleme.

Ich bin immer vorsichtig im www, scanne alles was ich runterlade, klicke auf nichts, was ich nicht kenne, habe immer Avast am Laufen, habe Java fürs Internet deaktiviert und keine zweifelhaften Add-Ons für den IE.

Normalerweise habe ich auch immer den Popup-Blocker aktiviert, blocke alle Popups. Aber die beiden Webseiten funktionieren nur mit Popups. Aber wenn Werbe-Popups kommen, drücke ich sie immer gleich weg, klicke auf nichts Dubioses.

Fragen habe ich:

1. Aus dem frst log:

"Files to move or delete:
====================
C:\ProgramData\SetStretch.exe"

Was ist das, was soll ich damit machen?

2. Die Dateien die sich in der Quarantäne von Combofix und AdwCleaner befinden, was sind das für Dateien, was soll ich damit machen? Sie einfach so vor sich hin schmoren zu lassen, das beunruhigt mich irgendwie.

3. Was hat mein Notebook eigentlich für eine Infektion gehabt?
Wie kann ich sie in Zukunft verhindern? (Ich nehme an, es waren die Popups, aber die brauche ich für die 2 Websites, sonst funktionieren sie nicht.)

4. Aus dem Addition log, die Application Errors und System Errors, was ist das?
Klingt ja als wäre mein neues, Asus Notebook kurz vor dem Explodieren...

Nochmals herzlichen Dank für Deine Mühe und Hilfe, hat mir bis jetzt sehr geholfen!!!

Gruß Cliff

schrauber · 04.01.2014, 15:36

Setze folgendermassen den Internet Explorer zurück:

Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.

(Hier findest du die bebilderte Anleitung.)

Die eine Datei kannste ignorieren, genau wie die Error Meldungen, jeder Schluckauf wird da eingetragen.

Da war ne Menge Adware auf dem System.

Redirection IE10, Windows 8

Plagegeister aller Art und deren Bekämpfung: Redirection IE10, Windows 8