Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 24.01.2014, 22:47   #1
Necro0
 
Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Sehr geehrtes Trojaner-Board Team,

wie auch das vieler anderer wurde auch mein E-Mail Konto von www.sicherheitstest.bsi.de positiv getestet.
Zudem hat jemand in den letzten Tagen bei meiner Bank angerufen ( mit sämtlichen persönlichen Daten, Kontonr. usw. ) und wollte etwas von meinem Konto überweisen.
Deshalb möchte ich gerne sicher gehen und meinen PC mit Ihrer Hilfe auf Herz und Nieren durchchecken.

Ich habe vorab mal die 4 Schritte für alle Hilfesuchenden abgearbeitet.
Hier die Logs:

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:09 on 24/01/2014 (Robert)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2014
Ran by Robert (administrator) on ROBERT-PC on 24-01-2014 20:27:25
Running from C:\Users\Robert\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Gainward Co.) C:\Program Files (x86)\EXPERTool\TBPANEL.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\SetPoint\SetPoint.exe
() C:\Program Files (x86)\ASUS\TurboV\TurboV.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
() C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_w32.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_x64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\wmi64.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [TurboV] - C:\Program Files (x86)\ASUS\TurboV\TurboV.exe [4040192 2008-10-21] ()
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811728 2009-06-30] (Logitech(c))
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2008-04-15] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-03-28] (DivX, LLC)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logitech\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [GAINWARD] - C:\Program Files (x86)\EXPERTool\TBPanel.exe [2181672 2009-05-12] (Gainward Co.)
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
MountPoints2: {192e93a7-4fc1-11e0-8c22-00248c9fd597} - F:\LaunchU3.exe -a
IFEO: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1CF3E2E5C76FCA01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - DefaultScope {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {9213EACE-9E17-47A0-9C80-CD242746D912} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=588E267A-CBB7-48D0-BCE0-056EEA6E076C&apn_sauid=8948AD11-A5CB-4A78-95AD-B29C308810D0
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://isearch.avg.com/search?cid={2D9D9775-C2BD-4E15-8099-A602BFC047A0}&mid=ca395b9b148047d1a60dd1b647e4e9f2-c62222099914541bc2a95e063d81af64193236db&lang=de&ds=tt014&pr=sa&d=2011-12-18 15:04:29&v=12.2.5.32&sap=dsp&q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 10 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 11 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 12 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 24 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog5-x64 07 %SystemRoot%\system32\PrxerNsp.dll [57448] ()
Winsock: Catalog9-x64 09 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 10 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 11 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 12 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 24 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default
FF user.js: detected! => C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\user.js
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://google.de/
FF NetworkProxy: "backup.ftp", "58.20.127.100"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "58.20.127.100"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "58.20.127.100"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "80.193.214.239"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.193.214.239"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.193.214.239"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.193.214.239"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 1
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 - C:\Users\Robert\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Robert\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)
FF SearchPlugin: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Ask Toolbar - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\toolbar@ask.com [2013-10-30]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Adblock Plus - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-04]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2011-01-20]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2011-01-20]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-10-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-01]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-19]

Chrome: 
=======
CHR HomePage: 
CHR DefaultSearchKeyword: google.de_
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Free Studio) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\np_dvs_plugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (ijji Web Launching Plugin for FF) - C:\Program Files (x86)\Mozilla Firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
CHR Plugin: (Octoshape Streaming Services) - C:\Users\Robert\AppData\Roaming\Mozilla\plugins\npoctoshape.dll (Octoshape ApS)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Robert\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (ProxTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-01-19]
CHR Extension: (Google Drive) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-09-16]
CHR Extension: (Brushed) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg [2013-03-27]
CHR Extension: (YouTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-16]
CHR Extension: (Google-Suche) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-16]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2012-09-16]
CHR Extension: (AdBlock) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-09-16]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2013-01-21]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-01-19]
CHR Extension: (Virtuelle Tastatur) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2012-09-16]
CHR Extension: (FVD Downloader) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2012-11-04]
CHR Extension: (Google Wallet) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-09-16]
CHR Extension: (NotScripts) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2012-09-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2012-11-01]
CHR Extension: (Google Mail) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-16]
CHR Extension: (Anti-Banner) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2012-09-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Robert\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-15]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [86016 2008-08-15] ()
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [678416 2012-11-14] ()
S3 LBTServ; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [160784 2009-07-20] (Logitech, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-01] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 TeamViewer8; E:\Programme\Teamviewer\TeamViewer_Service.exe [5087584 2013-10-01] (TeamViewer GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)
S3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2009-12-03] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [160784 2012-11-14] (<Turtle Entertainment>)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-19] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-19] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-19] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [61712 2009-05-28] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [376848 2009-05-28] (Logitech)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-08-28] (TuneUp Software)
S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [20480 2010-08-24] (Motorola)
S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-24 20:17 - 2014-01-24 20:17 - 00044110 _____ C:\Users\Robert\Desktop\Addition.txt
2014-01-24 20:16 - 2014-01-24 20:28 - 00034673 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:11 - 2014-01-24 20:11 - 02077696 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-24 20:09 - 2014-01-24 20:16 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-21 21:57 - 2014-01-21 22:15 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:51 - 2014-01-19 22:36 - 00000000 ____D C:\Profi cash
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:19 - 2014-01-19 17:18 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-24 20:25 - 00422572 _____ C:\Windows\setupact.log
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-24 19:36 - 00007240 _____ C:\Windows\PFRO.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:55 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-18 07:54 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-18 07:54 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-15 16:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

==================== One Month Modified Files and Folders =======

2014-01-24 20:28 - 2014-01-24 20:16 - 00034673 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-24 20:28 - 2009-12-11 17:22 - 01864262 _____ C:\Windows\WindowsUpdate.log
2014-01-24 20:26 - 2013-04-08 10:59 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-24 20:25 - 2014-01-18 15:26 - 00422572 _____ C:\Windows\setupact.log
2014-01-24 20:25 - 2012-11-24 16:45 - 00000000 ____D C:\ProgramData\VMware
2014-01-24 20:25 - 2009-08-13 22:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-24 20:25 - 2009-08-05 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-24 20:25 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-24 20:17 - 2014-01-24 20:17 - 00044110 _____ C:\Users\Robert\Desktop\Addition.txt
2014-01-24 20:16 - 2014-01-24 20:09 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:15 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-24 20:15 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:11 - 2014-01-24 20:11 - 02077696 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-24 20:09 - 2009-12-11 17:03 - 00000000 ____D C:\Users\Robert
2014-01-24 20:08 - 2011-06-27 16:17 - 00000000 ____D C:\Users\Robert\AppData\Local\PMB Files
2014-01-24 19:51 - 2012-09-16 13:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
2014-01-24 19:45 - 2010-03-07 03:07 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{17212944-8BF8-4509-BFF6-0D177AC05DDE}
2014-01-24 19:36 - 2014-01-18 15:25 - 00007240 _____ C:\Windows\PFRO.log
2014-01-24 00:51 - 2012-09-16 13:47 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
2014-01-23 23:48 - 2012-10-03 00:08 - 00000000 ____D C:\Users\Robert\AppData\Roaming\vlc
2014-01-23 07:44 - 2011-03-31 17:32 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-01-22 19:33 - 2009-07-14 18:58 - 00747994 _____ C:\Windows\system32\perfh007.dat
2014-01-22 19:33 - 2009-07-14 18:58 - 00170676 _____ C:\Windows\system32\perfc007.dat
2014-01-22 19:33 - 2009-07-14 06:13 - 01751820 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-22 18:48 - 2013-09-15 15:53 - 00000000 ____D C:\Users\Robert\AppData\Local\Deployment
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-22 16:28 - 2009-08-05 18:41 - 00000000 ___RD C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-22 10:30 - 2013-07-12 15:42 - 00000000 ____D C:\Users\Robert\AppData\Local\TSVNCache
2014-01-21 22:15 - 2014-01-21 21:57 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 22:36 - 2014-01-19 20:51 - 00000000 ____D C:\Profi cash
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:52 - 2006-11-02 13:34 - 00000237 _____ C:\Windows\win.ini
2014-01-19 20:49 - 2012-09-15 20:17 - 00000000 ____D C:\Users\Robert\AppData\Roaming\QuickScan
2014-01-19 20:11 - 2013-10-17 15:47 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-19 20:11 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-19 20:11 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:27 - 2009-12-02 12:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2014-01-19 17:19 - 2011-01-20 12:32 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-19 17:18 - 2014-01-19 17:19 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-19 03:14 - 2013-04-19 18:24 - 00768000 ___SH C:\Users\Robert\Thumbs.db
2014-01-19 03:06 - 2013-07-12 14:27 - 00000000 ____D C:\Users\Robert\AppData\Local\Package Cache
2014-01-19 00:47 - 2010-02-03 15:13 - 00000000 ____D C:\Users\Robert\AppData\Roaming\TS3Client
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 08:24 - 2009-12-11 18:16 - 00003704 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2014-01-18 08:13 - 2013-06-22 18:18 - 00000000 ____D C:\Users\Robert\Desktop\WOW WICHTIG!
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-07-01 22:56 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-17 21:58 - 2009-08-14 17:31 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Skype
2014-01-17 21:57 - 2011-05-12 18:30 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-17 21:57 - 2009-08-13 21:42 - 00000000 ____D C:\ProgramData\Skype
2014-01-17 21:53 - 2012-09-15 18:43 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-17 20:36 - 2009-12-11 17:02 - 01725164 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-17 20:34 - 2013-08-17 03:45 - 00000000 ____D C:\Windows\system32\MRT
2014-01-17 20:31 - 2010-01-14 17:47 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:52 - 2012-09-16 14:21 - 00002362 _____ C:\Users\Robert\Desktop\Google Chrome.lnk
2014-01-13 20:23 - 2009-10-24 17:27 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2014-01-11 20:04 - 2013-07-12 14:25 - 00000000 ____D C:\Users\Robert\Downloads\HonorB
2014-01-11 00:52 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Local\VMware
2014-01-09 20:45 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Roaming\VMware
2014-01-09 14:56 - 2009-08-27 15:10 - 00000000 ___RD C:\Users\Robert\Wichtiges
2014-01-04 15:37 - 2013-07-12 15:51 - 00000000 ____D C:\Users\Robert\AppData\Local\HonorbuddyMeshes

Some content of TEMP:
====================
C:\Users\Robert\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-19 00:16

==================== End Of Log ============================
         
--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2014
Ran by Robert at 2014-01-24 20:28:46
Running from C:\Users\Robert\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (x32 Version: 10.1.9 - Adobe Systems Incorporated)
Ask Toolbar (x32 Version: 1.15.15.0 - Ask.com) <==== ATTENTION
Ask Toolbar Updater (HKCU Version: 1.2.4.36191 - Ask.com) <==== ATTENTION
Assassin's Creed Revelations 1.03 (x32 Version: 1.03 - Ubisoft)
Avira Antivirus Premium (x32 Version: 14.0.2.286 - Avira)
Badaboom 1.1.1.241 (x32 Version: 1.1.1.241 - Elemental Technologies)
Battlefield 3™ (x32 Version: 1.4.0.0 - Electronic Arts)
Battlefield 4™ Beta (x32 Version: 1.0.0.0 - Electronic Arts)
Call of Duty: Black Ops II - Multiplayer (x32 Version:  - )
Call of Duty: Black Ops II (x32 Version:  - Treyarch)
CCleaner (Version: 4.08 - Piriform)
CDDRV_Installer (Version: 4.60 - Logitech) Hidden
Cool & Quiet (x32 Version:  - )
Counter-Strike: Global Offensive Beta (x32 Version:  - )
Counter-Strike: Source (x32 Version: 1.0.0.0 - Valve)
Curse Client (HKCU Version: 5.1.1.792 - Curse)
DivX Converter (x32 Version: 7.1.0 - DivX, Inc.)
DivX Plus DirectShow Filters (x32 Version:  - DivX, Inc.)
DivX-Setup (x32 Version: 2.6.1.28 - DivX, LLC)
EasyBits GO (HKCU Version:  - EasyBits Media)
EPU-6 Engine (x32 Version: 1.00.28 - )
erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden
ESL Wire 1.15 (Version:  - Turtle Entertainment GmbH)
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
EXPERTool 7.5 (x32 Version:  - Gainward Co., Ltd)
Express Gate Updater (x32 Version: 1.1.1.2 - DeviceVM)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.23.0 - MAGIX AG)
Free YouTube to MP3 Converter version 3.12.12.827 (x32 Version: 3.12.12.827 - DVDVideoSoft Ltd.)
GameSpy Comrade (x32 Version: 1.5.0.156 - GameSpy)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKCU Version: 32.0.1700.76 - Google Inc.)
Google Update Helper (x32 Version: 1.3.21.111 - Google Inc.) Hidden
Heroes of Newerth (x32 Version: 2.3.0 - S2 Games)
Honorbuddy (HKCU Version: 2.5.7291.636 - Bossland GmbH)
Honorbuddy (HKCU Version: 2.5.7346.637 - Bossland GmbH)
Honorbuddy (HKCU Version: 2.5.9468.722 - Bossland GmbH)
Honorbuddy (x32 Version: 2.5.9468.722 - Bossland GmbH) Hidden
Host OpenAL (ADI) (x32 Version:  - )
ICQ7.2 (x32 Version: 7.2 - ICQ)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden
Logitech G35 (Version: 1.0.152 - Logitech)
Logitech SetPoint (x32 Version: 4.80 - Logitech)
MAGIX Screenshare (x32 Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (x32 Version: 7.0.2.7 - MAGIX AG)
Microsoft .NET Framework 1.1 (x32 Version:  - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 1.1 Security Update (KB953297) (x32 Version:  - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (x32 Version:  - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
mIRC (x32 Version: 6.35 - mIRC Co. Ltd.)
Mozilla Firefox 17.0.1 (x86 de) (x32 Version: 17.0.1 - Mozilla)
Mozilla Maintenance Service (x32 Version: 17.0.1 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
NCsoft Launcher (x32 Version: 1.5.19002 - NCsoft)
Notepad++ (x32 Version: 6.5 - Notepad++ Team)
NVIDIA 3D Vision Controller Driver (x32 Version: 280.19 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller-Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.3 (x32 Version: 3.3.9567 - OpenOffice.org)
Origin (x32 Version: 8.6.0.357 - Electronic Arts, Inc.)
Pando Media Booster (x32 Version: 2.3.6.0 - Pando Networks Inc.)
Profi cash (x32 Version:  - )
PROTOTYPE 2 (x32 Version:  - Radical Entertainment)
Proxifier version 3.21 (x32 Version: 3.21 - Initex)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype Click to Call (x32 Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sniper Elite V2 (x32 Version:  - )
SoundMAX (x32 Version: 6.10.2.6520 - Analog Devices)
Steam(TM) (x32 Version: 1.0.0.0 - Valve)
TeamSpeak 3 Client (x32 Version: 3.0.13.1 - TeamSpeak Systems GmbH)
TeamViewer 8 (x32 Version: 8.0.22298 - TeamViewer)
tools-linux (x32 Version: 9.6.1.1379776 - VMware, Inc.) Hidden
TortoiseSVN 1.8.0.24401 (64 bit) (Version: 1.8.24401 - TortoiseSVN)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 10.0.4410.1 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.2160.11 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.5100.2 - TuneUp Software) Hidden
TurboV (x32 Version: 1.00.17 - )
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.3 (x32 Version: 2.0.3 - VideoLAN)
VLC media player 2.1.2 (Version: 2.1.2 - VideoLAN)
VMware Player (Version: 6.0.1 - VMware, Inc.) Hidden
VMware Player (x32 Version: 6.0.1 - VMware, Inc)
vReveal (x32 Version:  - MotionDSP)
Warcraft III (x32 Version:  - )
Warcraft III: All Products (HKCU Version:  - )
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
WinPcap 4.1.1 (x32 Version: 4.1.0.1753 - CACE Technologies)
WinRAR (x32 Version:  - )
World of Warcraft (x32 Version:  - Blizzard Entertainment)

==================== Restore Points  =========================

24-01-2014 04:16:53 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2006-11-02 13:34 - 2006-09-18 22:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {08631979-D016-4152-A093-6D3E4F4E7A12} - System32\Tasks\SVN Update2 => E:\SVN Update2.bat [2013-11-09] ()
Task: {13A36FA7-B51E-42A7-A24C-6928FFE7F87D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {18010635-0EE2-4B03-9EA6-30B0C50C7AA2} - System32\Tasks\{90A3A757-3A64-445C-B407-B3956DB512CD} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-15] (Skype Technologies S.A.)
Task: {185BBCC6-9B25-4AA5-8140-FEA91F0FDB77} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {1D571EDF-1EB8-4D06-98B6-621613C54E70} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-02-08] ()
Task: {20A7E74B-22CA-479E-8562-49CB05E8038C} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2009-07-14] (Microsoft Corporation)
Task: {3BE67737-A7A8-4186-AE85-99C5B26A9113} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {4C0E5B45-8EB2-4F5D-B752-ED53133328B6} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2013-12-10] (TuneUp Software)
Task: {4C2F3E75-29AC-4B0E-BB2B-6AE7C8756AF2} - System32\Tasks\{B37E03D7-724D-4ED6-A0C3-B870D6690AA1} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {4D820902-3FAA-4D64-97FE-DAFF65749979} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)
Task: {4F814AB8-EA3A-4587-B9FD-BBF302E0FE65} - System32\Tasks\{B60632FC-CD32-4786-B57E-6F6D7D05B405} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {830998AC-4D46-484A-AA33-5DF38748633E} - System32\Tasks\DivX-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2013-02-13] ()
Task: {90F5E964-C187-40A6-A384-1CF67A1D603D} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {910171FB-FEFF-46DF-9C99-7378CF46AC7A} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe
Task: {9475DD97-BB54-4FD8-A31A-032B4833F6AA} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {95C6CA51-3E2A-47DE-9288-024625960618} - System32\Tasks\{DCED82F0-7941-43D4-BB72-5307D26CA57A} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-15] (Skype Technologies S.A.)
Task: {9B34B395-2186-49B7-B5EB-CF53607FE0E9} - System32\Tasks\Google Updater and Installer => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {A6651D8F-83E0-4A57-9E78-6B6803C1E6A8} - System32\Tasks\SVN Update => E:\SVN Update.bat [2013-10-06] ()
Task: {AB54D6C5-5BC4-4375-9039-960F7F6F2A56} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {AE17272F-8E41-4056-B822-354581F6C6E2} - System32\Tasks\{DCE9D458-5A5C-4C33-B054-1E531B793694} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {B165A169-FAA2-4ECD-818B-24F0047F56C9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {C15A9275-9D3A-49A2-9FAE-ECBE177427D5} - System32\Tasks\{862D60CD-E564-4C01-9101-9AF7AD4B6E2B} => E:\Programme\HoN\hon.exe [2013-10-13] (S2 Games)
Task: {C15F8E8F-C064-4FEB-AF1A-4C3ACC1A2649} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {C28278BF-1ABF-4595-BB2A-15201DDF25E3} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {C592C51D-489B-4B85-BE20-EF6F489FD5E1} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {DC69638B-35B6-4932-A742-8CF09EA335AD} - System32\Tasks\{DFB05294-0DC7-4FEE-9B93-42EC5DC53F4C} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-06-17 19:27 - 2013-06-17 19:27 - 00075504 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
2013-06-17 19:27 - 2013-06-17 19:27 - 00088304 _____ () C:\Program Files\TortoiseSVN\bin\libsasl.dll
2009-09-14 13:08 - 2009-07-20 11:35 - 00018960 _____ () C:\Program Files (x86)\Logitech\SetPoint\khalwrapper.dll
2013-09-03 15:53 - 2012-11-22 17:57 - 00057448 _____ () C:\Windows\system32\PrxerNsp.dll
2012-11-13 15:45 - 2013-06-08 16:02 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2009-08-05 19:01 - 1998-10-31 09:55 - 00005120 _____ () C:\Program Files (x86)\EXPERTool\TBManage.dll
2009-08-05 18:58 - 2005-05-11 15:39 - 00565248 _____ () C:\Program Files (x86)\ASUS\TurboV\pngio.dll
2009-08-05 18:58 - 2008-09-04 16:42 - 01126912 _____ () C:\Program Files (x86)\ASUS\TurboV\OcProfile.dll
2009-08-05 18:58 - 2008-08-21 14:19 - 00126976 _____ () C:\Program Files (x86)\ASUS\TurboV\TVOCLIB.DLL
2013-10-18 12:46 - 2013-10-18 12:46 - 01260624 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:24721E3C

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/24/2014 08:26:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/24/2014 08:23:21 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (01/24/2014 07:38:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 10:47:52 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1".
Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (01/23/2014 10:45:13 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (01/23/2014 07:21:36 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 07:18:37 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (01/22/2014 07:15:25 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Steam2k5.Launcher.exe, Version: 2.5.9468.722, Zeitstempel: 0x52d943fd
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x19a0
Startzeit der fehlerhaften Anwendung: 0xSteam2k5.Launcher.exe0
Pfad der fehlerhaften Anwendung: Steam2k5.Launcher.exe1
Pfad des fehlerhaften Moduls: Steam2k5.Launcher.exe2
Berichtskennung: Steam2k5.Launcher.exe3

Error: (01/22/2014 07:15:24 PM) (Source: .NET Runtime) (User: )
Description: Anwendung: Steam2k5.Launcher.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.InvalidOperationException
Stapel:
   bei System.Diagnostics.Process.WaitForInputIdle(Int32)
   bei System.Diagnostics.Process.WaitForInputIdle()
   bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.Input.InputManager.ProcessStagingArea()
   bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei Microsoft.Win32.NativeMethods.ShellExecuteEx(ShellExecuteInfo)
   bei System.Diagnostics.ShellExecuteHelper.ShellExecuteFunction()
   bei System.Diagnostics.ShellExecuteHelper.ShellExecuteOnSTAThread()
   bei System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)
   bei System.Diagnostics.Process.Start()
   bei System.Diagnostics.Process.Start(System.Diagnostics.ProcessStartInfo)
   bei System.Diagnostics.Process.Start(System.String, System.String)
   bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.Input.InputManager.ProcessStagingArea()
   bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.Run()
   bei System.Windows.Application.RunDispatcher(System.Object)
   bei System.Windows.Application.RunInternal(System.Windows.Window)
   bei System.Windows.Application.Run(System.Windows.Window)
   bei System.Windows.Application.Run()
   bei Honorbuddy.Launcher.App.Main()

Error: (01/22/2014 10:51:57 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1".
Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (01/24/2014 02:02:44 AM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/22/2014 05:49:18 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/22/2014 05:49:18 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/22/2014 05:49:17 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/22/2014 05:49:17 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/22/2014 10:30:11 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TeamViewer 8" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/22/2014 10:30:11 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst TeamViewer 8 erreicht.

Error: (01/19/2014 08:11:46 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (01/19/2014 03:02:53 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/18/2014 03:26:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (01/24/2014 08:26:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/24/2014 08:23:21 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe)(User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (01/24/2014 07:38:51 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 10:47:52 AM) (Source: SideBySide)(User: )
Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files (x86)\windows live\messenger\wlcsdk.exe

Error: (01/23/2014 10:45:13 AM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2

Error: (01/23/2014 07:21:36 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 07:18:37 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe)(User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (01/22/2014 07:15:25 PM) (Source: Application Error)(User: )
Description: Steam2k5.Launcher.exe2.5.9468.72252d943fdKERNELBASE.dll6.1.7601.1822951fb1116e04343520000c41f19a001cf179dd9523bcfE:\Programme\BG\Steam2k5.Launcher.exeC:\Windows\syswow64\KERNELBASE.dll29b72253-8391-11e3-b4ad-005056c00008

Error: (01/22/2014 07:15:24 PM) (Source: .NET Runtime)(User: )
Description: Anwendung: Steam2k5.Launcher.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.InvalidOperationException
Stapel:
   bei System.Diagnostics.Process.WaitForInputIdle(Int32)
   bei System.Diagnostics.Process.WaitForInputIdle()
   bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.Input.InputManager.ProcessStagingArea()
   bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei Microsoft.Win32.NativeMethods.ShellExecuteEx(ShellExecuteInfo)
   bei System.Diagnostics.ShellExecuteHelper.ShellExecuteFunction()
   bei System.Diagnostics.ShellExecuteHelper.ShellExecuteOnSTAThread()
   bei System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)
   bei System.Diagnostics.Process.Start()
   bei System.Diagnostics.Process.Start(System.Diagnostics.ProcessStartInfo)
   bei System.Diagnostics.Process.Start(System.String, System.String)
   bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.Input.InputManager.ProcessStagingArea()
   bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.Run()
   bei System.Windows.Application.RunDispatcher(System.Object)
   bei System.Windows.Application.RunInternal(System.Windows.Window)
   bei System.Windows.Application.Run(System.Windows.Window)
   bei System.Windows.Application.Run()
   bei Honorbuddy.Launcher.App.Main()

Error: (01/22/2014 10:51:57 AM) (Source: SideBySide)(User: )
Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files (x86)\windows live\messenger\wlcsdk.exe


CodeIntegrity Errors:
===================================
  Date: 2014-01-23 10:47:06.063
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.062
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.060
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.045
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.044
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.042
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-22 10:50:21.441
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-22 10:50:21.440
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-22 10:50:21.438
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-22 10:50:21.415
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 35%
Total physical RAM: 6135.12 MB
Available physical RAM: 3957.72 MB
Total Pagefile: 12268.41 MB
Available Pagefile: 9653.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:298.09 GB) (Free:194.39 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Volume) (Fixed) (Total:698.63 GB) (Free:535.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: E7091A42)
Partition 1: (Active) - (Size=298 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 114AA6A5)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Code:
ATTFilter
GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-24 20:49:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD322HJ rev.1AC01118 298,09GB
Running: gmer.exe; Driver: C:\Users\Robert\AppData\Local\Temp\kgdiqpow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey         000000007793faa8 5 bytes JMP 00000001710c18a8
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory  0000000077940038 5 bytes JMP 00000001710c1ea1
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                     00000000711f1a22 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                     00000000711f1ad0 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                     00000000711f1b08 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                     00000000711f1bba 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                     00000000711f1bda 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                              00000000765f1465 2 bytes [5F, 76]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                             00000000765f14bb 2 bytes [5F, 76]
.text  ...                                                                                                                                         * 2
.text  C:\Program Files (x86)\Ask.com\Updater\Updater.exe[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            00000000765f1465 2 bytes [5F, 76]
.text  C:\Program Files (x86)\Ask.com\Updater\Updater.exe[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                           00000000765f14bb 2 bytes [5F, 76]
.text  ...                                                                                                                                         * 2
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 26                                                  000000006f3013c6 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 74                                                  000000006f3013f6 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 257                                                 000000006f3014ad 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 303                                                 000000006f3014db 2 bytes [30, 6F]
.text  ...                                                                                                                                         * 2
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 79                                                  000000006f301577 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 175                                                 000000006f3015d7 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 620                                                 000000006f301794 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 921                                                 000000006f3018c1 2 bytes [30, 6F]
.text  C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  00000000765f1465 2 bytes [5F, 76]
.text  C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000765f14bb 2 bytes [5F, 76]
.text  ...                                                                                                                                         * 2
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                        00000000777411f5 8 bytes {JMP 0xd}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                      0000000077741390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                             000000007774143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                             000000007774158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                     000000007774191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                     0000000077741b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                    0000000077741bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                       0000000077741d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                       0000000077741eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                           0000000077741edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                          0000000077741f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                         0000000077741fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                 0000000077741fd7 8 bytes {JMP 0xb}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                             0000000077742272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                             0000000077742301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                  0000000077742792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                         00000000777427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                       00000000777427d2 8 bytes {JMP 0x10}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                        000000007774282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                       0000000077742890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                         * 2
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                               0000000077742d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                               0000000077742d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                         * 3
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                       0000000077743023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                           000000007774323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                           00000000777433c0 16 bytes {JMP 0x4e}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                          0000000077743a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                          0000000077743ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                              0000000077743b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                              0000000077743d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                       0000000077744190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                 0000000077791380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                               0000000077791500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                     0000000077791530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                   0000000077791650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                       0000000077791700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                       0000000077791d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                     0000000077791f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                     00000000777927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                   00000000752713cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                   000000007527146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                00000000752716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                  00000000752716e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                             00000000752719db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                             00000000752719fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                       0000000075271a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                         0000000075271a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                       0000000075271a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                            0000000075271a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision                                                                7043064

---- EOF - GMER 2.1 ----
         
Ich danke Ihnen schonmal vielmals für die Hilfe!

Ich sollte noch erwähnen, dass KASPERSKY Internet Security 2014 und Avira Antivirus Suite nichts auf dem Rechner gefunden haben.
Deshalb habe ich hierzu auch keine Logs gepostet.

Editieren des Beitrags war leider nicht mehr möglich.

Alt 25.01.2014, 10:27   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



hi,
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________

__________________

Alt 25.01.2014, 13:53   #3
Necro0
 
Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Hi,

vielen Dank, dass Sie mir helfen.

Code:
ATTFilter
ComboFix 14-01-23.02 - Robert 25.01.2014  13:12:13.1.8 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.6135.4006 [GMT 1:00]
ausgeführt von:: c:\users\Robert\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Robert\AppData\Local\assembly\tmp
c:\windows\IsUn0407.exe
c:\windows\SysWow64\~GLH03d9.TMP
c:\windows\SysWow64\~GLH03db.TMP
c:\windows\SysWow64\~GLH03dd.TMP
c:\windows\SysWow64\~GLH03f6.TMP
c:\windows\SysWow64\~GLH03f8.TMP
c:\windows\SysWow64\~GLH03fa.TMP
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-12-25 bis 2014-01-25  ))))))))))))))))))))))))))))))
.
.
2014-01-25 12:17 . 2014-01-25 12:17	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-01-24 19:13 . 2014-01-24 19:13	--------	d-----w-	C:\FRST
2014-01-19 19:51 . 2014-01-19 21:36	--------	d-----w-	C:\Profi cash
2014-01-19 02:11 . 2014-01-19 02:11	6649344	----a-r-	c:\users\Robert\AppData\Roaming\Microsoft\Installer\{6D8FB164-2A7D-43B2-A59E-E16BF568ACB0}\DesktopIcon.exe
2014-01-18 06:55 . 2014-01-18 06:55	--------	d-----w-	c:\programdata\Oracle
2014-01-18 06:54 . 2013-12-18 20:09	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-17 20:57 . 2014-01-17 20:57	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-01-15 15:22 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-15 15:22 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-15 15:22 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-15 15:22 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-15 15:22 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-15 15:22 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-15 15:22 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-15 15:22 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
2014-01-15 15:22 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-19 19:11 . 2013-10-17 14:47	620640	----a-w-	c:\windows\system32\drivers\klif.sys
2014-01-19 19:11 . 2013-10-17 14:47	458336	----a-w-	c:\windows\system32\drivers\kl1.sys
2014-01-19 19:11 . 2013-06-06 16:38	178272	----a-w-	c:\windows\system32\drivers\kneps.sys
2014-01-17 19:31 . 2010-01-14 16:47	86054176	----a-w-	c:\windows\system32\MRT.exe
2013-12-19 20:33 . 2009-09-27 14:12	3071656	----a-w-	c:\windows\system32\nvapi64.dll
2013-12-19 20:33 . 2009-09-27 14:12	2698272	----a-w-	c:\windows\SysWow64\nvapi.dll
2013-12-19 18:53 . 2010-10-16 11:13	6671648	----a-w-	c:\windows\system32\nvcpl.dll
2013-12-19 18:53 . 2010-10-16 11:13	3490080	----a-w-	c:\windows\system32\nvsvc64.dll
2013-12-19 18:53 . 2010-10-16 11:13	386336	----a-w-	c:\windows\system32\nvmctray.dll
2013-12-19 18:53 . 2010-10-16 11:13	922912	----a-w-	c:\windows\system32\nvvsvc.exe
2013-12-19 18:53 . 2010-10-16 11:13	2559776	----a-w-	c:\windows\system32\nvsvcr.dll
2013-12-19 18:53 . 2009-05-01 00:46	63776	----a-w-	c:\windows\system32\nvshext.dll
2013-12-19 11:20 . 2013-12-19 11:20	590112	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2013-12-18 14:53 . 2013-05-07 16:29	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-12-18 14:53 . 2013-03-30 02:09	131576	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-12-18 14:53 . 2013-03-30 02:09	108440	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-12-10 22:26 . 2013-04-08 09:59	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-10 22:26 . 2013-04-08 09:59	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-10 17:43 . 2012-09-19 12:59	35640	----a-w-	c:\windows\system32\TURegOpt.exe
2013-12-10 17:43 . 2012-09-22 13:23	38200	----a-w-	c:\windows\system32\uxtuneup.dll
2013-12-10 17:43 . 2012-09-22 13:23	30520	----a-w-	c:\windows\SysWow64\uxtuneup.dll
2013-12-10 17:43 . 2012-09-19 12:59	26936	----a-w-	c:\windows\system32\authuitu.dll
2013-12-10 17:43 . 2012-09-19 12:59	22328	----a-w-	c:\windows\SysWow64\authuitu.dll
2013-12-10 02:15 . 2013-10-30 02:25	982232	----a-w-	c:\windows\SysWow64\nvspcap.dll
2013-12-10 02:14 . 2013-10-30 02:25	1100248	----a-w-	c:\windows\system32\nvspcap64.dll
2013-12-05 08:42 . 2013-12-17 19:20	39200	----a-w-	c:\windows\system32\drivers\nvvad64v.sys
2013-12-05 08:42 . 2013-12-17 19:20	32544	----a-w-	c:\windows\SysWow64\nvaudcap32v.dll
2013-12-05 08:42 . 2013-10-02 13:44	35104	----a-w-	c:\windows\system32\nvaudcap64v.dll
2013-11-26 11:54 . 2013-12-12 02:01	23183360	----a-w-	c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-12 02:01	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-12 02:01	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-12 02:01	66048	----a-w-	c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-12 02:01	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-12 02:01	2764288	----a-w-	c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-12 02:01	53760	----a-w-	c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-12 02:01	33792	----a-w-	c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-12 02:01	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-12 02:01	574976	----a-w-	c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-12 02:01	139264	----a-w-	c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-12 02:01	111616	----a-w-	c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-12 02:01	708608	----a-w-	c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-12 02:01	218624	----a-w-	c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-12 02:01	5769216	----a-w-	c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-12 02:01	553472	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 02:01	4243968	----a-w-	c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-12 02:01	1995264	----a-w-	c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-12 02:01	12996608	----a-w-	c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-12 02:01	1928192	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-12 02:01	2334208	----a-w-	c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-12 02:01	1395200	----a-w-	c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-12 02:01	817664	----a-w-	c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-12 02:01	1820160	----a-w-	c:\windows\SysWow64\wininet.dll
2013-11-25 19:02 . 2013-03-30 02:09	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-11-23 18:26 . 2013-12-12 00:25	417792	----a-w-	c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 00:25	465920	----a-w-	c:\windows\system32\WMPhoto.dll
2013-11-14 19:35 . 2013-11-14 19:35	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-14 19:35 . 2013-11-14 19:35	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-11-14 19:34 . 2013-11-14 19:34	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-14 19:34 . 2013-11-14 19:34	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2013-11-14 19:34 . 2013-11-14 19:34	235008	----a-w-	c:\windows\system32\elshyph.dll
2013-11-14 19:34 . 2013-11-14 19:34	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2013-11-14 19:34 . 2013-11-14 19:34	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-14 19:34 . 2013-11-14 19:34	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-11-14 19:34 . 2013-11-14 19:34	61952	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2013-11-14 19:34 . 2013-11-14 19:34	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2013-11-14 19:34 . 2013-11-14 19:34	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2013-11-14 19:34 . 2013-11-14 19:34	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-11-14 19:34 . 2013-11-14 19:34	454656	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-11-14 19:34 . 2013-11-14 19:34	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-11-14 19:34 . 2013-11-14 19:34	34816	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-14 19:34 . 2013-11-14 19:34	337408	----a-w-	c:\windows\SysWow64\html.iec
2013-11-14 19:34 . 2013-11-14 19:34	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-11-14 19:34 . 2013-11-14 19:34	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-11-14 19:34 . 2013-11-14 19:34	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2013-11-14 19:34 . 2013-11-14 19:34	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2013-11-14 19:34 . 2013-11-14 19:34	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-11-14 19:34 . 2013-11-14 19:34	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-11-14 19:34 . 2013-11-14 19:34	1051136	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-11-14 19:34 . 2013-11-14 19:34	942592	----a-w-	c:\windows\system32\jsIntl.dll
2013-11-14 19:34 . 2013-11-14 19:34	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-11-14 19:34 . 2013-11-14 19:34	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2013-11-14 19:34 . 2013-11-14 19:34	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2013-11-14 19:34 . 2013-11-14 19:34	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-11-14 19:34 . 2013-11-14 19:34	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-11-14 19:34 . 2013-11-14 19:34	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-11-14 19:34 . 2013-11-14 19:34	413696	----a-w-	c:\windows\system32\html.iec
2013-11-14 19:34 . 2013-11-14 19:34	40448	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-14 19:34 . 2013-11-14 19:34	296960	----a-w-	c:\windows\system32\dxtrans.dll
2013-11-14 19:34 . 2013-11-14 19:34	247808	----a-w-	c:\windows\system32\msls31.dll
2013-11-14 19:34 . 2013-11-14 19:34	195584	----a-w-	c:\windows\system32\msrating.dll
2013-11-14 19:34 . 2013-11-14 19:34	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2013-11-14 19:34 . 2013-11-14 19:34	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-11-14 19:34 . 2013-11-14 19:34	105984	----a-w-	c:\windows\system32\iesysprep.dll
2013-11-14 19:34 . 2013-11-14 19:34	453120	----a-w-	c:\windows\system32\dxtmsft.dll
2013-11-14 19:34 . 2013-11-14 19:34	84992	----a-w-	c:\windows\system32\mshtmled.dll
2013-11-14 19:34 . 2013-11-14 19:34	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2013-11-14 19:34 . 2013-11-14 19:34	81408	----a-w-	c:\windows\system32\icardie.dll
2013-11-14 19:34 . 2013-11-14 19:34	774144	----a-w-	c:\windows\system32\jscript.dll
2013-11-14 19:34 . 2013-11-14 19:34	626176	----a-w-	c:\windows\system32\msfeeds.dll
2013-11-14 19:34 . 2013-11-14 19:34	62464	----a-w-	c:\windows\system32\pngfilt.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-02-08 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2013-02-08 13:55	1520776	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-02-08 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	64792	----a-w-	c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 163328]
"GAINWARD"="c:\program files (x86)\EXPERTool\TBPanel.exe" [2009-05-12 2181672]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"SoundMax"="c:\program files (x86)\Analog Devices\SoundMAX\SoundMAX.exe" [2008-08-20 3858432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"TurboV"="c:\program files (x86)\ASUS\TurboV\TurboV.exe" [2008-10-21 4040192]
"Logitech G35"="c:\program files (x86)\Logitech\G35\G35.exe" [2009-06-30 1811728]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2008-04-15 1310720]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-18 684600]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-02-08 1644680]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-03-28 450560]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files (x86)\Logitech\SetPoint\SetPoint.exe [2009-8-13 1207312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"DivXMediaServer"=c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
.
R2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ESLvnic1;ESLvnic Virtual Network 64 Bit;c:\windows\system32\DRIVERS\ESLvnic.sys;c:\windows\SYSNATIVE\DRIVERS\ESLvnic.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 UPnPService;UPnPService;c:\program files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe;c:\program files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [x]
R3 VaneFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys;c:\windows\SYSNATIVE\drivers\Lachesis.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R4 EslWireHelper;ESL Wire Helper Service;c:\program files\EslWire\service\WireHelperSvc.exe;c:\program files\EslWire\service\WireHelperSvc.exe [x]
R4 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
R4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R4 klflt;klflt;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys;c:\windows\SYSNATIVE\drivers\vsock.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys;c:\windows\SYSNATIVE\drivers\ESLWireACD.sys [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer8;TeamViewer 8;e:\programme\Teamviewer\TeamViewer_Service.exe;e:\programme\Teamviewer\TeamViewer_Service.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 LADF_DHP2;G35 DHP2 Filter Driver;c:\windows\system32\DRIVERS\ladfDHP2amd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfDHP2amd64.sys [x]
S3 LADF_SBVM;G35 SBVM Filter Driver;c:\windows\system32\DRIVERS\ladfSBVMamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfSBVMamd64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - KLBG
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-08 22:26]
.
2014-01-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
- c:\users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16 13:20]
.
2014-01-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
- c:\users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16 13:20]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20	75544	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-08 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube to MP3 Converter - c:\users\Robert\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Zu Anti-Banner hinzufügen - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ie_banner_deny.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
LSP: %SystemRoot%\system32\PrxerDrv.dll
LSP: %windir%\system32\vsocklib.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.de/
FF - prefs.js: network.proxy.ftp - 80.193.214.239
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - 80.193.214.239
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - 80.193.214.239
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - 80.193.214.239
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 1
FF - ExtSQL: !HIDDEN! 2009-12-11 17:06; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-{17c3ec1c-d814-4d83-ac88-062376366583} - c:\users\Robert\AppData\Local\Package Cache\{17c3ec1c-d814-4d83-ac88-062376366583}\Honorbuddy Installer v2.5.7291.636.exe
AddRemove-{a7b6917c-def9-4e52-909e-c77d3246bf2d} - c:\users\Robert\AppData\Local\Package Cache\{a7b6917c-def9-4e52-909e-c77d3246bf2d}\Honorbuddy Installer v2.5.7346.637.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,
   91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,
   36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0
"{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}"=hex:51,66,7a,6c,4c,1d,38,12,da,39,34,
   5d,e1,a9,97,05,de,be,2c,e9,c9,ff,c2,38
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,
   aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{E33CF602-D945-461A-83F0-819F76A199F8}"=hex:51,66,7a,6c,4c,1d,38,12,6c,f5,2f,
   e7,77,97,74,03,fc,e6,c2,df,73,ff,dd,ec
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:45,db,33,83,59,26,cd,01
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-25  13:19:22
ComboFix-quarantined-files.txt  2014-01-25 12:19
.
Vor Suchlauf: 9 Verzeichnis(se), 210.150.072.320 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 210.262.712.320 Bytes frei
.
- - End Of File - - 474ED209CEFAD4F27CEAC5559C5F5B43
A36C5E4F47E84449FF07ED3517B43A31
         
Nach dem ich Combofix ausgeführt habe, war mein Desktophintergrund verschwunden und ein Icon auf dem Desktop enthät keine Grafik mehr. Ich habe allerdings noch nicht versucht es auszuführen, weil ich nicht wusste ob ich überhaupt ein Programm starten darf.

Könnten Sie mir dann auch eine kurze Info geben, ob Ihnen bisher etwas aufgefallen ist?
__________________

Geändert von Necro0 (25.01.2014 um 14:00 Uhr)

Alt 26.01.2014, 07:11   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Rechner einfach mal neustarten. Du hast schon en bissl Müll auf dem Rechner, aber das bekommen wir hin. PW vom Email Account ändern.


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 26.01.2014, 15:09   #5
Necro0
 
Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Also Neustart hab ich in der Zwischenzeit schon öfter gemacht hat aber nichts geholfen.
Aber wenn da nichts schlimmeres passiert ist der Hintergrund ist mir egal.

MBAM
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.26.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Robert :: ROBERT-PC [Administrator]

Schutz: Aktiviert

26.01.2014 14:14:33
mbam-log-2014-01-26 (14-14-33).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 218269
Laufzeit: 4 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0J1D1Q1L0X2Z1M2V0X2X1R1LtFzvtHzv -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
AdwCleaner
Code:
ATTFilter
# AdwCleaner v3.017 - Bericht erstellt am 26/01/2014 um 14:23:28
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Robert - ROBERT-PC
# Gestartet von : C:\Users\Robert\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\Robert\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Robert\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Robert\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\toolbar@ask.com
Datei Gelöscht : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\invalidprefs.js
Datei Gelöscht : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml
Datei Gelöscht : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_hamachi_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_hamachi_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tubebox_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tubebox_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Wert Gelöscht : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]

-\\ Mozilla Firefox v17.0.1 (de)

[ Datei : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\prefs.js ]


-\\ Google Chrome v

[ Datei : C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [6882 octets] - [26/01/2014 14:22:26]
AdwCleaner[S0].txt - [6306 octets] - [26/01/2014 14:23:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6366 octets] ##########
         
JRT
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Ultimate x64
Ran by Robert on 26.01.2014 at 14:29:49,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9213EACE-9E17-47A0-9C80-CD242746D912}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Robert\appdata\local\apn"



~~~ FireFox

Emptied folder: C:\Users\Robert\AppData\Roaming\mozilla\firefox\profiles\2xcpxftx.default\minidumps [9 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.01.2014 at 14:35:28,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
FRST

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-01-2014 01
Ran by Robert (administrator) on ROBERT-PC on 26-01-2014 14:51:32
Running from C:\Users\Robert\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Gainward Co.) C:\Program Files (x86)\EXPERTool\TBPANEL.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
() C:\Program Files (x86)\ASUS\TurboV\TurboV.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\SetPoint\SetPoint.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer_Service.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
() C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_w32.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_x64.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [TurboV] - C:\Program Files (x86)\ASUS\TurboV\TurboV.exe [4040192 2008-10-21] ()
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811728 2009-06-30] (Logitech(c))
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2008-04-15] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-03-28] (DivX, LLC)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logitech\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [GAINWARD] - C:\Program Files (x86)\EXPERTool\TBPanel.exe [2181672 2009-05-12] (Gainward Co.)
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1CF3E2E5C76FCA01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 10 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 11 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 12 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 24 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog5-x64 07 %SystemRoot%\system32\PrxerNsp.dll [57448] ()
Winsock: Catalog9-x64 09 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 10 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 11 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 12 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 24 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)

FireFox:
========
FF ProfilePath: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://google.de/
FF NetworkProxy: "backup.ftp", "58.20.127.100"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "58.20.127.100"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "58.20.127.100"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "80.193.214.239"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.193.214.239"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.193.214.239"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.193.214.239"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 1
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 - C:\Users\Robert\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Robert\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Adblock Plus - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-04]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2011-01-20]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2011-01-20]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-10-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-01]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-19]

Chrome: 
=======
CHR HomePage: 
CHR DefaultSearchKeyword: google.de_
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Free Studio) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\np_dvs_plugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (ijji Web Launching Plugin for FF) - C:\Program Files (x86)\Mozilla Firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
CHR Plugin: (Octoshape Streaming Services) - C:\Users\Robert\AppData\Roaming\Mozilla\plugins\npoctoshape.dll (Octoshape ApS)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Robert\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (ProxTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-01-19]
CHR Extension: (Google Drive) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-09-16]
CHR Extension: (Brushed) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg [2013-03-27]
CHR Extension: (YouTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-16]
CHR Extension: (Google-Suche) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-16]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2012-09-16]
CHR Extension: (AdBlock) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-09-16]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2013-01-21]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-01-19]
CHR Extension: (Virtuelle Tastatur) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2012-09-16]
CHR Extension: (FVD Downloader) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2012-11-04]
CHR Extension: (Google Wallet) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-09-16]
CHR Extension: (NotScripts) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2012-09-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2012-11-01]
CHR Extension: (Google Mail) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-16]
CHR Extension: (Anti-Banner) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2012-09-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Robert\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-15]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [86016 2008-08-15] ()
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [678416 2012-11-14] ()
S3 LBTServ; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [160784 2009-07-20] (Logitech, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-01] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 TeamViewer8; E:\Programme\Teamviewer\TeamViewer_Service.exe [5087584 2013-10-01] (TeamViewer GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)
S3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2009-12-03] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [160784 2012-11-14] (<Turtle Entertainment>)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-19] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-19] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-19] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [61712 2009-05-28] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [376848 2009-05-28] (Logitech)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-08-28] (TuneUp Software)
S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [20480 2010-08-24] (Motorola)
S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-26 14:51 - 2014-01-26 14:51 - 00032737 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-26 14:35 - 2014-01-26 14:35 - 00001101 _____ C:\Users\Robert\Desktop\JRT.txt
2014-01-26 14:29 - 2014-01-26 14:29 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 14:28 - 2014-01-26 14:28 - 00006466 _____ C:\Users\Robert\Desktop\AdwCleaner[S0].txt
2014-01-26 14:22 - 2014-01-26 14:23 - 00000000 ____D C:\AdwCleaner
2014-01-26 14:11 - 2014-01-26 14:11 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 14:10 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-26 14:09 - 2014-01-26 14:09 - 01037068 _____ (Thisisu) C:\Users\Robert\Desktop\JRT.exe
2014-01-26 14:08 - 2014-01-26 14:08 - 02078208 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-26 14:07 - 2014-01-26 14:07 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Robert\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-26 14:07 - 2014-01-26 14:07 - 01236282 _____ C:\Users\Robert\Desktop\adwcleaner.exe
2014-01-26 02:55 - 2014-01-26 02:55 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-26 02:55 - 2014-01-26 02:54 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-26 02:55 - 2014-01-26 02:54 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-26 02:55 - 2014-01-26 02:54 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-26 02:54 - 2014-01-26 02:54 - 00000000 ____D C:\Program Files\Java
2014-01-26 00:02 - 2014-01-26 00:02 - 00000488 __RSH C:\ProgramData\ntuser.pol
2014-01-25 13:19 - 2014-01-25 13:19 - 00032474 _____ C:\ComboFix.txt
2014-01-25 13:10 - 2014-01-25 13:19 - 00000000 ____D C:\Qoobox
2014-01-25 13:10 - 2014-01-25 13:18 - 00000000 ____D C:\Windows\erdnt
2014-01-25 13:10 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-25 13:10 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-25 13:10 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-25 13:06 - 2014-01-25 13:06 - 05175240 ____R (Swearware) C:\Users\Robert\Desktop\ComboFix.exe
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:09 - 2014-01-26 14:08 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-21 21:57 - 2014-01-21 22:15 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:51 - 2014-01-19 22:36 - 00000000 ____D C:\Profi cash
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:19 - 2014-01-19 17:18 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-26 14:47 - 00739420 _____ C:\Windows\setupact.log
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-26 14:25 - 00008158 _____ C:\Windows\PFRO.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 16:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

==================== One Month Modified Files and Folders =======

2014-01-26 14:51 - 2014-01-26 14:51 - 00032737 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-26 14:51 - 2012-09-16 13:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
2014-01-26 14:47 - 2014-01-18 15:26 - 00739420 _____ C:\Windows\setupact.log
2014-01-26 14:47 - 2012-11-24 16:45 - 00000000 ____D C:\ProgramData\VMware
2014-01-26 14:47 - 2009-08-13 22:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-26 14:46 - 2009-08-05 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-26 14:46 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-26 14:44 - 2009-12-11 17:22 - 01940945 _____ C:\Windows\WindowsUpdate.log
2014-01-26 14:35 - 2014-01-26 14:35 - 00001101 _____ C:\Users\Robert\Desktop\JRT.txt
2014-01-26 14:34 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-26 14:34 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-26 14:29 - 2014-01-26 14:29 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 14:28 - 2014-01-26 14:28 - 00006466 _____ C:\Users\Robert\Desktop\AdwCleaner[S0].txt
2014-01-26 14:26 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-26 14:25 - 2014-01-18 15:25 - 00008158 _____ C:\Windows\PFRO.log
2014-01-26 14:23 - 2014-01-26 14:22 - 00000000 ____D C:\AdwCleaner
2014-01-26 14:11 - 2014-01-26 14:11 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 14:09 - 2014-01-26 14:09 - 01037068 _____ (Thisisu) C:\Users\Robert\Desktop\JRT.exe
2014-01-26 14:08 - 2014-01-26 14:08 - 02078208 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-26 14:08 - 2014-01-24 20:09 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-26 14:07 - 2014-01-26 14:07 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Robert\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-26 14:07 - 2014-01-26 14:07 - 01236282 _____ C:\Users\Robert\Desktop\adwcleaner.exe
2014-01-26 14:02 - 2010-03-07 03:07 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{17212944-8BF8-4509-BFF6-0D177AC05DDE}
2014-01-26 03:26 - 2013-04-08 10:59 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-26 02:55 - 2014-01-26 02:55 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-26 02:54 - 2014-01-26 02:55 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-26 02:54 - 2014-01-26 02:55 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-26 02:54 - 2014-01-26 02:55 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-26 02:54 - 2014-01-26 02:54 - 00000000 ____D C:\Program Files\Java
2014-01-26 00:51 - 2012-09-16 13:47 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
2014-01-26 00:02 - 2014-01-26 00:02 - 00000488 __RSH C:\ProgramData\ntuser.pol
2014-01-25 13:19 - 2014-01-25 13:19 - 00032474 _____ C:\ComboFix.txt
2014-01-25 13:19 - 2014-01-25 13:10 - 00000000 ____D C:\Qoobox
2014-01-25 13:19 - 2010-07-15 17:23 - 00000000 ____D C:\Users\Robert\AppData\Local\Apps\2.0
2014-01-25 13:18 - 2014-01-25 13:10 - 00000000 ____D C:\Windows\erdnt
2014-01-25 13:17 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-25 13:06 - 2014-01-25 13:06 - 05175240 ____R (Swearware) C:\Users\Robert\Desktop\ComboFix.exe
2014-01-25 00:51 - 2009-08-27 15:10 - 00000000 ___RD C:\Users\Robert\Wichtiges
2014-01-24 22:48 - 2013-09-15 15:53 - 00000000 ____D C:\Users\Robert\AppData\Local\Deployment
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-24 20:09 - 2009-12-11 17:03 - 00000000 ____D C:\Users\Robert
2014-01-24 20:08 - 2011-06-27 16:17 - 00000000 ____D C:\Users\Robert\AppData\Local\PMB Files
2014-01-23 23:48 - 2012-10-03 00:08 - 00000000 ____D C:\Users\Robert\AppData\Roaming\vlc
2014-01-23 07:44 - 2011-03-31 17:32 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-01-22 19:33 - 2009-07-14 18:58 - 00747994 _____ C:\Windows\system32\perfh007.dat
2014-01-22 19:33 - 2009-07-14 18:58 - 00170676 _____ C:\Windows\system32\perfc007.dat
2014-01-22 19:33 - 2009-07-14 06:13 - 01751820 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-22 16:28 - 2009-08-05 18:41 - 00000000 ___RD C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-22 10:30 - 2013-07-12 15:42 - 00000000 ____D C:\Users\Robert\AppData\Local\TSVNCache
2014-01-21 22:15 - 2014-01-21 21:57 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 22:36 - 2014-01-19 20:51 - 00000000 ____D C:\Profi cash
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:52 - 2006-11-02 13:34 - 00000237 _____ C:\Windows\win.ini
2014-01-19 20:49 - 2012-09-15 20:17 - 00000000 ____D C:\Users\Robert\AppData\Roaming\QuickScan
2014-01-19 20:11 - 2013-10-17 15:47 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-19 20:11 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-19 20:11 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:27 - 2009-12-02 12:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2014-01-19 17:19 - 2011-01-20 12:32 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-19 17:18 - 2014-01-19 17:19 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-19 03:14 - 2013-04-19 18:24 - 00768000 ___SH C:\Users\Robert\Thumbs.db
2014-01-19 03:06 - 2013-07-12 14:27 - 00000000 ____D C:\Users\Robert\AppData\Local\Package Cache
2014-01-19 00:47 - 2010-02-03 15:13 - 00000000 ____D C:\Users\Robert\AppData\Roaming\TS3Client
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 08:24 - 2009-12-11 18:16 - 00003704 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2014-01-18 08:13 - 2013-06-22 18:18 - 00000000 ____D C:\Users\Robert\Desktop\WOW WICHTIG!
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-07-01 22:56 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-17 21:58 - 2009-08-14 17:31 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Skype
2014-01-17 21:57 - 2011-05-12 18:30 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-17 21:57 - 2009-08-13 21:42 - 00000000 ____D C:\ProgramData\Skype
2014-01-17 21:53 - 2012-09-15 18:43 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-17 20:36 - 2009-12-11 17:02 - 01725164 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-17 20:34 - 2013-08-17 03:45 - 00000000 ____D C:\Windows\system32\MRT
2014-01-17 20:31 - 2010-01-14 17:47 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:52 - 2012-09-16 14:21 - 00002362 _____ C:\Users\Robert\Desktop\Google Chrome.lnk
2014-01-13 20:23 - 2009-10-24 17:27 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2014-01-11 20:04 - 2013-07-12 14:25 - 00000000 ____D C:\Users\Robert\Downloads\HonorB
2014-01-11 00:52 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Local\VMware
2014-01-09 20:45 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Roaming\VMware
2014-01-04 15:37 - 2013-07-12 15:51 - 00000000 ____D C:\Users\Robert\AppData\Local\HonorbuddyMeshes

Some content of TEMP:
====================
C:\Users\Robert\AppData\Local\Temp\avgnt.exe
C:\Users\Robert\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-19 00:16

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---


Ich weiß nicht genau wie weit wir sind, aber wenn wir mit dem PC an sich fertig sind könntest du mir dann noch kurz bei 3 Sachen helfen?

1. Meine externe Festplatte ( mit einer Sicherung dieses PC's ) und meine USB Sticks bereinigen? ( Die Sicherung ist mir egal die werde ich dann sowieso löschen, aber die anderen Daten sollten erhalten bleiben )

2. Vielleicht so ne kleine Hilfestellung bzw. ein Programm wie ich das in Zukunft besser machen kann. Z.B. habe ich bei AdwCleaner gesehen, dass man bspw. Hosts Anti-PUP/Adware installieren sollte.

3. Ist MBAM ein Programm, dass man sich anschaffen sollte? Um das System öfters mal damit zu scannen?


Alt 27.01.2014, 10:02   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware

Alt 28.01.2014, 06:00   #7
Necro0
 
Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cc800ab1afc9c2499daf167e727c9a78
# engine=16820
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-28 02:58:54
# local_time=2014-01-28 03:58:54 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 17245011 142507784 0 0
# scanned=272208
# found=0
# cleaned=0
# scan_time=12592
         
Nach ESET habe ich wieder alle USB-Sticks und externe Festplatten vom PC entfernt.
Allerdings habe ich ESET nicht direkt wieder deinstalliert macht das einen Unterschied?

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.79  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Kaspersky Internet Security   
Avira Desktop                 
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 TuneUp Utilities 2013   
 TuneUp Utilities Language Pack (de-DE) 
 TuneUp Utilities 2013   
 TuneUp Utilities Language Pack (de-DE) 
 Adobe Flash Player 11.9.900.170  
 Adobe Reader 10.1.9 Adobe Reader out of Date!  
 Mozilla Firefox 17.0.1 Firefox out of Date!  
 Google Chrome 32.0.1700.72  
 Google Chrome 32.0.1700.76  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Kaspersky Lab Kaspersky Internet Security 14.0.0 avp.exe  
 Kaspersky Lab Kaspersky Internet Security 14.0.0 avpui.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-01-2014 02
Ran by Robert (administrator) on ROBERT-PC on 28-01-2014 05:56:12
Running from C:\Users\Robert\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Gainward Co.) C:\Program Files (x86)\EXPERTool\TBPANEL.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer_Service.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\SetPoint\SetPoint.exe
() C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
() C:\Program Files (x86)\ASUS\TurboV\TurboV.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [TurboV] - C:\Program Files (x86)\ASUS\TurboV\TurboV.exe [4040192 2008-10-21] ()
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811728 2009-06-30] (Logitech(c))
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2008-04-15] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-03-28] (DivX, LLC)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logitech\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [GAINWARD] - C:\Program Files (x86)\EXPERTool\TBPanel.exe [2181672 2009-05-12] (Gainward Co.)
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1CF3E2E5C76FCA01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 10 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 11 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 12 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 24 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog5-x64 07 %SystemRoot%\system32\PrxerNsp.dll [57448] ()
Winsock: Catalog9-x64 09 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 10 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 11 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 12 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 24 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://google.de/
FF NetworkProxy: "backup.ftp", "58.20.127.100"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "58.20.127.100"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "58.20.127.100"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "80.193.214.239"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.193.214.239"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.193.214.239"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.193.214.239"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 1
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 - C:\Users\Robert\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Robert\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Adblock Plus - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-04]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2011-01-20]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2011-01-20]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-10-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-01]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-19]

Chrome: 
=======
CHR HomePage: 
CHR DefaultSearchKeyword: google.de_
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Free Studio) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\np_dvs_plugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (ijji Web Launching Plugin for FF) - C:\Program Files (x86)\Mozilla Firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
CHR Plugin: (Octoshape Streaming Services) - C:\Users\Robert\AppData\Roaming\Mozilla\plugins\npoctoshape.dll (Octoshape ApS)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Robert\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (ProxTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-01-19]
CHR Extension: (Google Drive) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-09-16]
CHR Extension: (Brushed) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg [2013-03-27]
CHR Extension: (YouTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-16]
CHR Extension: (Google-Suche) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-16]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2012-09-16]
CHR Extension: (AdBlock) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-09-16]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2013-01-21]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-01-19]
CHR Extension: (Virtuelle Tastatur) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2012-09-16]
CHR Extension: (FVD Downloader) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2012-11-04]
CHR Extension: (Google Wallet) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-09-16]
CHR Extension: (NotScripts) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2012-09-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2012-11-01]
CHR Extension: (Google Mail) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-16]
CHR Extension: (Anti-Banner) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2012-09-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Robert\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-15]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [86016 2008-08-15] ()
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [678416 2012-11-14] ()
S3 LBTServ; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [160784 2009-07-20] (Logitech, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-01] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 TeamViewer8; E:\Programme\Teamviewer\TeamViewer_Service.exe [5087584 2013-10-01] (TeamViewer GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)
S3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2009-12-03] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [160784 2012-11-14] (<Turtle Entertainment>)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-19] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-19] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-19] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [61712 2009-05-28] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [376848 2009-05-28] (Logitech)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-08-28] (TuneUp Software)
S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [20480 2010-08-24] (Motorola)
S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-28 05:56 - 2014-01-28 05:56 - 00032529 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-28 05:54 - 2014-01-28 05:54 - 00001226 _____ C:\Users\Robert\Desktop\checkup.txt
2014-01-28 05:53 - 2014-01-28 05:53 - 02079232 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-28 00:26 - 2014-01-28 00:26 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-27 19:20 - 2014-01-27 19:20 - 00987425 _____ C:\Users\Robert\Desktop\SecurityCheck.exe
2014-01-26 14:29 - 2014-01-26 14:29 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 14:22 - 2014-01-26 14:23 - 00000000 ____D C:\AdwCleaner
2014-01-26 14:11 - 2014-01-26 14:11 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 14:10 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-26 02:55 - 2014-01-26 02:55 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-26 02:55 - 2014-01-26 02:54 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-26 02:55 - 2014-01-26 02:54 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-26 02:55 - 2014-01-26 02:54 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-26 02:54 - 2014-01-26 02:54 - 00000000 ____D C:\Program Files\Java
2014-01-26 00:02 - 2014-01-26 00:02 - 00000488 __RSH C:\ProgramData\ntuser.pol
2014-01-25 13:19 - 2014-01-25 13:19 - 00032474 _____ C:\ComboFix.txt
2014-01-25 13:10 - 2014-01-25 13:19 - 00000000 ____D C:\Qoobox
2014-01-25 13:10 - 2014-01-25 13:18 - 00000000 ____D C:\Windows\erdnt
2014-01-25 13:10 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-25 13:10 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-25 13:10 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-25 13:06 - 2014-01-25 13:06 - 05175240 ____R (Swearware) C:\Users\Robert\Desktop\ComboFix.exe
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:09 - 2014-01-28 05:52 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-21 21:57 - 2014-01-21 22:15 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:51 - 2014-01-19 22:36 - 00000000 ____D C:\Profi cash
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:19 - 2014-01-19 17:18 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-27 18:58 - 00791999 _____ C:\Windows\setupact.log
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-26 14:25 - 00008158 _____ C:\Windows\PFRO.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 16:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

==================== One Month Modified Files and Folders =======

2014-01-28 05:56 - 2014-01-28 05:56 - 00032529 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-28 05:54 - 2014-01-28 05:54 - 00001226 _____ C:\Users\Robert\Desktop\checkup.txt
2014-01-28 05:53 - 2014-01-28 05:53 - 02079232 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-28 05:52 - 2014-01-24 20:09 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-28 05:51 - 2012-09-16 13:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
2014-01-28 05:26 - 2013-04-08 10:59 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-28 05:22 - 2009-08-13 22:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-28 03:00 - 2009-12-11 17:22 - 01958735 _____ C:\Windows\WindowsUpdate.log
2014-01-28 01:42 - 2010-03-07 03:07 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{17212944-8BF8-4509-BFF6-0D177AC05DDE}
2014-01-28 00:59 - 2012-09-16 13:47 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
2014-01-28 00:26 - 2014-01-28 00:26 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-27 19:27 - 2009-07-14 18:58 - 00747994 _____ C:\Windows\system32\perfh007.dat
2014-01-27 19:27 - 2009-07-14 18:58 - 00170676 _____ C:\Windows\system32\perfc007.dat
2014-01-27 19:27 - 2009-07-14 06:13 - 01751820 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-27 19:20 - 2014-01-27 19:20 - 00987425 _____ C:\Users\Robert\Desktop\SecurityCheck.exe
2014-01-27 19:05 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-27 19:05 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-27 18:58 - 2014-01-18 15:26 - 00791999 _____ C:\Windows\setupact.log
2014-01-27 18:58 - 2012-11-24 16:45 - 00000000 ____D C:\ProgramData\VMware
2014-01-27 18:58 - 2009-08-05 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-27 18:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-26 14:29 - 2014-01-26 14:29 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 14:26 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-26 14:25 - 2014-01-18 15:25 - 00008158 _____ C:\Windows\PFRO.log
2014-01-26 14:23 - 2014-01-26 14:22 - 00000000 ____D C:\AdwCleaner
2014-01-26 14:11 - 2014-01-26 14:11 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 02:55 - 2014-01-26 02:55 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-26 02:54 - 2014-01-26 02:55 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-26 02:54 - 2014-01-26 02:55 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-26 02:54 - 2014-01-26 02:55 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-26 02:54 - 2014-01-26 02:54 - 00000000 ____D C:\Program Files\Java
2014-01-26 00:02 - 2014-01-26 00:02 - 00000488 __RSH C:\ProgramData\ntuser.pol
2014-01-25 13:19 - 2014-01-25 13:19 - 00032474 _____ C:\ComboFix.txt
2014-01-25 13:19 - 2014-01-25 13:10 - 00000000 ____D C:\Qoobox
2014-01-25 13:19 - 2010-07-15 17:23 - 00000000 ____D C:\Users\Robert\AppData\Local\Apps\2.0
2014-01-25 13:18 - 2014-01-25 13:10 - 00000000 ____D C:\Windows\erdnt
2014-01-25 13:17 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-25 13:06 - 2014-01-25 13:06 - 05175240 ____R (Swearware) C:\Users\Robert\Desktop\ComboFix.exe
2014-01-25 00:51 - 2009-08-27 15:10 - 00000000 ___RD C:\Users\Robert\Wichtiges
2014-01-24 22:48 - 2013-09-15 15:53 - 00000000 ____D C:\Users\Robert\AppData\Local\Deployment
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-24 20:09 - 2009-12-11 17:03 - 00000000 ____D C:\Users\Robert
2014-01-24 20:08 - 2011-06-27 16:17 - 00000000 ____D C:\Users\Robert\AppData\Local\PMB Files
2014-01-23 23:48 - 2012-10-03 00:08 - 00000000 ____D C:\Users\Robert\AppData\Roaming\vlc
2014-01-23 07:44 - 2011-03-31 17:32 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-22 16:28 - 2009-08-05 18:41 - 00000000 ___RD C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-22 10:30 - 2013-07-12 15:42 - 00000000 ____D C:\Users\Robert\AppData\Local\TSVNCache
2014-01-21 22:15 - 2014-01-21 21:57 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 22:36 - 2014-01-19 20:51 - 00000000 ____D C:\Profi cash
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:52 - 2006-11-02 13:34 - 00000237 _____ C:\Windows\win.ini
2014-01-19 20:49 - 2012-09-15 20:17 - 00000000 ____D C:\Users\Robert\AppData\Roaming\QuickScan
2014-01-19 20:11 - 2013-10-17 15:47 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-19 20:11 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-19 20:11 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:27 - 2009-12-02 12:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2014-01-19 17:19 - 2011-01-20 12:32 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-19 17:18 - 2014-01-19 17:19 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-19 03:14 - 2013-04-19 18:24 - 00768000 ___SH C:\Users\Robert\Thumbs.db
2014-01-19 03:06 - 2013-07-12 14:27 - 00000000 ____D C:\Users\Robert\AppData\Local\Package Cache
2014-01-19 00:47 - 2010-02-03 15:13 - 00000000 ____D C:\Users\Robert\AppData\Roaming\TS3Client
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 08:24 - 2009-12-11 18:16 - 00003704 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2014-01-18 08:13 - 2013-06-22 18:18 - 00000000 ____D C:\Users\Robert\Desktop\WOW WICHTIG!
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-07-01 22:56 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-17 21:58 - 2009-08-14 17:31 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Skype
2014-01-17 21:57 - 2011-05-12 18:30 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-17 21:57 - 2009-08-13 21:42 - 00000000 ____D C:\ProgramData\Skype
2014-01-17 21:53 - 2012-09-15 18:43 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-17 20:36 - 2009-12-11 17:02 - 01725164 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-17 20:34 - 2013-08-17 03:45 - 00000000 ____D C:\Windows\system32\MRT
2014-01-17 20:31 - 2010-01-14 17:47 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:52 - 2012-09-16 14:21 - 00002362 _____ C:\Users\Robert\Desktop\Google Chrome.lnk
2014-01-13 20:23 - 2009-10-24 17:27 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2014-01-11 20:04 - 2013-07-12 14:25 - 00000000 ____D C:\Users\Robert\Downloads\HonorB
2014-01-11 00:52 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Local\VMware
2014-01-09 20:45 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Roaming\VMware
2014-01-04 15:37 - 2013-07-12 15:51 - 00000000 ____D C:\Users\Robert\AppData\Local\HonorbuddyMeshes

Some content of TEMP:
====================
C:\Users\Robert\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-19 00:16

==================== End Of Log ============================
         
--- --- ---

Alt 28.01.2014, 15:50   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



ESET kannste jetzt deinstallieren. Adobe und Firefox updaten.

Zitat:
FF NetworkProxy: "backup.ftp", "58.20.127.100"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "58.20.127.100"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "58.20.127.100"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "80.193.214.239"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.193.214.239"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.193.214.239"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.193.214.239"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 1
Hats Du den Proxy gesetzt in Firefox?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 28.01.2014, 21:11   #9
Necro0
 
Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Also den oberen Proxy ( 58.20.127.100:3128 ) kenn ich jetzt ned, aber den unteren ( 80.193.214.239:3128 ) müsste ich gesetzt haben ja.
Ich benutze Firefox eig nie ich benutze eig immer Chrome.
Den Proxy in Firefox benutze ich manchmal wenn ich mir mal nen Video in Youtube anschauen will.

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.79  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Kaspersky Internet Security   
Avira Desktop                 
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 TuneUp Utilities 2013   
 TuneUp Utilities Language Pack (de-DE) 
 TuneUp Utilities 2013   
 TuneUp Utilities Language Pack (de-DE) 
  Adobe Flash Player 12.0.0.43 Flash Player out of Date!  
 Adobe Reader XI  
 Mozilla Firefox (26.0) 
 Google Chrome 32.0.1700.102  
 Google Chrome 32.0.1700.76  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 Kaspersky Lab Kaspersky Internet Security 14.0.0 avp.exe  
 Kaspersky Lab Kaspersky Internet Security 14.0.0 avpui.exe  
 Kaspersky Lab Kaspersky Internet Security 14.0.0 klwtblfs.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         
Also warum er den Flash als "out of Date" bezeichnet kann ich leider ned nachvollziehen.
Wenn ich auf die HP von Adobe gehe ( ich muss dazu sagen, dass ich gerade gerade die aktuellste Version installiert hab ) dann zeigt er mir wenn ich mit Chrome auf die Seite gehe, dass ich die Version 12.0.0.41 habe und das ist auch die aktuellste Version für Chrome.
Wenn ich mit Firefox auf die Seite gehe, dann zeigt er mir an, dass ich die Version 12.0.0.43 habe und das ist beim Firefox ja auch die aktuellste Version.
Also ka warum der "out of Date" sein soll.

1 Frage hätte ich gerade noch.

Hat das mit Defogger oder ähnlichem zutun, dass TuneUp Utilities plötzlich anzeigt das die Administrative Freigabe aktiviert ist und er diese deaktivieren will?

Geändert von Necro0 (28.01.2014 um 21:00 Uhr)

Alt 29.01.2014, 12:20   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Das kommt von einem unserer Tools, ändern wir beim Aufräumen. SecurtiyCheck ignorieren, das spinnt manchmal.

und Finger weg von Tune Up Müll, ausser du hast vor den Rechner früher oder später zu toasten.



Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 29.01.2014, 22:42   #11
Necro0
 
Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Hi Schrauber,

Zitat:
Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.

2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.

3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.

4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

erledigt!


Jetzt hätte ich aber doch noch paar Fragen, wenn das in Ordnung ist.

1. In jedem Thema, dass ich lese wird immer nur Opera und Firefox als alternativen zum IE aufgeführt. Ich benutze eigentlich schon sehr lange Google Chrome mit AdBlock, NotScripts und jetzt auch WOT. Ich habe jetzt aber aufgrund der Hinweise mal den Firefox komplett neu installiert. Danach habe ich die vorgeschlagenen Addons installiert und in den Einstellungen z.B. die Verfolgung ausgemacht. Sollte ich lieber Mozilla Firefox verwenden und wenn ja was hat dieser für einen Vorteil gegenüber dem Chrome Browser?


2. Mir ist aufgefallen, dass in der Quarantäne von MBAM immer noch die 2 gefundenen Objekte enthalten sind. Sollte ich da noch einen weiteren Schritt durchführen oder ist das so korrekt?


3. Ist als Firewall die Kaspersky Firewall ausreichend oder sollte man sich noch eine extra Firewall anschaffen und dafür dann die Kaspersky Firewall ausschalten?


4. Kannst du mir zufällig sagen, wie ich am besten die Sicherung auf der Festplatte lösche? Kann ich bei einer Sicherung auch einfach "löschen"?


5. und letztens. Kann ich zum aktuellen Zeitpunkt davon ausgehen, dass mein System, meine USB Sticks und meine externe Festplatte frei von Malware sind?

Mit freundlichen Grüßen und einem sehr sehr großen DANKESCHÖN!!!!

Necro

Alt 30.01.2014, 16:46   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Zitat:
1. In jedem Thema, dass ich lese wird immer nur Opera und Firefox als alternativen zum IE aufgeführt. Ich benutze eigentlich schon sehr lange Google Chrome mit AdBlock, NotScripts und jetzt auch WOT. Ich habe jetzt aber aufgrund der Hinweise mal den Firefox komplett neu installiert. Danach habe ich die vorgeschlagenen Addons installiert und in den Einstellungen z.B. die Verfolgung ausgemacht. Sollte ich lieber Mozilla Firefox verwenden und wenn ja was hat dieser für einen Vorteil gegenüber dem Chrome Browser?
Mittlerweile geben die sich nix mehr, ich müsste ihn mal in die Anleitung aufnehmen.
Zitat:
2. Mir ist aufgefallen, dass in der Quarantäne von MBAM immer noch die 2 gefundenen Objekte enthalten sind. Sollte ich da noch einen weiteren Schritt durchführen oder ist das so korrekt?
Kannste so lassen, is ja extra dafür da die Quarantäne
Zitat:
3. Ist als Firewall die Kaspersky Firewall ausreichend oder sollte man sich noch eine extra Firewall anschaffen und dafür dann die Kaspersky Firewall ausschalten?
Wenn Du ne Suite von KAV hast hast Du AV Programm und Firewall. Ok, auch wenn ich kein Fan von KAV bin. Ein AV Programm zusammen mit WIndows Firewall reicht vollkommen.
Zitat:
4. Kannst du mir zufällig sagen, wie ich am besten die Sicherung auf der Festplatte lösche? Kann ich bei einer Sicherung auch einfach "löschen"?
Klar, Ordner löschen und er ist weg
Zitat:
5. und letztens. Kann ich zum aktuellen Zeitpunkt davon ausgehen, dass mein System, meine USB Sticks und meine externe Festplatte frei von Malware sind?
genau
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 31.01.2014, 17:42   #13
Necro0
 
Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Also abschließend nochmal VIELEN DANK SCHRAUBER!!^^

Alt 01.02.2014, 11:28   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 01.02.2014, 18:09   #15
Necro0
 
Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Standard

Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware



Hi,

jetzt müsste ich dich wenn es ok ist doch noch einmal belästigen.^^

Also seit ich mit den letzten Punkten die ganzen Programme/Anwendungen wieder von meinem PC gelöscht habe, startet sich Kaspersky Internet Security 2014 nicht mehr automatisch beim hochfahren des BS.
Wenn ich es dann manuell starten will " als Admin ausführen" dann kommt, dass ich keinen Zugriff darauf habe.
Erst wenn ich es über die als Admin gestartete Eingabeauff. starte funktioniert es.

Gestern hat es beim Neustarten des Rechners auch funktioniert.
Sprich Rechner hochgefahren KIS 14 startete nicht-> Neustart->KIS 14 startet.

An was könnte das liegen? Davor hat es problemlos funktioniert.

Antwort

Themen zu Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware
adblock, antivir, antivirus, avira, browser, converter, downloader, dvdvideosoft ltd., e-mail, ebanking, email, error, fehler, flash player, helper, homepage, kaspersky, klelam.sys, malware, mozilla, mp3, ntdll.dll, registry, scan, security, software, svchost.exe, system, tastatur, windows



Ähnliche Themen: Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware


  1. Windows 8.1(Bootcamp;MacBookPro)- Verdacht auf Rootkit bzw. Malware
    Log-Analyse und Auswertung - 21.05.2015 (5)
  2. Windows 7 Malware oder Trojaner Befall-insbesondere Keyboard betroffen
    Plagegeister aller Art und deren Bekämpfung - 26.10.2014 (37)
  3. E-Mail Account gehackt - Rechner betroffen?
    Log-Analyse und Auswertung - 24.06.2014 (5)
  4. Windows 7: Neue E-Mail Adresse erstellt und gleich Spoof Mail bekommen... Ebay rät Trojaner Check!
    Log-Analyse und Auswertung - 14.04.2014 (78)
  5. Windows 7, PC extrem langsam, 50% Leerlaufauslastung, Verdacht auf Malware / Virus
    Plagegeister aller Art und deren Bekämpfung - 26.02.2014 (45)
  6. Über meine Mail-Adresse wurden massiv Spammails verschickt - Malware unwahrscheinlich - was tun?
    Plagegeister aller Art und deren Bekämpfung - 13.02.2014 (5)
  7. E-Mail Account betroffen nach Sicherheitstest.bsi überprufung !!!!!
    Plagegeister aller Art und deren Bekämpfung - 26.01.2014 (9)
  8. BSI hat E-Mail Adresse im Bot-Netzwerk gefunden
    Plagegeister aller Art und deren Bekämpfung - 25.01.2014 (3)
  9. Mail-Adresse gehackt? - "keineantwortadresse@web.de" - Mail-Flut
    Plagegeister aller Art und deren Bekämpfung - 12.12.2013 (5)
  10. Windows 7: Desktopicons sporadisch verschwunden. Malware Verdacht
    Log-Analyse und Auswertung - 31.08.2013 (11)
  11. Verdacht auf GVU-Trojaner. Ist mein System betroffen?
    Plagegeister aller Art und deren Bekämpfung - 09.01.2013 (13)
  12. Avira fraß Mail: Auch Unix-Produkte betroffen
    Nachrichten - 23.02.2012 (0)
  13. Spam-Mail von meiner web.de-E-Mail-Adresse an alle Kontakte gesendet
    Log-Analyse und Auswertung - 22.02.2012 (27)
  14. Verdacht auf Schädlinge - Computer hängt sich auf, E-Mail Adresse eventuell geknackt /-:
    Log-Analyse und Auswertung - 03.10.2011 (1)
  15. Spam von meiner e-mail-Adresse?
    Plagegeister aller Art und deren Bekämpfung - 19.02.2009 (3)
  16. Spam-Mail mit eigener E-Mail Adresse
    Plagegeister aller Art und deren Bekämpfung - 09.01.2009 (2)
  17. E-Mail Adresse abmelden?
    Plagegeister aller Art und deren Bekämpfung - 15.04.2003 (4)

Zum Thema Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware - Sehr geehrtes Trojaner-Board Team, wie auch das vieler anderer wurde auch mein E-Mail Konto von www.sicherheitstest.bsi.de positiv getestet. Zudem hat jemand in den letzten Tagen bei meiner Bank angerufen ( - Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware...
Archiv
Du betrachtest: Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.