Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 31.01.2014, 19:23   #1
ferropolis
 
Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Hallo

vor 1-2 Tage habe ich durch Zufall gesehen das mein Task Manager weg ist, nichts böses bei gedacht, eher eine Laune der Natur vielleicht.

Heute sollte ich eines besseren belehrt werden - auf einmal war eine Verknüpfung mit dem mcafee auf meinem Desktop was ich definitiv nicht runtergeladen habe. Also schnell unter Systemsteuerung - Programme entfernen das Ding weg gemacht. Alles gut, dachte ich.

Taskmanager lässt sich über STRG+ALT+ENTF immer noch nicht aufrufen (der Eintrag ist einfach nicht vorhanden). Im Internet gesucht, man sollte in der Registry einen Schlüssel prüfen = Registry lässt sich nicht öffnen (wurde durch den Administrator gesperrt).

Schlussendlich auf diese Seite gestoßen: hxxp://www.wintotal.de/tipparchiv/?TID=177
Script ausgeführt, ich komme wieder in die Systemregistry und mein Taskmanager ist auch wieder da.

AABBEERRR!
Da muss doch noch mehr sein, das ist doch nicht normal - oder?

Im Anhang einige Ergebnisse meiner Scans.

Mein riesen Dank vorab!
lg
Angehängte Dateien
Dateityp: txt Addition.txt (48,8 KB, 130x aufgerufen)
Dateityp: txt FRST.txt (33,7 KB, 115x aufgerufen)
Dateityp: txt Gmer.txt (21,3 KB, 119x aufgerufen)

Alt 31.01.2014, 22:15   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 01.02.2014, 07:59   #3
ferropolis
 
Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Danke für den Hinweis.

Addition.txtFRST Additions Logfile:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014 01
Ran by ferropolis at 2014-01-31 18:49:14
Running from D:\Eigene Datein\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.0 - Adobe Systems)
Adobe AIR (x32 Version: 3.8.0.870 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.8.0.870 - Adobe Systems Incorporated) Hidden
Adobe Creative Suite 5 Master Collection (x32 Version: 5.0 - Adobe Systems Incorporated)
Adobe Flash Media Live Encoder 3.2 (x32 Version: 3.2.0 - Adobe Systems Incorporated)
Adobe Flash Media Server 4 (Version:  - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 4.2 64-bit (Version: 4.2.1 - Adobe)
Adobe Reader 9.4.5 - Deutsch (x32 Version: 9.4.5 - Adobe Systems Incorporated)
AMD USB Filter Driver (x32 Version: 1.0.14.91 - Advanced Micro Devices, Inc.) Hidden
ANNO 1503 (x32 Version:  - )
ANNO 1602 Königs-Edition (x32 Version:  - )
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
ASUS nVidia Driver (x32 Version: 1.00.0000 - ASUSTek) Hidden
ATI Catalyst Install Manager (Version: 3.0.762.0 - ATI Technologies, Inc.)
AudibleManager (x32 Version: 1997749486.48.56.38604146 - Audible, Inc.)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Battlefield 1942 Server (x32 Version:  - )
Battlefield 1942™ (x32 Version: 1.6.20.0 - Electronic Arts)
Battlefield 2(TM) (x32 Version:  - )
Battlefield 3™ (x32 Version: 1.4.0.0 - Electronic Arts)
Battlefield 4™ (x32 Version: 1.0.0.1 - Electronic Arts)
Battlefield: Bad Company™ 2 (x32 Version: 1.0.0.0 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.3.2 - EA Digital Illusions CE AB)
Bitcoin (HKCU Version: 0.8.6 - Bitcoin project)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Call of Duty: Modern Warfare 2 - Multiplayer (x32 Version:  - Infinity Ward)
Call of Duty: Modern Warfare 2 (x32 Version:  - Infinity Ward)
Canon RAW Codec (x32 Version: 1.8.0.68 - Canon Inc.)
CINEMA 4D Release 11 (x32 Version:  - )
Color Efex Pro 3.0 Complete (x32 Version: 3.1.1.0 - Nik Software, Inc.)
Combined Community Codec Pack 2011-11-11 (x32 Version: 2011.11.11.0 - CCCP Project)
Cool & Quiet (x32 Version:  - )
Counter-Strike (x32 Version:  - Valve)
Counter-Strike: Global Offensive (x32 Version:  - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DCXtended .9 (x32 Version:  - )
DDBAC (x32 Version: 4.3.71 - DataDesign)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (Version:  - Microsoft)
DesertCombat  0.7 (x32 Version:  - )
devolo dLAN Cockpit (x32 Version: 3.2.0.0 - devolo AG)
Dfine 2.0 (x32 Version: 2.1.0.7 - Nik Software, Inc.)
dLAN Cockpit (x32 Version: 3.2.28 - devolo AG) Hidden
DRI Tool 2.0 (x32 Version: 2.0 - Traumflieger)
Emergency 2012 (x32 Version:  - Quadriga Games GmbH)
EPSON Scan (x32 Version:  - Seiko Epson Corporation)
EPSON SX420W Series Netzwerk-Handbuch (x32 Version:  - )
EPSON SX420W Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (x32 Version: 2.4j - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.2 (x32 Version: 3.2a - SEIKO EPSON CORPORATION)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden
FileZilla Client 3.2.7.1 (HKCU Version: 3.2.7.1 - )
FlashFXP v4.0 (x32 Version: 4.0.0.1488 - OpenSight Software, LLC)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Foto-Mosaik-Edda Standard V6.6.12119.1 (x32 Version:  - Steffen Schirmer)
Friendly Pinger (x32 Version: 5.0.1 - A.Kilievich & Co.)
G19 BF2 Mod 1.0.1 (x32 Version:  - )
GameSpy Arcade (x32 Version:  - )
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKCU Version: 32.0.1700.102 - Google Inc.)
Google Drive (x32 Version: 1.13.5782.599 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Half-Life Dedicated Server Update Tool (x32 Version:  - )
High-Definition Video Playback 10 (x32 Version: 7.0.11400.29.0 - Nero AG) Hidden
iCloud (Version: 3.1.0.40 - Apple Inc.)
IrfanView (remove only) (x32 Version: 4.32 - Irfan Skiljan)
iTunes (Version: 11.1.3.8 - Apple Inc.)
JavaFX 2.1.1 (x32 Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Kolor Autopano Giga 3.0 (Version: V3.0.2 - Kolor)
Lexware faktura+auftrag 2012 (x32 Version: 16.03.00.0140 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (x32 Version: 2.80.00.0007 - Haufe-Lexware GmbH & Co.KG)
Lexware online banking (x32 Version: 14.00.00.0076 - Haufe-Lexware GmbH & Co.KG)
Logitech Gaming Software (Version: 8.35.18 - Logitech Inc.) Hidden
Logitech Gaming Software 5.10 (Version: 5.10.127 - Logitech)
Logitech Gaming Software 8.35 (Version: 8.35.18 - Logitech Inc.)
Logitech SetPoint 6.20 (Version: 6.20.64 - Logitech)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Max Local Application (x32 Version: 1.3.7 - ELV Elektronik AG) Hidden
Media Player Classic - Home Cinema v1.5.2.3456 x64 (Version: 1.5.2.3456 - MPC-HC Team)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Flight Simulator X (x32 Version: 10.0.60905 - Microsoft Game Studios)
Microsoft Flight Simulator X (x32 Version: 10.0.60905 - Microsoft Game Studios) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Visio 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Visio MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Outlook Hotmail Connector 64-Bit (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (x32 Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visio Premium 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Miranda IM 0.10.8 (x32 Version: 0.10.8 - Miranda IM Project)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox (3.6.27) (x32 Version: 3.6.27 (de) - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (x32 Version: 4.20.9818.0 - Microsoft Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0 - NEC Electronics Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0 - NEC Electronics Corporation) Hidden
Nero 10 Menu TemplatePack Basic (x32 Version: 10.0.10600.6.0 - Nero AG) Hidden
Nero 10 Movie ThemePack Basic (x32 Version: 10.0.10600.6.0 - Nero AG) Hidden
Nero BackItUp 10 (x32 Version: 5.4.11800.21.100 - Nero AG)
Nero BackItUp 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Burning ROM 10 (x32 Version: 10.0.11100.10.100 - Nero AG)
Nero BurningROM 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero BurnRights 10 (x32 Version: 4.0.11000.12.100 - Nero AG)
Nero BurnRights 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.0.12000.1.4 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.13700.0.1 - Nero AG) Hidden
Nero CoverDesigner 10 (x32 Version: 5.0.10900.11.100 - Nero AG)
Nero CoverDesigner 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero DiscSpeed 10 (x32 Version: 6.0.10800.7.100 - Nero AG)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero Dolby Files 10 (x32 Version: 2.0.11000.0.10 - Nero AG) Hidden
Nero Express 10 (x32 Version: 10.0.11000.10.100 - Nero AG)
Nero Express 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero InfoTool 10 (x32 Version: 7.0.10800.8.100 - Nero AG)
Nero InfoTool 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero MediaHub 10 (x32 Version: 1.0.13400.11.100 - Nero AG)
Nero MediaHub 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Multimedia Suite 10 (x32 Version: 10.0.13200 - Nero AG)
Nero Recode 10 (x32 Version: 4.6.10900.4.100 - Nero AG)
Nero Recode 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero RescueAgent 10 (x32 Version: 3.0.10900.9.100 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero SoundTrax 10 (x32 Version: 4.6.10600.2.100 - Nero AG)
Nero SoundTrax 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero StartSmart 10 (x32 Version: 10.0.11200.12.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Update (x32 Version: 1.0.0017 - Nero AG)
Nero Vision 10 (x32 Version: 7.0.11100.8.100 - Nero AG)
Nero Vision 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero WaveEditor 10 (x32 Version: 5.6.10600.2.100 - Nero AG)
Nero WaveEditor 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA Display Control Panel (Version: 6.14.12.5896 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
Ontrack EasyRecovery Professional (x32 Version: 6.21.03 - Kroll Ontrack Inc.)
Ontrack EasyRecovery Professional (x32 Version: 6.21.03 - Kroll Ontrack Inc.) Hidden
Origin (x32 Version: 9.3.6.4639 - Electronic Arts, Inc.)
PanoramaStudio 1.5 (deinstallieren) (x32 Version:  - )
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Portrait Professional 11.3 (x32 Version: 11.3 - Anthropics Technology Ltd.)
PunkBuster für Battlefield 1942 (x32 Version:  - )
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
PxMergeModule (x32 Version: 1.00.0000 - Your Company Name) Hidden
QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)
Reader for PC (x32 Version: 2.1.00.06250 - Sony Corporation)
Reader Library by Sony (x32 Version: 3.3.00.07130 - Sony)
RollerCoaster Tycoon 2 (x32 Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Silver Efex Pro 2 (x32 Version: 2.0.0.0 - Nik Software, Inc.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sound Blaster X-Fi MB (x32 Version: 1.0 - Creative Technology Limited)
StarCraft II (x32 Version:  - Blizzard Entertainment)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
streamWriter (x32 Version:  - )
Synology Assistant (remove only) (x32 Version:  - )
TeamSpeak 3 Client (x32 Version:  - TeamSpeak Systems GmbH)
The Panorama Factory V5 x64 Edition (Version: 5.0.2667 - Smoky City Design)
TomTom HOME (x32 Version: 2.9.6 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2 - TomTom International B.V.)
Topaz DeNoise 5 (64-bit) (Version: 5.0.1 - Topaz Labs) Hidden
Topaz DeNoise 5 (x32 Version: 5.0.1 - Topaz Labs) Hidden
Topaz Simplify 3 (64-bit) (Version: 3.0.2 - Topaz Labs) Hidden
Topaz Simplify 3 (x32 Version: 3.0.2 - Topaz Labs) Hidden
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (Version:  - Microsoft)
VIA Plattform-Geräte-Manager (x32 Version: 1.34 - VIA Technologies, Inc.)
VirtualCloneDrive (x32 Version:  - Elaborate Bytes)
VirtualRig Studio 2.2 Pro (Version: 2.2.211 - mr.pixel Ltd.)
VLC media player 2.1.0 (x32 Version: 2.1.0 - VideoLAN)
Winamp (x32 Version: 5.61  - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1 - Nullsoft, Inc)
Winamp Pro (x32 Version: 5.5.8.2975 - Nullsoft Inc.)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
WinRAR Archivierer (x32 Version:  - )

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 03:34 - 2010-11-07 14:15 - 00002393 ____A C:\Windows\system32\Drivers\etc\hosts
	127.0.0.1 activate.adobe.com 
	127.0.0.1 hl2rcv.adobe.com 
	127.0.0.1 adobeereg.com 
	127.0.0.1 activate.adobe.com 
	127.0.0.1 practivate.adobe.com 
	127.0.0.1 ereg.adobe.com 
	127.0.0.1 activate.wip3.adobe.com 
	127.0.0.1 ereg.wip3.adobe.com 
	127.0.0.1 wip3.adobe.com 
	127.0.0.1 activate-sea.adobe.com 
	127.0.0.1 wwis-dubc1-vip60.adobe.com 
	127.0.0.1 activate-sjc0.adobe.com 
	127.0.0.1 3dns.adobe.com 
	127.0.0.1 3dns-1.adobe.com 
	127.0.0.1 3dns-2.adobe.com 
	127.0.0.1 3dns-3.adobe.com 
	127.0.0.1 3dns-4.adobe.com 
	127.0.0.1 adobe-dns.adobe.com 
	127.0.0.1 adobe-dns-1.adobe.com 
	127.0.0.1 adobe-dns-2.adobe.com 
	127.0.0.1 adobe-dns-3.adobe.com 
	127.0.0.1 adobe-dns-4.adobe.com 
	127.0.0.1 adobe-dns-5.adobe.com 
	127.0.0.1 activate.adobe.de 
	127.0.0.1 practivate.adobe.de 
	127.0.0.1 ereg.adobe.de 
	127.0.0.1 activate.wip3.adobe.de 
	127.0.0.1 wip3.adobe.de 
	127.0.0.1 3dns-3.adobe.de 
	127.0.0.1 3dns-2.adobe.de 
	127.0.0.1 adobe-dns.adobe.de 
	127.0.0.1 adobe-dns-2.adobe.de 
	127.0.0.1 adobe-dns-3.adobe.de 
	127.0.0.1 ereg.wip3.adobe.de 
	127.0.0.1 activate-sea.adobe.de 
	127.0.0.1 wwis-dubc1-vip60.adobe.de 
	127.0.0.1 activate-sjc0.adobe.de 
	127.0.0.1 hl2rcv.adobe.de
	127.0.0.1 flashfxp.com
	127.0.0.1 flashfxp.org
	127.0.0.1 flashfxp.ws
	127.0.0.1 www.flashfxp.com
	127.0.0.1 www.flashfxp.org
	127.0.0.1 www.flashfxp.ws
	127.0.0.1 liveupdate.inicom.net/verify.php
	127.0.0.1 liveupdate.inicom.net
	127.0.0.1 liveupdate.flashfxp.com
	127.0.0.1 update.inicom.net
	127.0.0.1 update.flashfxp.com

==================== Scheduled Tasks (whitelisted) =============

Task: {23950175-DB75-4E69-ABF9-D471440C8B56} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10] (Google Inc.)
Task: {52540A4D-308E-4697-B12E-20571932CFC1} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {620F7AAD-1762-4821-B12B-C4897EC9F6B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10] (Google Inc.)
Task: {8905D28C-B81B-40EA-BD3B-15890ACC071A} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {9DB5AB3A-C941-4646-ADA7-200406BEEA6D} - System32\Tasks\AdobeAAMUpdater-1.0-ferropolis-PC-ferropolis => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-03-21] (Adobe Systems Incorporated)
Task: {A51B63C6-E985-4261-A728-88352A6C1038} - System32\Tasks\Google Updater and Installer => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30] (Google Inc.)
Task: {B4D69961-BB4B-4E65-B737-1FF3AE13E8BC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30] (Google Inc.)
Task: {B88550CB-8908-4763-87EF-9A0E4297CE6D} - System32\Tasks\ASUS\RunDAOD => C:\Windows\DAODx.exe [2009-03-30] ()
Task: {BE006C00-6AF3-4326-A5E0-DE69BAA3FA22} - System32\Tasks\{AC6919F2-D121-4A67-801F-00AF05628091} => D:\Spiele\reflex\Simulator\REFLEX.exe
Task: {DCF3CC75-050C-479B-832F-66647AC45206} - System32\Tasks\elbyExecuteWithUAC => D:\Programme\VirtualClonedrive\ExecuteWithUAC.exe [2008-06-27] ()
Task: {F1A17B6C-7B7E-4BA8-B7A0-E9D5AA47F196} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {FD228054-F5B4-4850-9CFA-8787262C606F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-31] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1ce0f818ac57e9.job => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1cef8d292a9344c.job => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2009-08-23 18:24 - 2009-08-23 18:24 - 00098304 _____ () D:\Programme\fileziller\FileZilla FTP Client\fzshellext_64.dll
2014-01-25 18:55 - 2005-06-07 12:26 - 00043008 _____ () D:\Programme\winrar\rarext64.dll
2013-07-07 16:52 - 2013-07-07 16:52 - 00012520 _____ () C:\Users\ferropolis\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.gadget\CoreTempReader.dll
2013-07-07 16:52 - 2013-07-07 16:52 - 00015080 _____ () C:\Users\ferropolis\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.gadget\GetCoreTempInfoNET.dll
2013-07-07 16:52 - 2013-07-07 16:52 - 00014056 _____ () C:\Users\ferropolis\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.gadget\SystemInfo.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-15 03:36 - 2013-02-15 03:36 - 01554496 _____ () D:\Programme\Office2010\Office14\ADDINS\UmOutlookAddin.dll
2013-08-08 20:49 - 2013-08-05 18:10 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-04-21 20:44 - 2013-04-21 20:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 20:44 - 2013-04-21 20:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-01-31 17:47 - 2014-01-31 17:47 - 00098816 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32api.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00110080 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\PyWinTypes27.dll
2014-01-31 17:47 - 2014-01-31 17:47 - 00364544 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\pythoncom27.dll
2014-01-31 17:47 - 2014-01-31 17:47 - 00044032 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_socket.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 01153024 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_ssl.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00320512 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32com.shell.shell.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00711680 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_hashlib.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 01175040 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._core_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00805888 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._gdi_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00811008 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._windows_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 01062400 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._controls_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00735232 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._misc_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00128512 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_elementtree.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00127488 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\pyexpat.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00557056 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\pysqlite2._sqlite.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00087040 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_ctypes.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00119808 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32file.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00108544 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32security.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00018432 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32event.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00038912 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32inet.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00122368 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._wizard.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00026624 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_multiprocessing.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00070656 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._html2.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00010240 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\select.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00686080 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\unicodedata.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00025600 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32pdh.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00521680 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\windows._lib_cacheinvalidation.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00011264 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32crypt.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00024064 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32pipe.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00035840 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32process.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00017408 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32profile.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00022528 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32ts.pyd
2013-06-25 17:23 - 2013-06-25 17:23 - 00880640 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\fsk.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00040264 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskMediaPlayers.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00239944 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\Fskin.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00026952 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskinLocalize.dll
2013-05-23 18:54 - 2013-05-23 18:54 - 00798720 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskSecurity.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00125256 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskDocumentViewer.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00016200 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskPower.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00024904 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskNetInterface.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00017224 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskMobileMediaDevice.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00015176 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskTimeHardware.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00034632 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ticket.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00018760 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ebookDeviceNotifier.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00092488 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ebookUsb.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00149832 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\readerAppHelper.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00178504 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\USBDetector.dll
2014-01-29 14:54 - 2014-01-23 06:56 - 00715544 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\libglesv2.dll
2014-01-29 14:54 - 2014-01-23 06:56 - 00100120 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\libegl.dll
2014-01-29 14:54 - 2014-01-23 06:56 - 04055320 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\pdf.dll
2014-01-29 14:54 - 2014-01-23 06:57 - 00399640 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll
2014-01-29 14:54 - 2014-01-23 06:55 - 01634584 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\ProgramData\Microsoft:DlaFF2w9cy9j0sEdecCZ
AlternateDataStreams: C:\ProgramData\Microsoft:nC4LtXh4vLrMBKg6hBwmtf
AlternateDataStreams: C:\Users\ferropolis\Cookies:Ue6u5ikaLCkUCnDOl5RBa0An

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/31/2014 06:49:15 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
] ist ein Fehler aufgetreten.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
   Schattenkopien abfragen

Kontext:
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
   Snapshotkontext: 13
   Snapshotkontext: 13
   Ausführungskontext: Coordinator

Error: (01/31/2014 06:49:15 PM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
   Schattenkopien abfragen

Kontext:
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
   Snapshotkontext: 13
   Snapshotkontext: 13
   Ausführungskontext: Coordinator

Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/31/2014 05:52:34 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80042302).

Error: (01/31/2014 05:52:34 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "GetProviderMgmtInterface" ist ein unerwarteter Fehler aufgetreten. hr = 0x8004230f, Unerwarteter Fehler beim Schattenkopieanbieter bei dem Versuch, den angegebenen Vorgang zu verarbeiten.
.

Error: (01/31/2014 05:52:34 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
] ist ein Fehler aufgetreten.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Anbieterverwaltungsschnittstelle wird abgerufen

Kontext:
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Klassen-ID: {00000000-0000-0000-0000-000000000000}
   Snapshotkontext: -1
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}

Error: (01/31/2014 05:52:34 PM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Anbieterverwaltungsschnittstelle wird abgerufen

Kontext:
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Klassen-ID: {00000000-0000-0000-0000-000000000000}
   Snapshotkontext: -1
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}

Error: (01/29/2014 09:16:27 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.


System errors:
=============
Error: (01/31/2014 05:48:55 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/31/2014 05:48:16 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
PxHelp20
sptd

Error: (01/31/2014 05:47:31 PM) (Source: sptd) (User: )
Description: Der Treiber hat einen internen Fehler in seinen Datenstrukturen für  festgestellt.

Error: (01/29/2014 10:31:16 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (01/29/2014 09:11:33 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/29/2014 09:10:53 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
PxHelp20
sptd

Error: (01/29/2014 09:10:16 PM) (Source: sptd) (User: )
Description: Der Treiber hat einen internen Fehler in seinen Datenstrukturen für  festgestellt.

Error: (01/29/2014 05:23:51 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (01/29/2014 05:23:10 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
PxHelp20
sptd

Error: (01/29/2014 05:22:34 PM) (Source: sptd) (User: )
Description: Der Treiber hat einen internen Fehler in seinen Datenstrukturen für  festgestellt.


Microsoft Office Sessions:
=========================
Error: (01/31/2014 06:49:15 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
   Schattenkopien abfragen

Kontext:
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
   Snapshotkontext: 13
   Snapshotkontext: 13
   Ausführungskontext: Coordinator

Error: (01/31/2014 06:49:15 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
   Schattenkopien abfragen

Kontext:
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
   Snapshotkontext: 13
   Snapshotkontext: 13
   Ausführungskontext: Coordinator

Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/31/2014 05:52:34 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80042302

Error: (01/31/2014 05:52:34 PM) (Source: VSS)(User: )
Description: GetProviderMgmtInterface0x8004230f, Unerwarteter Fehler beim Schattenkopieanbieter bei dem Versuch, den angegebenen Vorgang zu verarbeiten.

Error: (01/31/2014 05:52:34 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Anbieterverwaltungsschnittstelle wird abgerufen

Kontext:
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Klassen-ID: {00000000-0000-0000-0000-000000000000}
   Snapshotkontext: -1
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}

Error: (01/31/2014 05:52:34 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Anbieterverwaltungsschnittstelle wird abgerufen

Kontext:
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Klassen-ID: {00000000-0000-0000-0000-000000000000}
   Snapshotkontext: -1
   Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}

Error: (01/29/2014 09:16:27 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000


==================== Memory info =========================== 

Percentage of memory in use: 26%
Total physical RAM: 16382.18 MB
Available physical RAM: 12108.8 MB
Total Pagefile: 32762.53 MB
Available Pagefile: 28187.42 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:59.62 GB) (Free:6.2 GB) NTFS
Drive d: (Volume) (Fixed) (Total:1397.26 GB) (Free:1169.79 GB) NTFS
Drive e: (Volume) (Fixed) (Total:1397.16 GB) (Free:1213.54 GB) NTFS
Drive m: (music) (Network) (Total:912.45 GB) (Free:279.6 GB) NTFS
Drive p: (photo) (Network) (Total:1829.34 GB) (Free:606.4 GB) NTFS
Drive r: (ebooks) (Network) (Total:1829.34 GB) (Free:606.4 GB) NTFS
Drive v: (video) (Network) (Total:1829.34 GB) (Free:606.4 GB) NTFS
Drive z: (_unsortiert) (Network) (Total:1829.34 GB) (Free:606.4 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: 0DC92061)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-698829766656) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: 8E80E98C)
Partition 1: (Active) - (Size=-698723860480) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 60 GB) (Disk ID: 0DC92079)
Partition 1: (Active) - (Size=60 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
--- --- ---


FRST.TXT


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by ferropolis (administrator) on FERROPOLIS on 31-01-2014 18:48:58
Running from D:\Eigene Datein\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
() C:\Windows\DAODx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\MDM.EXE
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
() D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) D:\Programme\skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Sony Corporation) D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Apple Inc.) D:\Programme\itunes\iTunesHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointG\SetPointII.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) D:\Programme\Office2010\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] - D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [6900024 2012-07-24] (Logitech Inc.)
HKLM\...\Run: [Start WingMan Profiler] - C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - D:\Programme\Office2010\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\itunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [Google Update] - C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2010-09-30] (Google Inc.)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20203904 2013-12-06] (Google)
HKCU\...\Run: [TomTomHOME.exe] - D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
HKCU\...\Run: [Skype] - D:\Programme\skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKCU\...\Policies\system: [EnableLUA] 0
MountPoints2: {d809e191-efd9-11df-9a0f-20cf30214935} - G:\SETUP.EXE

==================== Internet (Whitelisted) ====================

ProxyServer: 183.111.12.21:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x50F06B3E11DCCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100476&babsrc=SP_ss&mntrId=40ea805a00000000000020cf30214935
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100476&babsrc=SP_ss&mntrId=40ea805a00000000000020cf30214935
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default
FF DefaultSearchEngine: Search the web (Babylon)
FF SearchEngineOrder.1: Search the web (Babylon)
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Keyword.URL: hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
FF Plugin-x32: Adobe Acrobat - D:\Programme\adobe acrobat X Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Firebug - C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\Extensions\firebug@software.joehewitt.com [2012-02-19]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-12]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-10-18]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn [2011-06-25]

Chrome: 
=======
CHR HomePage: hxxp://www.aldi.com/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (WacomTabletPlugin) - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
CHR Plugin: (Reader Library) - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
CHR Extension: (Angry Birds) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2011-10-30]
CHR Extension: (Google Drive) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]
CHR Extension: (Stealthy) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2013-06-23]
CHR Extension: (Yulia Brodskaya) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2013-06-02]
CHR Extension: (Google Wallet) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Google Reader) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjhlfkghdhmijklfnahfkpgmhcmfgcm [2012-10-30]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\FERROP~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-14]
CHR StartMenuInternet: Google Chrome - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-26] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG)
S3 FMS; D:\Programme\adobe flash media server4\FMSMaster.exe [4693504 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSAdmin; D:\Programme\adobe flash media server4\FMSAdmin.exe [5706240 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSHttpd; D:\Programme\adobe flash media server4\Apache2.2\bin\httpd.exe [24645 2010-08-19] (Apache Software Foundation)
S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office2010\Office14\GROOVE.EXE [50921648 2013-03-09] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-21] ()
S2 SkypeUpdate; D:\Programme\skype\Updater\Updater.exe [171680 2013-09-05] (Skype Technologies)
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom)
R2 UsbClientService; D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] ()

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [363096 2010-07-08] (Logitech)
S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [334552 2010-07-08] (Logitech)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0 PxHelp20; C:\Windows\SysWOW64\Drivers\PxHelp20.sys [44944 2009-04-28] (Sonic Solutions)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2010-11-14] (Duplex Secure Ltd.)
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-31 18:48 - 2014-01-31 18:48 - 00000000 ___DC C:\FRST
2014-01-31 18:08 - 2014-01-31 18:08 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-31 18:08 - 2014-01-31 18:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-31 18:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ C:\Windows\Minidump\010414-32105-01.dmp

==================== One Month Modified Files and Folders =======

2014-01-31 18:48 - 2014-01-31 18:48 - 00000000 ___DC C:\FRST
2014-01-31 18:48 - 2011-10-18 19:18 - 00000000 ____D C:\Users\ferropolis\AppData\Roaming\Skype
2014-01-31 18:43 - 2010-09-30 20:33 - 00001138 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
2014-01-31 18:28 - 2013-12-25 11:30 - 00000000 ____D C:\Users\ferropolis\AppData\Local\3A8434C7-EF7B-40BD-A0C4-4D41B304A44C.aplzod
2014-01-31 18:11 - 2010-09-30 21:01 - 00000000 ____D C:\Users\ferropolis
2014-01-31 18:08 - 2014-01-31 18:08 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-31 18:08 - 2014-01-31 18:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-31 18:04 - 2011-06-10 15:52 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-31 17:58 - 2010-10-01 19:35 - 00000000 ____D C:\Users\ferropolis\AppData\Local\Adobe
2014-01-31 17:55 - 2009-07-14 05:45 - 00023040 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-31 17:55 - 2009-07-14 05:45 - 00023040 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-31 17:53 - 2010-09-30 21:01 - 01430368 _____ C:\Windows\WindowsUpdate.log
2014-01-31 17:53 - 2009-07-14 18:58 - 05921298 _____ C:\Windows\system32\perfh007.dat
2014-01-31 17:53 - 2009-07-14 18:58 - 01777050 _____ C:\Windows\system32\perfc007.dat
2014-01-31 17:53 - 2009-07-14 06:13 - 00006508 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-31 17:52 - 2012-12-08 16:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-31 17:49 - 2012-12-08 16:33 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-31 17:49 - 2012-05-20 18:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-31 17:49 - 2012-03-11 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-31 17:48 - 2013-05-14 19:58 - 00000000 ___RD C:\Users\ferropolis\Google Drive
2014-01-31 17:47 - 2013-09-06 17:32 - 00027663 _____ C:\Windows\setupact.log
2014-01-31 17:47 - 2011-06-10 15:52 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-31 17:47 - 2010-10-05 13:03 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-31 17:47 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-29 19:33 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system
2014-01-29 17:05 - 2011-04-30 13:22 - 00000000 ____D C:\Users\ferropolis\scans
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-25 18:52 - 2010-11-04 18:56 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-25 18:51 - 2011-10-26 17:58 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2014-01-25 18:50 - 2011-06-10 15:52 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-25 18:50 - 2010-10-18 17:00 - 00000000 ____D C:\Program Files (x86)\Adobe
2014-01-25 18:46 - 2010-10-13 17:50 - 00000000 ____D C:\Program Files\WinRAR
2014-01-25 16:48 - 2011-08-09 18:23 - 00000000 ____D C:\ProgramData\Lexware
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-22 17:59 - 2010-10-16 17:53 - 00000000 ____D C:\Users\ferropolis\webseiten
2014-01-22 17:52 - 2010-11-07 14:43 - 00000132 _____ C:\Users\ferropolis\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-01-16 17:26 - 2009-07-14 05:45 - 05289680 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-15 20:30 - 2013-07-30 19:13 - 00000000 ____D C:\Windows\system32\MRT
2014-01-15 20:29 - 2010-10-17 09:59 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-12 14:42 - 2010-10-05 18:24 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-06 20:04 - 2010-10-05 18:24 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ C:\Windows\Minidump\010414-32105-01.dmp
2014-01-04 13:25 - 2010-12-16 17:55 - 00000000 ____D C:\Windows\Minidump
2014-01-02 19:31 - 2013-11-10 12:21 - 00000000 ____D C:\Users\ferropolis\AppData\Roaming\vlc
2014-01-01 12:28 - 2012-04-22 17:23 - 00043520 ___SH C:\Users\ferropolis\Thumbs.db

Some content of TEMP:
====================
C:\Users\ferropolis\AppData\Local\Temp\avgnt.exe
C:\Users\ferropolis\AppData\Local\Temp\nvStInst.exe
C:\Users\ferropolis\AppData\Local\Temp\sonarinst.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-29 15:09

==================== End Of Log ============================
         
--- --- ---

--- --- ---


GMER.TXT
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-01-31 19:15:34
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-7 OCZ-VERTEX rev.1.6 59,63GB
Running: ycptywh9.exe; Driver: C:\Users\FERROP~1\AppData\Local\Temp\uxtiyfob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                                                                   fffff80003a04000 45 bytes [00, 00, 16, 02, 4E, 74, 66, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                                                                                                                                   fffff80003a0402f 29 bytes [00, 01, 00, 06, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2160] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                                                  0000000075581465 2 bytes [58, 75]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2160] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                                                 00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                                                                                                              00000000723a1a22 2 bytes [3A, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                                                                                                              00000000723a1ad0 2 bytes [3A, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                                                                                                              00000000723a1b08 2 bytes [3A, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                                                                                                              00000000723a1bba 2 bytes [3A, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                                                                                                              00000000723a1bda 2 bytes [3A, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                       0000000075581465 2 bytes [58, 75]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                      00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                         0000000075581465 2 bytes [58, 75]
.text     D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                        00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                    0000000075581465 2 bytes [58, 75]
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                   00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                0000000075581465 2 bytes [58, 75]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                               00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[3276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                      0000000075581465 2 bytes [58, 75]
.text     C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[3276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                     00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     C:\Program Files (x86)\Google\Drive\googledrivesync.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                0000000075581465 2 bytes [58, 75]
.text     C:\Program Files (x86)\Google\Drive\googledrivesync.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                               00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe[3664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                0000000075581465 2 bytes [58, 75]
.text     D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe[3664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                               00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                         0000000075581465 2 bytes [58, 75]
.text     C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                        00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
.text     C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                              0000000075581465 2 bytes [58, 75]
.text     C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                             00000000755814bb 2 bytes [58, 75]
.text     ...                                                                                                                                                                                                                                                  * 2
---- Processes - GMER 2.1 ----

Library   C:\Users\ferropolis\AppData\Local\Microsoft\Windows Sidebar\Gadgets\networktraffic.gadget\netlib.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [3136] (NIC Information .NET Wrapper/Jonathan Abbott)(2012-11-25 12:05:57)  0000000073240000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (Python Core/Python Software Foundation)(2014-01-31 16:47:59)                                      000000001e000000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                               000000001e8c0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                           000000001e7a0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                            00000000002f0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                                0000000000240000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                                   0000000010000000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                   000000001e800000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                               0000000002ec0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                              0000000002f80000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxbase294u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59)                         00000000030b0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxbase294u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59)                     0000000000290000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxmsw294u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59)                     00000000032a0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxmsw294u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59)                      0000000003740000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                               0000000003980000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                           00000000042f0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxmsw294u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59)                     00000000043c0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                          00000000045f0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                              0000000004700000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                           000000001d100000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                                0000000002650000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                      0000000003a50000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                                000000001d1a0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                              000000001ea10000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                          000000001ec80000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                             000000001e9b0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                              000000001eaa0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                             0000000002680000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                       0000000001f40000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                              00000000026b0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxmsw294u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59)                  0000000005790000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                                 00000000057b0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                            0000000005830000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                               000000001eb60000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                             000000001e980000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                              000000001eb90000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59)                                                                           000000001ebf0000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                           000000001ec20000
Library   C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58)                                                                                000000001ed40000
Library   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{29ED0093-F58D-4D5C-A212-B0D7A91E95F9}\offreg.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [6372](2014-01-31 17:10:19)                                                    000007feee4e0000

---- EOF - GMER 2.1 ----
         
MBAM.TXT
Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.31.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
ferropolis :: FERROPOLIS [Administrator]

31.01.2014 18:08:30
MBAM-log-2014-01-31 (19-09-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 737086
Laufzeit: 1 Stunde(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0C1P1I1C1H1J1UtFzytH0A -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 1
HKCU\SOFTWARE\Policies\Microsoft\Windows\System|DisableCMD (PUM.Hijack.CMDPrompt) -> Bösartig: (2) Gut: (0) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.

(Ende)
         
__________________

Alt 01.02.2014, 15:52   #4
ferropolis
 
Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Sry, musste meine FRST.TXT noch mal anpassen.


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 03
Ran by ferropolis (administrator) on FERROPOLIS on 01-02-2014 15:50:47
Running from D:\Eigene Datein\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Windows\DAODx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\MDM.EXE
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
() D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) D:\Programme\skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Sony Corporation) D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Apple Inc.) D:\Programme\itunes\iTunesHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointG\SetPointII.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] - D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [6900024 2012-07-24] (Logitech Inc.)
HKLM\...\Run: [Start WingMan Profiler] - C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - D:\Programme\Office2010\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\itunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [Google Update] - C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2010-09-30] (Google Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20203904 2013-12-06] (Google)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [TomTomHOME.exe] - D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [Skype] - D:\Programme\skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Policies\system: [EnableLUA] 0
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\MountPoints2: {d809e191-efd9-11df-9a0f-20cf30214935} - G:\SETUP.EXE

==================== Internet (Whitelisted) ====================

ProxyServer: 183.111.12.21:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x50F06B3E11DCCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100476&babsrc=SP_ss&mntrId=40ea805a00000000000020cf30214935
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100476&babsrc=SP_ss&mntrId=40ea805a00000000000020cf30214935
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default
FF DefaultSearchEngine: Search the web (Babylon)
FF SearchEngineOrder.1: Search the web (Babylon)
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Keyword.URL: hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
FF Plugin-x32: Adobe Acrobat - D:\Programme\adobe acrobat X Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Firebug - C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\Extensions\firebug@software.joehewitt.com [2012-02-19]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-12]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-10-18]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn [2011-06-25]

Chrome: 
=======
CHR HomePage: hxxp://www.aldi.com/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (WacomTabletPlugin) - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
CHR Plugin: (Reader Library) - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
CHR Extension: (Angry Birds) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2011-10-30]
CHR Extension: (Google Drive) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]
CHR Extension: (Stealthy) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2013-06-23]
CHR Extension: (Yulia Brodskaya) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2013-06-02]
CHR Extension: (Google Wallet) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Google Reader) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjhlfkghdhmijklfnahfkpgmhcmfgcm [2012-10-30]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\FERROP~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-14]
CHR StartMenuInternet: Google Chrome - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-26] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG)
S3 FMS; D:\Programme\adobe flash media server4\FMSMaster.exe [4693504 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSAdmin; D:\Programme\adobe flash media server4\FMSAdmin.exe [5706240 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSHttpd; D:\Programme\adobe flash media server4\Apache2.2\bin\httpd.exe [24645 2010-08-19] (Apache Software Foundation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office2010\Office14\GROOVE.EXE [50921648 2013-03-09] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-21] ()
S2 SkypeUpdate; D:\Programme\skype\Updater\Updater.exe [171680 2013-09-05] (Skype Technologies)
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom)
R2 UsbClientService; D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] ()

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [363096 2010-07-08] (Logitech)
S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [334552 2010-07-08] (Logitech)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0 PxHelp20; C:\Windows\SysWOW64\Drivers\PxHelp20.sys [44944 2009-04-28] (Sonic Solutions)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2010-11-14] (Duplex Secure Ltd.)
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-31 18:48 - 2014-02-01 15:50 - 00000000 ___DC () C:\FRST
2014-01-31 18:08 - 2014-01-31 18:08 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-31 18:08 - 2014-01-31 18:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-31 18:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ () C:\Windows\Minidump\010414-32105-01.dmp

==================== One Month Modified Files and Folders =======

2014-02-01 15:50 - 2014-01-31 18:48 - 00000000 ___DC () C:\FRST
2014-02-01 15:45 - 2011-10-18 19:18 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Skype
2014-02-01 15:43 - 2010-09-30 20:33 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
2014-02-01 15:10 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-01 15:10 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-01 15:08 - 2009-07-14 18:58 - 05950382 _____ () C:\Windows\system32\perfh007.dat
2014-02-01 15:08 - 2009-07-14 18:58 - 01786086 _____ () C:\Windows\system32\perfc007.dat
2014-02-01 15:08 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-01 15:06 - 2010-09-30 21:01 - 01459750 _____ () C:\Windows\WindowsUpdate.log
2014-02-01 15:04 - 2011-06-10 15:52 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-01 15:03 - 2013-05-14 19:58 - 00000000 ___RD () C:\Users\ferropolis\Google Drive
2014-02-01 15:03 - 2011-06-10 15:52 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-01 15:02 - 2013-09-06 17:32 - 00028111 _____ () C:\Windows\setupact.log
2014-02-01 15:02 - 2010-10-05 13:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-01 15:02 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-01 08:03 - 2010-10-01 19:35 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Adobe
2014-01-31 19:52 - 2012-12-08 16:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-31 18:28 - 2013-12-25 11:30 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\3A8434C7-EF7B-40BD-A0C4-4D41B304A44C.aplzod
2014-01-31 18:11 - 2010-09-30 21:01 - 00000000 ____D () C:\Users\ferropolis
2014-01-31 18:08 - 2014-01-31 18:08 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-31 18:08 - 2014-01-31 18:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-31 17:49 - 2012-12-08 16:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-31 17:49 - 2012-05-20 18:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-31 17:49 - 2012-03-11 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-29 19:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-01-29 17:05 - 2011-04-30 13:22 - 00000000 ____D () C:\Users\ferropolis\scans
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-25 18:52 - 2010-11-04 18:56 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-25 18:51 - 2011-10-26 17:58 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-01-25 18:50 - 2011-06-10 15:52 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-25 18:50 - 2010-10-18 17:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-25 18:46 - 2010-10-13 17:50 - 00000000 ____D () C:\Program Files\WinRAR
2014-01-25 16:48 - 2011-08-09 18:23 - 00000000 ____D () C:\ProgramData\Lexware
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-22 17:59 - 2010-10-16 17:53 - 00000000 ____D () C:\Users\ferropolis\webseiten
2014-01-22 17:52 - 2010-11-07 14:43 - 00000132 _____ () C:\Users\ferropolis\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-01-16 17:26 - 2009-07-14 05:45 - 05289680 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-15 20:30 - 2013-07-30 19:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 20:29 - 2010-10-17 09:59 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-12 14:42 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-06 20:04 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ () C:\Windows\Minidump\010414-32105-01.dmp
2014-01-04 13:25 - 2010-12-16 17:55 - 00000000 ____D () C:\Windows\Minidump
2014-01-02 19:31 - 2013-11-10 12:21 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\vlc

Some content of TEMP:
====================
C:\Users\ferropolis\AppData\Local\Temp\avgnt.exe
C:\Users\ferropolis\AppData\Local\Temp\nvStInst.exe
C:\Users\ferropolis\AppData\Local\Temp\sonarinst.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-29 15:09

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---

--- --- ---

Alt 02.02.2014, 07:04   #5
schrauber
/// the machine
/// TB-Ausbilder
 

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Suchlauf mit rKill

Bitte lade dir rKill von Grinler auf deinen Desktop von einem der folgenden Links: RKill oder http://www.trojaner-board.de/85629-rkill-download.html
  • Starte nun das Programm durch einen Doppelklick.
  • Wenn sich jetzt kein schwarzes Fenster öffnet, dann versuche einen der anderen Downloadlinks.
  • Das Tool wird jetzt einige Minuten lang laufen und verschiedene Einstellungen prüfen und neu setzen.
  • Nach dem Ende der Abarbeitung öffnet sich automatisch die Logdatei rkill.txt.
  • Bitte poste sie in deinen Thread in CODE-Tags (Anleitung).



Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.02.2014, 14:13   #6
ferropolis
 
Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Code:
ATTFilter
Rkill 2.6.5 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 hxxp://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 02/02/2014 01:51:01 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * C:\Windows\DAODx.exe (PID: 1984) [WD-HEUR]
 * C:\Windows\SysWOW64\nlssrv32.exe (PID: 2216) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

 * System Policy Removed:  DisableCMD [HKCU]

Backup Registry file created at:
 D:\Eigene Datein\Desktop\rkill\rkill-02-02-2014-01-51-05.reg

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
  * HKLM\Software\Classes\exefile\shell\open\command\\IsolatedCommand was changed. It was reset to "%1" %*!

  * HKLM\Software\Classes\exefile\shell\runas\command\\IsolatedCommand was changed. It was reset to "%1" %*!


Performing miscellaneous checks:

 * No issues found.

Checking Windows Service Integrity: 

 * No issues found.

Searching for Missing Digital Signatures: 

 * No issues found.

Checking HOSTS File: 

 * Cannot edit the HOSTS file.
 * Permissions could not be fixed. Use Hosts-perm.bat to fix permissions: hxxp://www.bleepingcomputer.com/download/hosts-permbat/

Program finished at: 02/02/2014 01:51:15 PM
Execution time: 0 hours(s), 0 minute(s), and 14 seconds(s)
         
Code:
ATTFilter
ComboFix 14-02-01.01 - ferropolis 02.02.2014  14:04:42.2.6 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.16382.13206 [GMT 1:00]
ausgeführt von:: d:\eigene datein\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
 ADS - Windows: deleted 0 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_ctypes.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_elementtree.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_hashlib.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_multiprocessing.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_socket.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_ssl.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pyexpat.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pysqlite2._sqlite.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\python27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pythoncom27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\PyWinTypes27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\select.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\unicodedata.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32api.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32com.shell.shell.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32crypt.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32event.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32file.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32inet.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32pdh.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32pipe.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32process.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32profile.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32security.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32ts.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\windows._lib_cacheinvalidation.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._controls_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._core_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._gdi_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._html2.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._misc_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._windows_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._wizard.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxbase294u_net_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxbase294u_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_adv_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_core_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_html_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_webview_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_ctypes.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_elementtree.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_hashlib.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_multiprocessing.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_socket.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_ssl.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pyexpat.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pysqlite2._sqlite.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\python27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pythoncom27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\PyWinTypes27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\select.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\unicodedata.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32api.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32com.shell.shell.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32crypt.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32event.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32file.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32inet.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32pdh.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32pipe.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32process.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32profile.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32security.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32ts.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\windows._lib_cacheinvalidation.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._controls_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._core_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._gdi_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._html2.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._misc_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._windows_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._wizard.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxbase294u_net_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxbase294u_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_adv_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_core_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_html_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_webview_vc90.dll
.
---- Vorheriger Suchlauf -------
.
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_ctypes.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_elementtree.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_hashlib.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_multiprocessing.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_socket.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_ssl.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pyexpat.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pysqlite2._sqlite.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\python27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pythoncom27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\PyWinTypes27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\select.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\unicodedata.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32api.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32com.shell.shell.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32crypt.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32event.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32file.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32inet.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32pdh.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32pipe.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32process.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32profile.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32security.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32ts.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\windows._lib_cacheinvalidation.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._controls_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._core_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._gdi_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._html2.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._misc_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._windows_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._wizard.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxbase294u_net_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxbase294u_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_adv_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_core_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_html_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_webview_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_ctypes.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_elementtree.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_hashlib.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_multiprocessing.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_socket.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_ssl.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pyexpat.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pysqlite2._sqlite.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\python27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pythoncom27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\PyWinTypes27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\select.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\unicodedata.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32api.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32com.shell.shell.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32crypt.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32event.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32file.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32inet.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32pdh.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32pipe.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32process.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32profile.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32security.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32ts.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\windows._lib_cacheinvalidation.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._controls_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._core_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._gdi_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._html2.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._misc_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._windows_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._wizard.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxbase294u_net_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxbase294u_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_adv_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_core_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_html_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_webview_vc90.dll
c:\windows\AutoRun.ini
c:\windows\IsUn0407.exe
c:\windows\iun6002.exe
c:\windows\SysWow64\tmp2240.tmp
c:\windows\SysWow64\tmp2260.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-01-02 bis 2014-02-02  ))))))))))))))))))))))))))))))
.
.
2014-02-02 13:08 . 2014-02-02 13:08	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-01-31 17:48 . 2014-02-01 14:51	--------	dc----w-	C:\FRST
2014-01-31 16:52 . 2013-12-04 03:28	10315576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{29ED0093-F58D-4D5C-A212-B0D7A91E95F9}\mpengine.dll
2014-01-22 19:02 . 2014-01-22 19:02	--------	d-----w-	c:\users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 17:41 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-15 17:41 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-15 17:41 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-15 17:41 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-15 17:41 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-15 17:41 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-15 17:41 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-15 17:41 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
2014-01-15 17:41 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-31 16:49 . 2012-05-20 17:02	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-31 16:49 . 2012-03-11 08:38	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-15 19:29 . 2010-10-17 08:59	86054176	----a-w-	c:\windows\system32\MRT.exe
2014-01-12 13:42 . 2010-10-05 17:24	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2014-01-06 19:04 . 2010-10-05 17:24	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2013-12-21 15:20 . 2010-10-05 17:24	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
2013-12-19 17:01 . 2013-08-08 19:50	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-12-19 17:01 . 2013-08-08 19:49	131576	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-12-19 17:01 . 2013-08-08 19:49	108440	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-12-18 05:13 . 2010-09-30 19:33	270496	------w-	c:\windows\system32\MpSigStub.exe
2013-12-10 02:13 . 2013-12-22 13:52	982232	----a-w-	c:\windows\SysWow64\nvspcap.dll
2013-12-10 02:13 . 2013-12-22 13:52	1100248	----a-w-	c:\windows\system32\nvspcap64.dll
2013-12-05 08:42 . 2013-12-22 13:53	39200	----a-w-	c:\windows\system32\drivers\nvvad64v.sys
2013-12-05 08:42 . 2013-12-22 13:53	32544	----a-w-	c:\windows\SysWow64\nvaudcap32v.dll
2013-12-05 08:42 . 2013-12-22 13:50	35104	----a-w-	c:\windows\system32\nvaudcap64v.dll
2013-12-04 09:43 . 2013-12-04 09:43	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-04 09:43 . 2013-12-04 09:43	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-12-04 09:43 . 2013-12-04 09:43	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-04 09:43 . 2013-12-04 09:43	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2013-12-04 09:43 . 2013-12-04 09:43	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-12-04 09:43 . 2013-12-04 09:43	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2013-12-04 09:43 . 2013-12-04 09:43	34816	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-04 09:43 . 2013-12-04 09:43	337408	----a-w-	c:\windows\SysWow64\html.iec
2013-12-04 09:43 . 2013-12-04 09:43	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-12-04 09:43 . 2013-12-04 09:43	235008	----a-w-	c:\windows\system32\elshyph.dll
2013-12-04 09:43 . 2013-12-04 09:43	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2013-12-04 09:43 . 2013-12-04 09:43	942592	----a-w-	c:\windows\system32\jsIntl.dll
2013-12-04 09:43 . 2013-12-04 09:43	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-12-04 09:43 . 2013-12-04 09:43	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2013-12-04 09:43 . 2013-12-04 09:43	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2013-12-04 09:43 . 2013-12-04 09:43	81408	----a-w-	c:\windows\system32\icardie.dll
2013-12-04 09:43 . 2013-12-04 09:43	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-12-04 09:43 . 2013-12-04 09:43	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-04 09:43 . 2013-12-04 09:43	61952	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2013-12-04 09:43 . 2013-12-04 09:43	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2013-12-04 09:43 . 2013-12-04 09:43	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-12-04 09:43 . 2013-12-04 09:43	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2013-12-04 09:43 . 2013-12-04 09:43	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-12-04 09:43 . 2013-12-04 09:43	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-12-04 09:43 . 2013-12-04 09:43	454656	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-12-04 09:43 . 2013-12-04 09:43	453120	----a-w-	c:\windows\system32\dxtmsft.dll
2013-12-04 09:43 . 2013-12-04 09:43	413696	----a-w-	c:\windows\system32\html.iec
2013-12-04 09:43 . 2013-12-04 09:43	40448	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-04 09:43 . 2013-12-04 09:43	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-12-04 09:43 . 2013-12-04 09:43	296960	----a-w-	c:\windows\system32\dxtrans.dll
2013-12-04 09:43 . 2013-12-04 09:43	263376	----a-w-	c:\windows\system32\iedkcs32.dll
2013-12-04 09:43 . 2013-12-04 09:43	247808	----a-w-	c:\windows\system32\msls31.dll
2013-12-04 09:43 . 2013-12-04 09:43	235520	----a-w-	c:\windows\system32\url.dll
2013-12-04 09:43 . 2013-12-04 09:43	195584	----a-w-	c:\windows\system32\msrating.dll
2013-12-04 09:43 . 2013-12-04 09:43	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-12-04 09:43 . 2013-12-04 09:43	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2013-12-04 09:43 . 2013-12-04 09:43	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2013-12-04 09:43 . 2013-12-04 09:43	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2013-12-04 09:43 . 2013-12-04 09:43	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-12-04 09:43 . 2013-12-04 09:43	1228800	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-12-04 09:43 . 2013-12-04 09:43	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-12-04 09:43 . 2013-12-04 09:43	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-12-04 09:43 . 2013-12-04 09:43	105984	----a-w-	c:\windows\system32\iesysprep.dll
2013-12-04 09:43 . 2013-12-04 09:43	1051136	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-12-04 09:43 . 2013-12-04 09:43	84992	----a-w-	c:\windows\system32\mshtmled.dll
2013-12-04 09:43 . 2013-12-04 09:43	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2013-12-04 09:43 . 2013-12-04 09:43	774144	----a-w-	c:\windows\system32\jscript.dll
2013-12-04 09:43 . 2013-12-04 09:43	626176	----a-w-	c:\windows\system32\msfeeds.dll
2013-12-04 09:43 . 2013-12-04 09:43	62464	----a-w-	c:\windows\system32\pngfilt.dll
2013-12-04 09:43 . 2013-12-04 09:43	548352	----a-w-	c:\windows\system32\vbscript.dll
2013-12-04 09:43 . 2013-12-04 09:43	48128	----a-w-	c:\windows\system32\imgutil.dll
2013-12-04 09:43 . 2013-12-04 09:43	30208	----a-w-	c:\windows\system32\licmgr10.dll
2013-12-04 09:43 . 2013-12-04 09:43	243200	----a-w-	c:\windows\system32\webcheck.dll
2013-12-04 09:43 . 2013-12-04 09:43	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-12-04 09:43 . 2013-12-04 09:43	147968	----a-w-	c:\windows\system32\occache.dll
2013-12-04 09:43 . 2013-12-04 09:43	143872	----a-w-	c:\windows\system32\wextract.exe
2013-12-04 09:43 . 2013-12-04 09:43	13824	----a-w-	c:\windows\system32\mshta.exe
2013-12-04 09:43 . 2013-12-04 09:43	135680	----a-w-	c:\windows\system32\iepeers.dll
2013-12-04 09:43 . 2013-12-04 09:43	101376	----a-w-	c:\windows\system32\inseng.dll
2013-11-26 18:15 . 2013-08-08 19:49	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-11-26 11:54 . 2013-12-12 16:33	23183360	----a-w-	c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-12 16:33	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-12 16:33	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-12 16:33	66048	----a-w-	c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-12 16:33	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-12 16:33	2764288	----a-w-	c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-12 16:33	53760	----a-w-	c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-12 16:33	33792	----a-w-	c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-12 16:33	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-12 16:33	574976	----a-w-	c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-12 16:33	139264	----a-w-	c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-12 16:33	111616	----a-w-	c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-12 16:33	708608	----a-w-	c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-12 16:33	218624	----a-w-	c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-12 16:33	5769216	----a-w-	c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-12 16:33	553472	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 16:33	4243968	----a-w-	c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-12 16:33	1995264	----a-w-	c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-12 16:33	12996608	----a-w-	c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-12 16:33	1928192	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-12 16:33	2334208	----a-w-	c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-12 16:33	1395200	----a-w-	c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-12 16:33	817664	----a-w-	c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-12 16:33	1820160	----a-w-	c:\windows\SysWow64\wininet.dll
2013-11-23 18:26 . 2013-12-12 15:44	417792	----a-w-	c:\windows\SysWow64\WMPhoto.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-12-11 16:41	220632	----a-w-	c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-12-11 16:41	220632	----a-w-	c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-12-11 16:41	220632	----a-w-	c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2013-12-06 20203904]
"TomTomHOME.exe"="d:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2013-07-02 248208]
"Skype"="d:\programme\skype\Phone\Skype.exe" [2013-11-14 20584608]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-11-20 59720]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-19 684600]
"Reader Application Helper"="d:\program files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2013-06-25 899400]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="d:\programme\itunes\iTunesHelper.exe" [2013-11-01 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
"EnableLUA"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 FMS;Flash Media Server (FMS);d:\programme\adobe flash media server4\FMSMaster.exe;d:\programme\adobe flash media server4\FMSMaster.exe [x]
R3 FMSAdmin;Flash Media Administration Server;d:\programme\adobe flash media server4\FMSAdmin.exe;d:\programme\adobe flash media server4\FMSAdmin.exe [x]
R3 FMSHttpd;FMSHttpd;d:\programme\adobe flash media server4\Apache2.2\bin\httpd.exe;d:\programme\adobe flash media server4\Apache2.2\bin\httpd.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LADF_BakerCOnly;BakerC Filter Driver;c:\windows\system32\DRIVERS\ladfBakerCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfBakerCamd64.sys [x]
R3 LADF_BakerROnly;BakerR Filter Driver;c:\windows\system32\DRIVERS\ladfBakerRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfBakerRamd64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys;c:\windows\SYSNATIVE\DRIVERS\tapoas.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 DevoloNetworkService;devolo Network Service;d:\programme\devolo\dlan\devolonetsvc.exe;d:\programme\devolo\dlan\devolonetsvc.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\sysWOW64\drivers\npf_devolo.sys;c:\windows\sysWOW64\drivers\npf_devolo.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 SkypeUpdate;Skype Updater;d:\programme\skype\Updater\Updater.exe;d:\programme\skype\Updater\Updater.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;d:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;d:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 UsbClientService;UsbClientService;d:\program files (x86)\Synology\Assistant\UsbClientService.exe;d:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 LADF_CaptureOnly;LADF Capture Filter Driver;c:\windows\system32\DRIVERS\ladfGSCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSCamd64.sys [x]
S3 LADF_RenderOnly;LADF Render Filter Driver;c:\windows\system32\DRIVERS\ladfGSRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSRamd64.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\Drivers\LGPBTDD.sys;c:\windows\SYSNATIVE\Drivers\LGPBTDD.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
S3 VMfilt;VMfilt;c:\windows\system32\drivers\VMfilt64.sys;c:\windows\SYSNATIVE\drivers\VMfilt64.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-20 16:49]
.
2014-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10 14:52]
.
2014-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10 14:52]
.
2013-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1ce0f818ac57e9.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
2013-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1cef8d292a9344c.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
2014-02-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-12-11 16:41	244696	----a-w-	c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-12-11 16:41	244696	----a-w-	c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-12-11 16:41	244696	----a-w-	c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-12-06 14:47	778704	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"="d:\programme\SetPoint_6.20\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2012-07-24 6900024]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 190536]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-03-21 472992]
"BCSSync"="d:\programme\Office2010\Office14\BCSSync.exe" [2012-11-05 108144]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-14 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 183.111.12.21:8080
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: NameServer = 192.168.2.1
FF - ProfilePath - c:\users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
FF - Ext: Adobe Contribute Toolbar: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9} - d:\programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF - Ext: Adobe Acrobat - Create PDF: web2pdfextension@web2pdf.adobedotcom - d:\programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-ANNO 1602 Königs-Edition - c:\windows\IsUn0407.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-DesertCombat - c:\windows\iun6002.exe
AddRemove-{8A1EBF29-7CF8-471E-B90B-95FF36AC8248} - c:\programdata\{89E2929F-C967-49CB-9FE3-FD86B97312FE}\simplify3_setup.exe
AddRemove-{8A551628-20DB-4A9C-A172-572689456C44} - c:\programdata\{5D041186-ED95-4AA8-B0C6-2378CD198955}\MAX!_Setup.exe
AddRemove-{9E82D1DB-3AFB-4D18-A221-081F1B4B4789} - c:\programdata\{54AE07EB-BBE5-4429-9DF3-C156DB112B54}\denoise5_setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{517BDDE4-E3A7-4570-B21E-2B52B6139FC7}"=hex:51,66,7a,6c,4c,1d,38,12,8a,de,68,
   55,95,ad,1e,00,cd,08,68,12,b3,4d,db,d3
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90,
   43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87
"{074C1DC5-9320-4A9A-947D-C042949C6216}"=hex:51,66,7a,6c,4c,1d,38,12,ab,1e,5f,
   03,12,dd,f4,0f,eb,6b,83,02,91,c2,26,02
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f,
   aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{F4971EE7-DAA0-4053-9964-665D8EE6A077}"=hex:51,66,7a,6c,4c,1d,38,12,89,1d,84,
   f0,92,94,3d,05,e6,72,25,1d,8b,b8,e4,63
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
   2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:ef,d3,d8,ba,fc,cb,ce,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7d,ef,43,95,70,72,a7,4e,ae,86,a2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7d,ef,43,95,70,72,a7,4e,ae,86,a2,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:06,8f,a0,81,4f,8b,e0,7c,e8,d4,d1,6c,df,3f,fb,d9,df,cc,87,2b,13,
   59,b2,ff,4f,df,79,6d,c0,84,8e,58,84,ef,2d,fd,1b,d3,3d,40,c4,76,0e,ca,1c,3a,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:06,8f,a0,81,4f,8b,e0,7c,e8,d4,d1,6c,df,3f,fb,d9,df,cc,87,2b,13,
   59,b2,ff,4f,df,79,6d,c0,84,8e,58,3d,91,0b,90,2c,a3,e6,b5,c4,76,0e,ca,1c,3a,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\DAODx.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files\Logitech Gaming Software\Applets\LCDMedia.exe
c:\program files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
c:\program files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-02-02  14:11:49 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-02-02 13:11
.
Vor Suchlauf: 8.394.231.808 Bytes frei
Nach Suchlauf: 8.384.692.224 Bytes frei
.
- - End Of File - - 5BBBEC82AFDA9C70969C80E63ACDB7C5
A36C5E4F47E84449FF07ED3517B43A31
         

Alt 03.02.2014, 13:17   #7
schrauber
/// the machine
/// TB-Ausbilder
 

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.02.2014, 17:39   #8
ferropolis
 
Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.03.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
ferropolis :: FERROPOLIS [Administrator]

03.02.2014 17:14:27
mbam-log-2014-02-03 (17-14-27).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 244375
Laufzeit: 3 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0C1P1I1C1H1J1UtFzytH0A -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         
Code:
ATTFilter
# AdwCleaner v3.018 - Bericht erstellt am 03/02/2014 um 17:26:46
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : ferropolis - FERROPOLIS
# Gestartet von : D:\Eigene Datein\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\ferropolis\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\ferropolis\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\ferropolis\AppData\Roaming\Babylon
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\.autoreg
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Babylon

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v3.6.27 (de)

[ Datei : C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\prefs.js ]

Zeile gelöscht : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Zeile gelöscht : user_pref("browser.search.order.1", "Search the web (Babylon)");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=100476");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", 4);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltSrch", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.hmpg", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.id", "40ea805a00000000000020cf30214935");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15298");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.keyWordUrl", "hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastDP", 4);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.4.35.1017:09:20");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "3.6");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.newTab", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.propectorlck", 77384646);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkDS", 1);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.ptch_0717", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.srchPrvdr", "Search the web (Babylon)");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "tb9");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.4.35.10");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.4.35.1017:09:20");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=");

-\\ Google Chrome v

[ Datei : C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [5437 octets] - [03/02/2014 17:23:48]
AdwCleaner[S0].txt - [5178 octets] - [03/02/2014 17:26:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5238 octets] ##########
         
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by ferropolis on 03.02.2014 at 17:34:35,03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\caphyon



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.02.2014 at 17:36:26,85
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04
Ran by ferropolis (administrator) on FERROPOLIS on 03-02-2014 17:37:16
Running from D:\Eigene Datein\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\DAODx.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\MDM.EXE
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
() D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) D:\Programme\skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Sony Corporation) D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Apple Inc.) D:\Programme\itunes\iTunesHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointG\SetPointII.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Farbar) D:\Eigene Datein\Downloads\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] - D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [6900024 2012-07-24] (Logitech Inc.)
HKLM\...\Run: [Start WingMan Profiler] - C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - D:\Programme\Office2010\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\itunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20203904 2013-12-06] (Google)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [TomTomHOME.exe] - D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [Skype] - D:\Programme\skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Policies\system: [EnableLUA] 0

==================== Internet (Whitelisted) ====================

ProxyServer: 183.111.12.21:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x50F06B3E11DCCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
FF Plugin-x32: Adobe Acrobat - D:\Programme\adobe acrobat X Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Firebug - C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\Extensions\firebug@software.joehewitt.com [2012-02-19]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-12]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-10-18]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn [2011-06-25]

Chrome: 
=======
CHR HomePage: hxxp://www.aldi.com/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (WacomTabletPlugin) - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
CHR Plugin: (Reader Library) - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
CHR Extension: (Angry Birds) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2011-10-30]
CHR Extension: (Google Drive) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]
CHR Extension: (Stealthy) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2013-06-23]
CHR Extension: (Yulia Brodskaya) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2013-06-02]
CHR Extension: (Google Wallet) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Google Reader) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjhlfkghdhmijklfnahfkpgmhcmfgcm [2012-10-30]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\FERROP~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-14]
CHR StartMenuInternet: Google Chrome - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-26] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG)
S3 FMS; D:\Programme\adobe flash media server4\FMSMaster.exe [4693504 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSAdmin; D:\Programme\adobe flash media server4\FMSAdmin.exe [5706240 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSHttpd; D:\Programme\adobe flash media server4\Apache2.2\bin\httpd.exe [24645 2010-08-19] (Apache Software Foundation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office2010\Office14\GROOVE.EXE [50921648 2013-03-09] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-21] ()
S2 SkypeUpdate; D:\Programme\skype\Updater\Updater.exe [171680 2013-09-05] (Skype Technologies)
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom)
R2 UsbClientService; D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] ()

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [363096 2010-07-08] (Logitech)
S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [334552 2010-07-08] (Logitech)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0 PxHelp20; C:\Windows\SysWOW64\Drivers\PxHelp20.sys [44944 2009-04-28] (Sonic Solutions)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2010-11-14] (Duplex Secure Ltd.)
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-03 17:30 - 2014-02-03 17:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 17:23 - 2014-02-03 17:26 - 00000000 ___DC () C:\AdwCleaner
2014-02-03 17:07 - 2014-02-03 17:07 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-03 17:07 - 2014-02-03 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-03 17:07 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-02 14:11 - 2014-02-02 14:11 - 00048394 ____C () C:\ComboFix.txt
2014-02-02 13:53 - 2014-02-02 14:11 - 00000000 ___DC () C:\Qoobox
2014-02-02 13:53 - 2014-02-02 14:00 - 00000000 ____D () C:\Windows\erdnt
2014-02-02 13:53 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-02 13:53 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-02 13:53 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-01-31 18:48 - 2014-02-03 17:37 - 00000000 ___DC () C:\FRST
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ () C:\Windows\Minidump\010414-32105-01.dmp

==================== One Month Modified Files and Folders =======

2014-02-03 17:37 - 2014-01-31 18:48 - 00000000 ___DC () C:\FRST
2014-02-03 17:35 - 2011-10-18 19:18 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Skype
2014-02-03 17:34 - 2013-09-06 17:32 - 00030071 _____ () C:\Windows\setupact.log
2014-02-03 17:34 - 2013-05-14 19:58 - 00000000 ___RD () C:\Users\ferropolis\Google Drive
2014-02-03 17:34 - 2011-06-10 15:52 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-03 17:34 - 2010-10-05 13:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-03 17:34 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-03 17:33 - 2010-09-30 21:01 - 01564785 _____ () C:\Windows\WindowsUpdate.log
2014-02-03 17:33 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-03 17:33 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-03 17:30 - 2014-02-03 17:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 17:26 - 2014-02-03 17:23 - 00000000 ___DC () C:\AdwCleaner
2014-02-03 17:26 - 2011-02-03 21:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-03 17:21 - 2013-03-31 16:29 - 00072912 _____ () C:\Windows\PFRO.log
2014-02-03 17:15 - 2011-08-09 18:23 - 00000000 ____D () C:\ProgramData\Lexware
2014-02-03 17:11 - 2010-10-01 19:35 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Adobe
2014-02-03 17:07 - 2014-02-03 17:07 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-03 17:07 - 2014-02-03 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-03 17:07 - 2009-07-14 18:58 - 06008550 _____ () C:\Windows\system32\perfh007.dat
2014-02-03 17:07 - 2009-07-14 18:58 - 01804158 _____ () C:\Windows\system32\perfc007.dat
2014-02-03 17:07 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-03 17:04 - 2011-06-10 15:52 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-02 16:43 - 2010-09-30 20:33 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
2014-02-02 15:52 - 2012-12-08 16:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-02 14:11 - 2014-02-02 14:11 - 00048394 ____C () C:\ComboFix.txt
2014-02-02 14:11 - 2014-02-02 13:53 - 00000000 ___DC () C:\Qoobox
2014-02-02 14:10 - 2009-07-14 03:34 - 00000215 ____C () C:\Windows\system.ini
2014-02-02 14:00 - 2014-02-02 13:53 - 00000000 ____D () C:\Windows\erdnt
2014-01-31 18:28 - 2013-12-25 11:30 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\3A8434C7-EF7B-40BD-A0C4-4D41B304A44C.aplzod
2014-01-31 18:11 - 2010-09-30 21:01 - 00000000 ____D () C:\Users\ferropolis
2014-01-31 17:49 - 2012-12-08 16:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-31 17:49 - 2012-05-20 18:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-31 17:49 - 2012-03-11 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-29 19:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-01-29 17:05 - 2011-04-30 13:22 - 00000000 ____D () C:\Users\ferropolis\scans
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-25 18:52 - 2010-11-04 18:56 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-25 18:51 - 2011-10-26 17:58 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-01-25 18:50 - 2011-06-10 15:52 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-25 18:50 - 2010-10-18 17:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-25 18:46 - 2010-10-13 17:50 - 00000000 ____D () C:\Program Files\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-22 17:59 - 2010-10-16 17:53 - 00000000 ____D () C:\Users\ferropolis\webseiten
2014-01-22 17:52 - 2010-11-07 14:43 - 00000132 _____ () C:\Users\ferropolis\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-01-16 17:26 - 2009-07-14 05:45 - 05289680 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-15 20:30 - 2013-07-30 19:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 20:29 - 2010-10-17 09:59 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-12 14:42 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-06 20:04 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ () C:\Windows\Minidump\010414-32105-01.dmp
2014-01-04 13:25 - 2010-12-16 17:55 - 00000000 ____D () C:\Windows\Minidump

Some content of TEMP:
====================
C:\Users\ferropolis\AppData\Local\Temp\avgnt.exe
C:\Users\ferropolis\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-29 15:09

==================== End Of Log ============================
         
--- --- ---

Alt 04.02.2014, 11:58   #9
schrauber
/// the machine
/// TB-Ausbilder
 

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 05.02.2014, 19:28   #10
ferropolis
 
Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Nein, Problem habe ich schon lange nicht...
Kann man denn irgend wodran fest machen was ich falsch gemacht habe oder woher das gekommen ist?

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b374ab42d71808498f0b5f52e3f5c661
# engine=16937
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-04 09:17:49
# local_time=2014-02-04 10:17:49 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 15770 162219974 8550 0
# compatibility_mode=5893 16776573 100 94 12080 143178519 0 0
# scanned=602493
# found=0
# cleaned=0
# scan_time=9912
         
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.79  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 JavaFX 2.1.1    
 Java version out of Date! 
  Adobe Flash Player 12.0.0.43 Flash Player out of Date!  
 Adobe Reader 9 Adobe Reader out of Date! 
 Mozilla Firefox (3.6.27) Firefox out of Date!  
 Google Chrome 32.0.1700.102  
 Google Chrome 32.0.1700.107  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2014
Ran by ferropolis (administrator) on FERROPOLIS on 05-02-2014 19:26:40
Running from D:\Eigene Datein\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\MDM.EXE
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
() C:\Windows\DAODx.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
() D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) D:\Programme\skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Sony Corporation) D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Apple Inc.) D:\Programme\itunes\iTunesHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointG\SetPointII.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
() D:\Eigene Datein\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Farbar) D:\Eigene Datein\Downloads\FRST64 (2).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] - D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [6900024 2012-07-24] (Logitech Inc.)
HKLM\...\Run: [Start WingMan Profiler] - C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - D:\Programme\Office2010\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\itunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20203904 2013-12-06] (Google)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [TomTomHOME.exe] - D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [Skype] - D:\Programme\skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Policies\system: [EnableLUA] 0

==================== Internet (Whitelisted) ====================

ProxyServer: 183.111.12.21:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x50F06B3E11DCCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
FF Plugin-x32: Adobe Acrobat - D:\Programme\adobe acrobat X Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Firebug - C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\Extensions\firebug@software.joehewitt.com [2012-02-19]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-12]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-10-18]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn [2011-06-25]

Chrome: 
=======
CHR HomePage: hxxp://www.aldi.com/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (WacomTabletPlugin) - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
CHR Plugin: (Reader Library) - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
CHR Extension: (Angry Birds) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2011-10-30]
CHR Extension: (Google Drive) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]
CHR Extension: (Stealthy) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2013-06-23]
CHR Extension: (Yulia Brodskaya) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2013-06-02]
CHR Extension: (Google Wallet) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Google Reader) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjhlfkghdhmijklfnahfkpgmhcmfgcm [2012-10-30]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\FERROP~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-14]
CHR StartMenuInternet: Google Chrome - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-26] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG)
S3 FMS; D:\Programme\adobe flash media server4\FMSMaster.exe [4693504 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSAdmin; D:\Programme\adobe flash media server4\FMSAdmin.exe [5706240 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSHttpd; D:\Programme\adobe flash media server4\Apache2.2\bin\httpd.exe [24645 2010-08-19] (Apache Software Foundation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office2010\Office14\GROOVE.EXE [50921648 2013-03-09] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-21] ()
S2 SkypeUpdate; D:\Programme\skype\Updater\Updater.exe [171680 2013-09-05] (Skype Technologies)
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom)
R2 UsbClientService; D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] ()

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [363096 2010-07-08] (Logitech)
S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [334552 2010-07-08] (Logitech)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0 PxHelp20; C:\Windows\SysWOW64\Drivers\PxHelp20.sys [44944 2009-04-28] (Sonic Solutions)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2010-11-14] (Duplex Secure Ltd.)
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-04 21:39 - 2014-02-04 21:39 - 00000144 _____ () C:\Windows\Pcfk32.INI
2014-02-04 19:24 - 2014-02-04 19:24 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-03 17:30 - 2014-02-03 17:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 17:23 - 2014-02-03 17:26 - 00000000 ___DC () C:\AdwCleaner
2014-02-03 17:07 - 2014-02-03 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-03 17:07 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-02 14:11 - 2014-02-02 14:11 - 00048394 ____C () C:\ComboFix.txt
2014-02-02 13:53 - 2014-02-02 14:11 - 00000000 ___DC () C:\Qoobox
2014-02-02 13:53 - 2014-02-02 14:00 - 00000000 ____D () C:\Windows\erdnt
2014-02-02 13:53 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-02 13:53 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-02 13:53 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-01-31 18:48 - 2014-02-05 19:26 - 00000000 ___DC () C:\FRST
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2014-02-05 19:26 - 2014-01-31 18:48 - 00000000 ___DC () C:\FRST
2014-02-05 19:23 - 2011-10-18 19:18 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Skype
2014-02-05 19:18 - 2010-10-01 19:35 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Adobe
2014-02-05 19:16 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-05 19:16 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-05 19:13 - 2009-07-14 18:58 - 06052176 _____ () C:\Windows\system32\perfh007.dat
2014-02-05 19:13 - 2009-07-14 18:58 - 01817712 _____ () C:\Windows\system32\perfc007.dat
2014-02-05 19:13 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-05 19:11 - 2010-09-30 21:01 - 01625813 _____ () C:\Windows\WindowsUpdate.log
2014-02-05 19:08 - 2013-05-14 19:58 - 00000000 ___RD () C:\Users\ferropolis\Google Drive
2014-02-05 19:07 - 2013-09-06 17:32 - 00030519 _____ () C:\Windows\setupact.log
2014-02-05 19:07 - 2011-06-10 15:52 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-05 19:07 - 2010-10-05 13:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-05 19:07 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-04 22:04 - 2011-06-10 15:52 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-04 21:52 - 2012-12-08 16:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-04 21:43 - 2010-09-30 20:33 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
2014-02-04 21:40 - 2011-08-09 18:23 - 00000000 ____D () C:\ProgramData\Lexware
2014-02-04 21:39 - 2014-02-04 21:39 - 00000144 _____ () C:\Windows\Pcfk32.INI
2014-02-04 19:34 - 2013-06-26 19:08 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Audible
2014-02-04 19:24 - 2014-02-04 19:24 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-03 18:32 - 2013-12-25 11:30 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\3A8434C7-EF7B-40BD-A0C4-4D41B304A44C.aplzod
2014-02-03 17:49 - 2010-10-18 17:15 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2014-02-03 17:30 - 2014-02-03 17:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 17:26 - 2014-02-03 17:23 - 00000000 ___DC () C:\AdwCleaner
2014-02-03 17:26 - 2011-02-03 21:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-03 17:21 - 2013-03-31 16:29 - 00072912 _____ () C:\Windows\PFRO.log
2014-02-03 17:07 - 2014-02-03 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-02 14:11 - 2014-02-02 14:11 - 00048394 ____C () C:\ComboFix.txt
2014-02-02 14:11 - 2014-02-02 13:53 - 00000000 ___DC () C:\Qoobox
2014-02-02 14:10 - 2009-07-14 03:34 - 00000215 ____C () C:\Windows\system.ini
2014-02-02 14:00 - 2014-02-02 13:53 - 00000000 ____D () C:\Windows\erdnt
2014-01-31 18:11 - 2010-09-30 21:01 - 00000000 ____D () C:\Users\ferropolis
2014-01-31 17:49 - 2012-12-08 16:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-31 17:49 - 2012-05-20 18:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-31 17:49 - 2012-03-11 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-29 19:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-01-29 17:05 - 2011-04-30 13:22 - 00000000 ____D () C:\Users\ferropolis\scans
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-25 18:52 - 2010-11-04 18:56 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-25 18:51 - 2011-10-26 17:58 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-01-25 18:50 - 2011-06-10 15:52 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-25 18:50 - 2010-10-18 17:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-25 18:46 - 2010-10-13 17:50 - 00000000 ____D () C:\Program Files\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-22 17:59 - 2010-10-16 17:53 - 00000000 ____D () C:\Users\ferropolis\webseiten
2014-01-22 17:52 - 2010-11-07 14:43 - 00000132 _____ () C:\Users\ferropolis\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-01-16 17:26 - 2009-07-14 05:45 - 05289680 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-15 20:30 - 2013-07-30 19:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 20:29 - 2010-10-17 09:59 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-12 14:42 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-06 20:04 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0

Some content of TEMP:
====================
C:\Users\ferropolis\AppData\Local\Temp\avgnt.exe
C:\Users\ferropolis\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-29 15:09

==================== End Of Log ============================
         
--- --- ---

Alt 06.02.2014, 14:27   #11
schrauber
/// the machine
/// TB-Ausbilder
 

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Java, Adobe und Firefox updaten. Nachvollziehen kann man das nicht.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
ProxyServer: 183.111.12.21:8080
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.





Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 07.02.2014, 17:47   #12
ferropolis
 
Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Hallo

vielen Dank für deine wirklich tolle Hilfe - es scheint wieder alles zu funktionieren.

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2014
Ran by ferropolis at 2014-02-07 17:47:07 Run:1
Running from D:\Eigene Datein\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
ProxyServer: 183.111.12.21:8080
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.

==== End of Fixlog ====
         

Geändert von ferropolis (07.02.2014 um 18:01 Uhr)

Alt 08.02.2014, 13:16   #13
schrauber
/// the machine
/// TB-Ausbilder
 

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Standard

Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop



Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop
administrator, anhang, bessere, desktop, einfach, entfernen, ergebnisse, gesucht, internet, manager, mcafee, nicht öffnen, programme, prüfen, pum.hijack.cmdprompt, pup.optional.installcore.a, riskware.tool.ck, schnell, seite, systemsteuerung, task manager, taskmanager, verschwunden, öffnen



Ähnliche Themen: Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop


  1. Desktop und Taskleiste verschwunden
    Alles rund um Windows - 02.12.2014 (13)
  2. Windows 7: McAfee durch Gruppenrichtlinie gesperrt.
    Log-Analyse und Auswertung - 20.05.2014 (13)
  3. Ukash: WinXP gesperrt, Taskmanager gesperrt (Driveby Download mit IE)
    Plagegeister aller Art und deren Bekämpfung - 20.06.2012 (5)
  4. "McAfee"-Windows durch Trojaner gesperrt
    Log-Analyse und Auswertung - 29.03.2012 (1)
  5. arg135043.exe Startleiste verschwunden und Taskmanager deaktiviert
    Plagegeister aller Art und deren Bekämpfung - 23.03.2012 (4)
  6. Taskmanager verschwunden und unerwünschte Internetseite
    Log-Analyse und Auswertung - 22.03.2012 (1)
  7. 50 € Trojaner Schwarzer Bilfschirm Rote Schrift Bildschirm gesperrt Taskmanager gesperrt
    Log-Analyse und Auswertung - 05.02.2012 (11)
  8. XP - Taskmanager durch Admin gesperrt und fehlende aktive Symbole in Infobereich
    Plagegeister aller Art und deren Bekämpfung - 25.01.2012 (3)
  9. Systemsteuerung verschwunden / keine Berechtigung, obwohl als Admin angemeldet! iastor.sys infiziert
    Plagegeister aller Art und deren Bekämpfung - 11.01.2012 (25)
  10. Desktop + Taskleiste verschwunden!
    Plagegeister aller Art und deren Bekämpfung - 16.09.2008 (4)
  11. Alles durch Admin(Virus) gesperrt? Oo
    Plagegeister aller Art und deren Bekämpfung - 14.07.2008 (7)
  12. Taskleiste und DEsktop weg / Tasgmanger durch Admin gesperrt
    Log-Analyse und Auswertung - 26.06.2008 (27)
  13. Desktop verschwunden?
    Alles rund um Windows - 23.02.2008 (1)
  14. Desktop und Startleiste verschwunden
    Log-Analyse und Auswertung - 22.06.2007 (3)
  15. Ausführzeile verschwunden, taskmanager deaktiviert
    Plagegeister aller Art und deren Bekämpfung - 13.06.2006 (5)
  16. Desktop Hintergrund verschwunden
    Alles rund um Windows - 03.06.2006 (3)
  17. Nach Trojanerentfernung kein Desktop + Taskmanager gesperrt
    Plagegeister aller Art und deren Bekämpfung - 26.02.2006 (7)

Zum Thema Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop - Hallo vor 1-2 Tage habe ich durch Zufall gesehen das mein Task Manager weg ist, nichts böses bei gedacht, eher eine Laune der Natur vielleicht. Heute sollte ich eines besseren - Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop...
Archiv
Du betrachtest: Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.