BSI Email Account gehackt. PC mit Trojaner befallen?

hotte83 · 08.04.2014, 13:44

Hi

Es geht hier um den Rechner meiner Eltern. Ein Email Konto wurde gehackt und ich habe Angst, dass der Rechner mit einem Trojaner, Rootkit etc. befallen ist.

Hier sind die Logfiles:

FRST:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 (ATTENTION: ====> FRST version is 26 days old and could be outdated)
Ran by familie (administrator) on FAMILIE-PC on 08-04-2014 14:14:10
Running from C:\Users\familie\Desktop\befall
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Users\familie\Desktop\befall\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-20] ()
HKLM-x32\...\Run: [AVMWlanClient] - C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [1987976 2012-02-28] (LogMeIn Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-03-31] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-1878297874-2239277506-3418807465-1000\...\Run: [Google Update] - C:\Users\familie\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-06-03] (Google Inc.)
HKU\S-1-5-21-1878297874-2239277506-3418807465-1000\...\Run: [GoogleChromeAutoLaunch_463CDEA43E5BC3FE06F166F70F46F8FB] - C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe [859976 2014-03-15] (Google Inc.)
HKU\S-1-5-21-1878297874-2239277506-3418807465-1000\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844296 2012-12-20] (Samsung)
HKU\S-1-5-21-1878297874-2239277506-3418807465-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP&dt=072613
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 0.0.0.0

FireFox:
========
FF ProfilePath: C:\Users\familie\AppData\Roaming\Mozilla\Firefox\Profiles\w72z3jrj.default
FF DefaultSearchEngine: Bing 
FF SelectedSearchEngine: Bing 
FF SearchEngineOrder.3: Bing 
FF Homepage: hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP&dt=072613
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\familie\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\familie\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\familie\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\familie\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\familie\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\familie\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Users\familie\AppData\Roaming\Mozilla\Firefox\Profiles\w72z3jrj.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

Chrome: 
=======
CHR HomePage: hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP&dt=072613
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\gcswf32.dll No File
CHR Plugin: (Google Update) - C:\Users\familie\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (Angry Birds) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2013-05-24]
CHR Extension: (YouTube Options) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdokagampppgbnjfdlkfpphniapiiifn [2013-05-26]
CHR Extension: (TV) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\beobeededemalmllhkmnkinmfembdimh [2013-05-24]
CHR Extension: (YouTube) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-06-03]
CHR Extension: (Google-Suche) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-06-03]
CHR Extension: (Flag for Chrome) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbpojpfdiliekbbiplijcphappgcgjfn [2012-06-03]
CHR Extension: (AdBlock) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-06-03]
CHR Extension: (YouTube Downloader: MP3 / HD Video Download) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokfcbmfpgeajcgkaeigohghnkhjmcbj [2012-06-03]
CHR Extension: (Auto HD For YouTube™) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\koiaokdomkpjdgniimnkhgbilbjgpeak [2012-06-03]
CHR Extension: (BugMeNot Lite) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lackfehpdclhclidcbbfcemcpolgdgnb [2012-08-28]
CHR Extension: (Webcam Toy) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfbgimoladefibpklnfmkpknadbklade [2013-05-24]
CHR Extension: (Google Maps) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2013-05-24]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2012-09-28]
CHR Extension: (Google Wallet) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Youtube Video Downloader) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\obmbipnhbnpicpechoajlkjfdiopnoki [2013-05-26]
CHR Extension: (TV Germany - TV Duitsland Fernsehen) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\oeikdijhnfihaklejncbiaciicpenhak [2013-05-24]
CHR Extension: (Google Mail) - C:\Users\familie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-06-03]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\familie\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-28]
CHR HKCU\...\Chrome\Extension: [nlafpokblfobdnjhhggocaanijghemnd] - C:\Users\familie\AppData\Local\CRE\nlafpokblfobdnjhhggocaanijghemnd.crx [2012-07-05]
CHR HKLM-x32\...\Chrome\Extension: [nlafpokblfobdnjhhggocaanijghemnd] - C:\Users\familie\AppData\Local\CRE\nlafpokblfobdnjhhggocaanijghemnd.crx [2012-07-05]
CHR StartMenuInternet: Google Chrome - C:\Users\familie\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-03-31] (AVAST Software)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
S3 Creative Dolby Digital Live Pack Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\DDLLicensing.exe [79360 2012-06-03] (Creative Labs)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-03-31] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-03-31] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-03-31] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-03-31] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-03-31] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-03-31] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-03-31] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R3 ctgame; C:\Windows\System32\DRIVERS\ctgame.sys [26328 2010-03-19] (Creative Technology Ltd.)
R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
R3 SKYNET; C:\Windows\System32\DRIVERS\SkyNET_AMD64.SYS [617048 2010-05-10] (TechniSat Digital, S.A.)
S3 U6000ALL; C:\Windows\System32\DRIVERS\U6000ALL.sys [276480 2010-01-14] ()
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-08 14:13 - 2014-04-08 14:14 - 00000000 ____D () C:\FRST
2014-04-08 14:13 - 2014-04-08 14:13 - 00000000 _____ () C:\Users\familie\defogger_reenable
2014-04-08 14:10 - 2014-04-08 14:14 - 00000000 ____D () C:\Users\familie\Desktop\befall
2014-04-08 13:36 - 2014-04-08 13:36 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-04-08 13:36 - 2014-04-08 13:36 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-08 13:36 - 2014-04-08 13:36 - 00000000 ____D () C:\Users\familie\AppData\Local\Skype
2014-04-07 09:32 - 2014-04-07 09:32 - 00516506 _____ () C:\Users\familie\Desktop\Unbenannt 1auto.odt
2014-04-05 19:43 - 2014-04-05 19:43 - 00013789 _____ () C:\Users\familie\Desktop\Unbenannt 1.odt
2014-04-05 18:34 - 2014-04-08 08:50 - 00000000 ____D () C:\Users\familie\Desktop\2014-04-05
2014-04-04 22:11 - 2014-04-04 22:25 - 00000000 ____D () C:\Users\familie\Desktop\Unfall
2014-04-04 20:15 - 2014-04-04 22:09 - 00000000 ____D () C:\Users\familie\Desktop\2014-04-04
2014-04-01 20:05 - 2014-04-03 18:42 - 00000000 ____D () C:\Users\familie\Desktop\2014-04-01
2014-03-31 12:10 - 2014-03-31 12:10 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-26 15:22 - 2014-04-07 11:56 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-26
2014-03-24 13:08 - 2014-03-24 20:43 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-24
2014-03-23 18:56 - 2014-03-23 18:56 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-03-23 18:56 - 2014-03-23 18:56 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-03-22 12:56 - 2014-03-22 12:56 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-22
2014-03-21 19:25 - 2014-03-21 19:25 - 00009725 _____ () C:\Users\familie\Desktop\beschreibung ebay fellmantel.odt
2014-03-19 14:44 - 2014-03-21 17:50 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-19
2014-03-15 12:39 - 2014-03-15 12:40 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-15
2014-03-12 13:16 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-12 13:16 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-12 13:16 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-12 13:16 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-12 13:16 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-12 13:16 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-12 13:16 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-12 13:16 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-12 13:16 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-12 13:16 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-12 13:16 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-12 13:16 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-12 13:16 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-12 13:16 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-12 13:16 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-12 13:16 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-12 13:16 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-12 13:16 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-12 13:16 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-12 13:16 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-12 13:16 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-12 13:16 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-12 13:16 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-12 13:16 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-12 13:16 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-12 13:16 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-12 13:16 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-12 13:16 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-12 13:16 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-12 13:16 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-12 13:16 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-12 13:16 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-12 13:16 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-12 13:16 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-12 13:16 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-12 13:16 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-12 13:16 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-12 13:16 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-12 13:16 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-12 13:16 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-12 13:16 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-12 13:16 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-12 13:16 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-12 13:16 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-12 13:15 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-12 13:15 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-12 13:15 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-12 13:15 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

==================== One Month Modified Files and Folders =======

2014-04-08 14:14 - 2014-04-08 14:13 - 00000000 ____D () C:\FRST
2014-04-08 14:14 - 2014-04-08 14:10 - 00000000 ____D () C:\Users\familie\Desktop\befall
2014-04-08 14:13 - 2014-04-08 14:13 - 00000000 _____ () C:\Users\familie\defogger_reenable
2014-04-08 14:13 - 2012-06-03 14:28 - 00000000 ____D () C:\Users\familie
2014-04-08 14:12 - 2011-04-12 09:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-08 14:12 - 2011-04-12 09:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-08 14:12 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-08 14:11 - 2012-06-05 18:03 - 01136857 _____ () C:\Windows\WindowsUpdate.log
2014-04-08 14:08 - 2013-05-18 13:34 - 00000000 ____D () C:\Users\familie\AppData\Local\LogMeIn Hamachi
2014-04-08 14:08 - 2013-05-15 11:48 - 00048753 _____ () C:\Windows\setupact.log
2014-04-08 14:08 - 2013-05-11 13:35 - 00000000 ____D () C:\Users\familie\AppData\Roaming\Skype
2014-04-08 14:08 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-08 13:36 - 2014-04-08 13:36 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-04-08 13:36 - 2014-04-08 13:36 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-08 13:36 - 2014-04-08 13:36 - 00000000 ____D () C:\Users\familie\AppData\Local\Skype
2014-04-08 13:36 - 2013-05-11 13:35 - 00000000 ____D () C:\ProgramData\Skype
2014-04-08 13:35 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-08 13:35 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-08 13:31 - 2012-07-21 22:00 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-08 08:57 - 2012-06-03 14:56 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1878297874-2239277506-3418807465-1000UA.job
2014-04-08 08:50 - 2014-04-05 18:34 - 00000000 ____D () C:\Users\familie\Desktop\2014-04-05
2014-04-08 08:24 - 2013-05-15 11:34 - 00000000 ___RD () C:\Arbeitsprogramme
2014-04-07 12:57 - 2012-06-03 14:56 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1878297874-2239277506-3418807465-1000Core.job
2014-04-07 11:56 - 2014-03-26 15:22 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-26
2014-04-07 09:32 - 2014-04-07 09:32 - 00516506 _____ () C:\Users\familie\Desktop\Unbenannt 1auto.odt
2014-04-06 09:36 - 2013-05-26 09:10 - 00000000 ____D () C:\Downloads you tube ab 26.05.2013
2014-04-05 19:43 - 2014-04-05 19:43 - 00013789 _____ () C:\Users\familie\Desktop\Unbenannt 1.odt
2014-04-05 16:56 - 2012-07-21 16:58 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-04 22:25 - 2014-04-04 22:11 - 00000000 ____D () C:\Users\familie\Desktop\Unfall
2014-04-04 22:09 - 2014-04-04 20:15 - 00000000 ____D () C:\Users\familie\Desktop\2014-04-04
2014-04-03 18:42 - 2014-04-01 20:05 - 00000000 ____D () C:\Users\familie\Desktop\2014-04-01
2014-04-01 13:39 - 2013-09-13 13:56 - 00199942 _____ () C:\Windows\PFRO.log
2014-03-31 12:52 - 2012-06-03 14:56 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1878297874-2239277506-3418807465-1000UA
2014-03-31 12:52 - 2012-06-03 14:56 - 00003706 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1878297874-2239277506-3418807465-1000Core
2014-03-31 12:10 - 2014-03-31 12:10 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-31 12:10 - 2014-01-02 21:04 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-03-31 12:10 - 2013-03-14 09:37 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-03-31 12:10 - 2013-03-14 09:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-03-31 12:10 - 2012-06-03 15:02 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-03-31 12:10 - 2012-06-03 15:02 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-03-31 12:10 - 2012-06-03 15:02 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-03-31 12:10 - 2012-06-03 15:02 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-03-31 12:10 - 2012-06-03 15:02 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-03-26 15:29 - 2012-06-03 18:15 - 00000000 ____D () C:\Users\familie\AppData\Roaming\vlc
2014-03-24 20:43 - 2014-03-24 13:08 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-24
2014-03-23 19:03 - 2012-08-26 18:52 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-03-23 18:57 - 2012-06-03 18:06 - 00000000 ____D () C:\Users\familie\AppData\Local\Adobe
2014-03-23 18:56 - 2014-03-23 18:56 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-03-23 18:56 - 2014-03-23 18:56 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-03-23 18:56 - 2012-06-03 18:05 - 00000000 ____D () C:\ProgramData\Adobe
2014-03-23 18:28 - 2014-03-02 12:08 - 00000000 ____D () C:\Users\familie\Desktop\Bankwechsel
2014-03-22 12:56 - 2014-03-22 12:56 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-22
2014-03-21 19:25 - 2014-03-21 19:25 - 00009725 _____ () C:\Users\familie\Desktop\beschreibung ebay fellmantel.odt
2014-03-21 17:50 - 2014-03-19 14:44 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-19
2014-03-19 09:05 - 2013-03-07 19:41 - 00000000 ____D () C:\Users\familie\AppData\Roaming\Mozilla
2014-03-18 09:18 - 2013-07-23 22:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 09:18 - 2012-06-03 15:55 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-15 12:40 - 2014-03-15 12:39 - 00000000 ____D () C:\Users\familie\Desktop\2014-03-15
2014-03-13 08:46 - 2009-07-14 06:45 - 00320008 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-12 13:31 - 2014-02-05 22:31 - 05128584 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 13:31 - 2012-07-21 22:00 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 13:31 - 2012-07-21 21:59 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 13:31 - 2012-07-21 21:59 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-09 20:16 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

Some content of TEMP:
====================
C:\Users\familie\AppData\Local\Temp\APNSetup.exe
C:\Users\familie\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\familie\AppData\Local\Temp\SkypeSetup.exe
C:\Users\familie\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-30 19:15

==================== End Of Log ============================

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by familie at 2014-04-08 14:14:37
Running from C:\Users\familie\Desktop\befall
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

4Free Video Converter 2 (HKLM-x32\...\{7061301A-0D44-432F-859D-AF705DA2C81F}_is1) (Version:  - 4Free Studio)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
AMD Accelerated Video Transcoding (Version: 2.00.0002 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.923.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{5831C6D6-309D-DBB5-14F7-FEE57086CEE7}) (Version: 8.0.873.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.70405.2224 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft MediaImpression 2 (HKLM-x32\...\{81FC0476-9507-4CD3-95A7-2BE60E256D1D}) (Version: 2.0.27.846 - ArcSoft)
Audacity 1.3.12 (Unicode) (HKLM-x32\...\Audacity 1.3 Beta (Unicode)_is1) (Version:  - Audacity Team)
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber Deutschland)
AV Grabber (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2016 - Avast Software)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.0405.2205.37728 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.19 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.4.2.3442 - CDBurnerXP)
Creative ALchemy (HKLM-x32\...\ALchemy) (Version: 1.41 - Creative Technology Limited)
Creative Lautsprechereinstellungen (HKLM-x32\...\SPEAKER) (Version:  - )
Creative-Audiokonsole (HKLM-x32\...\AudioCS) (Version: 1.33 - Creative Technology Limited)
Creative-Grafik-Equalizer (HKLM-x32\...\Equalizer) (Version:  - )
DDL und DTS Connect-Lizenzaktivierung (HKLM-x32\...\AcMgrDDL) (Version:  - )
Desktop Icon für Amazon (HKLM\...\DesktopIconAmazon) (Version: 1.0.1 (de) - )
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Dolby Digital Live Pack (HKLM-x32\...\Dolby Digital Live Pack) (Version: 3.00 - Creative Technology Limited)
Drv (HKLM-x32\...\{DA71A94B-3617-4935-8BBE-1566B2174C95}) (Version: 1.00.0000 - My Company Name)
DTS Connect Pack (HKLM-x32\...\DTS Connect Pack) (Version: 1.00 - Creative Technology Limited)
DVBViewer TE2 (HKLM-x32\...\DVBViewer TE2_is1) (Version:  - CM&V)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 13.3.0.9066 - Landesfinanzdirektion Thüringen)
Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.0.2 - SCS Software)
EZ Grabber (HKLM-x32\...\InstallShield_{5B6455A4-E812-479B-A762-C2356244CF97}) (Version: 1.00.0000 - Ihr Firmenname)
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Free YouTube Download version 3.1.37.918 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
Goodbye Deponia (HKLM-x32\...\Deponia 3) (Version: 1.0 - Daedalic Entertainment)
Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Earth (HKLM-x32\...\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}) (Version: 6.2.2.6613 - Google)
Google Talk Plugin (HKLM-x32\...\{E121A4FE-009B-385B-BB0D-B934E2A88288}) (Version: 5.2.4.18058 - Google)
iTunes (HKLM\...\{76FF0F03-B707-4332-B5D1-A56C8303514E}) (Version: 11.0.4.4 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.0 (HKLM-x32\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.1.0.166 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.1.0.166 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware Version 1.62.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.62.0.1300 - Malwarebytes Corporation)
Media Player Codec Pack 4.2.5 (HKLM-x32\...\Media Player - Codec Pack) (Version: 4.2.5 - Media Player Codec Pack)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{307a22b8-8353-4c5e-b67b-2404c5734558}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Mozilla Firefox 19.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 19.0.2 (x86 de)) (Version: 19.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 19.0.2 - Mozilla)
MSVCRT Redists (x32 Version: 1.0 - Sony Creative Software Inc.) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Musik & Audio Restaurator Pro 5.0 (HKLM-x32\...\Musik & Audio Restaurator Pro 5_is1) (Version: 5.0 - Softfeld)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
n-tv plus (HKLM-x32\...\{FC1B9FBC-5550-433F-AFEC-2EC930C14EBB}) (Version: 7.4.3.0 - n-tv Nachrichtenfernsehen GmbH)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.1.12123_2 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.1.12123_2 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.16.0 - SAMSUNG Electronics Co., Ltd.)
SCR3xxx Smart Card Reader (HKLM-x32\...\{6DA99C69-0799-467E-9496-F37E1E452A4A}) (Version: 8.40 - SCM Microsystems)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SoundFont-Bank-Manager (HKLM-x32\...\SFBM) (Version:  - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TechniSat DVB-PC TV Star (HKLM-x32\...\{D032A7F0-8B5C-4603-8B46-235025D5F9C1}) (Version: 4.3.3 - TechniSat)
Turbo Lister 2 (HKLM-x32\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
Ulead VideoStudio SE DVD (HKLM-x32\...\{8F8D9297-FDD2-405A-97E7-E52C7B2F97B3}) (Version: 10.0 - Ulead Systems)
USB Video Device (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.48200.117 - Sonix)
VLC media player 2.0.1 (HKLM\...\VLC media player) (Version: 2.0.1 - VideoLAN)
WinRAR 4.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)

==================== Restore Points  =========================

08-04-2014 06:01:04 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {10488A4E-B395-4E5F-87B0-EC2DAB1422B3} - System32\Tasks\{6FB5FB55-2220-4F0C-B1F4-EA64C050C320} => E:\Desktop\PUSHINST\setup.exe
Task: {14775D2C-E5F2-427E-9E8B-15D5C3596034} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation)
Task: {2B0A67F1-F2FB-4123-A425-9D04EDCB7C2E} - System32\Tasks\{B47A92BB-F708-4FB5-BE45-EAAAF17F95DD} => E:\Desktop\PUSHINST\setup.exe
Task: {3329F4BF-845D-44A0-802C-8A4B4152A138} - System32\Tasks\PC Rambazamba => C:\Program Files (x86)\Langmeier Software\PC Rambazamba\pcrambazamba.exe
Task: {36D910A5-B476-41A8-A030-097DAE33B779} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1878297874-2239277506-3418807465-1000Core => C:\Users\familie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-03] (Google Inc.)
Task: {4D318206-DF15-4EC1-8283-B92BBE962F31} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {5492C8A4-6CE3-4E24-9F26-5011DE909735} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1878297874-2239277506-3418807465-1000UA => C:\Users\familie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-03] (Google Inc.)
Task: {69F44A1B-203C-4765-85E0-F561B809125F} - System32\Tasks\{B137FECF-6BB9-4C4A-BAF1-E7429FE7A0C0} => Chrome.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&amp;page=tsProgressBar
Task: {6CF8388E-137D-49CE-BEF8-ED2DA97C7EEC} - System32\Tasks\Google Updater and Installer => C:\Users\familie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-03] (Google Inc.)
Task: {76373687-147D-4EF1-A0BA-27DE4249C5F5} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-03-31] (AVAST Software)
Task: {886CD1D2-5374-4E82-B341-6106C5CAE118} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1878297874-2239277506-3418807465-1000Core.job => C:\Users\familie\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1878297874-2239277506-3418807465-1000UA.job => C:\Users\familie\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-06-03 16:09 - 2012-02-17 20:55 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2014-04-08 14:10 - 2014-04-08 14:10 - 00050477 _____ () C:\Users\familie\Desktop\befall\Defogger.exe
2014-04-07 11:43 - 2014-04-07 11:43 - 02189824 _____ () C:\Program Files\AVAST Software\Avast\defs\14040700\algo.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-11-22 08:52 - 2013-11-22 08:52 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-03-15 12:09 - 2014-03-15 02:50 - 00051016 _____ () C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll
2014-03-15 12:09 - 2014-03-15 02:50 - 00716616 _____ () C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\libglesv2.dll
2014-03-15 12:09 - 2014-03-15 02:50 - 00100168 _____ () C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\libegl.dll
2014-03-15 12:09 - 2014-03-15 02:50 - 04061000 _____ () C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll
2014-03-15 12:09 - 2014-03-15 02:50 - 00394568 _____ () C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll
2014-03-15 12:09 - 2014-03-15 02:50 - 01647432 _____ () C:\Users\familie\AppData\Local\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: AsioThk32Reg => REGSVR32.EXE /S CTASIO.DLL
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: tsnp2uvc => C:\Windows\tsnp2uvc.exe
MSCONFIG\startupreg: UVS10 Preload => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe

==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (04/08/2014 02:08:11 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/08/2014 01:27:58 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/08/2014 07:57:00 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/07/2014 01:36:41 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/07/2014 00:41:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (04/07/2014 11:42:27 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/07/2014 08:07:56 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/06/2014 07:17:58 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/06/2014 09:36:40 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: vc.exe, Version: 6.0.1.515, Zeitstempel: 0x4ff2dfd4
Name des fehlerhaften Moduls: imfc0.dll, Version: 0.9.0.0, Zeitstempel: 0x4c74a476
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00005d9e
ID des fehlerhaften Prozesses: 0x988
Startzeit der fehlerhaften Anwendung: 0xvc.exe0
Pfad der fehlerhaften Anwendung: vc.exe1
Pfad des fehlerhaften Moduls: vc.exe2
Berichtskennung: vc.exe3

Error: (04/06/2014 09:27:57 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (04/08/2014 02:08:01 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (04/08/2014 01:27:49 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (04/08/2014 07:56:50 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (04/07/2014 09:52:59 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MASTER",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{843EE731-DEB4-46AD-A33E-9F3116738204}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (04/07/2014 01:56:11 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "ANNETTE-PC",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{7FD96410-1B73-4A73-B842-03D6AEE519BE}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (04/07/2014 01:36:30 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (04/07/2014 01:36:36 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎07.‎04.‎2014 um 13:30:17 unerwartet heruntergefahren.

Error: (04/07/2014 11:42:17 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (04/07/2014 08:07:45 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (04/06/2014 09:41:02 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MASTER",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{843EE731-DEB4-46AD-A33E-9F3116738204}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================
Error: (04/08/2014 02:08:11 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/08/2014 01:27:58 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/08/2014 07:57:00 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/07/2014 01:36:41 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/07/2014 00:41:02 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*c:\program files (x86)\spybot - search & destroy\DelZip179.dllc:\program files (x86)\spybot - search & destroy\DelZip179.dll8

Error: (04/07/2014 11:42:27 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/07/2014 08:07:56 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/06/2014 07:17:58 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/06/2014 09:36:40 AM) (Source: Application Error)(User: )
Description: vc.exe6.0.1.5154ff2dfd4imfc0.dll0.9.0.04c74a476c000000500005d9e98801cf516aaf3ed27bC:\Program Files (x86)\4Free Video Converter\bin\version2\vc.exeC:\Program Files (x86)\4Free Video Converter\bin\version2\imfc0.dll30ab46eb-bd5e-11e3-a9c0-001c4afa1d88

Error: (04/06/2014 09:27:57 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 71%
Total physical RAM: 2047.3 MB
Available physical RAM: 577.55 MB
Total Pagefile: 4094.61 MB
Available Pagefile: 2041.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:59.53 GB) (Free:8.95 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 60 GB) (Disk ID: A124E856)

Partition: GPT Partition Type.

==================== End Of Log ============================

GMER:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-08 14:30:43
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 SanDisk_SDSSDP064G rev.1.0.0 59,63GB
Running: 5hyhw3i0.exe; Driver: C:\Users\familie\AppData\Local\Temp\pxdiyfod.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\system32\wininit.exe[504] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\services.exe[560] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\winlogon.exe[676] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\svchost.exe[744] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\atiesrxx.exe[880] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\System32\svchost.exe[956] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                00000000775ceecd 1 byte [62]
.text   C:\Windows\System32\svchost.exe[1004] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\svchost.exe[296] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\svchost.exe[448] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                00000000775ceecd 1 byte [62]
.text   C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe[344] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                      0000000075eba2ba 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1248] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\System32\spoolsv.exe[1516] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1552] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1580] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1680] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112              0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1704] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                  0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1736] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112  0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\avmwlanstick\WlanNetService.exe[1840] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                        0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe[1936] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\svchost.exe[2036] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1136] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe[1412] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                            0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[1932] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                 0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[1932] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                               0000000075a11465 2 bytes [A1, 75]
.text   C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[1932] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                              0000000075a114bb 2 bytes [A1, 75]
.text   ...                                                                                                                                                       * 2
.text   C:\Windows\system32\taskhost.exe[2748] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              00000000775ceecd 1 byte [62]
.text   C:\Windows\Explorer.EXE[2936] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                       00000000775ceecd 1 byte [62]
.text   C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint                                000000007798000c 1 byte [C3]
.text   C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin                           0000000077a0f8ea 5 bytes JMP 00000001779bd5c1
.text   C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1160] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                      0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\Skype\Phone\Skype.exe[2572] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                  0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[3136] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                               0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[3156] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                       0000000075eba2ba 1 byte [62]
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[3192] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                0000000075eba2ba 1 byte [62]
.text   C:\Program Files\AVAST Software\Avast\AvastUI.exe[3220] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                      0000000075e98769 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text   C:\Program Files\AVAST Software\Avast\AvastUI.exe[3220] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                             0000000075eba2ba 1 byte [62]
.text   C:\Windows\system32\SearchIndexer.exe[3780] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                         00000000775ceecd 1 byte [62]
.text   C:\Program Files\iPod\bin\iPodService.exe[1356] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                     00000000775ceecd 1 byte [62]
.text   C:\Program Files\Windows Media Player\wmpnetwk.exe[992] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                             00000000775ceecd 1 byte [62]
.text   C:\Windows\System32\svchost.exe[628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                00000000775ceecd 1 byte [62]
.text   C:\Users\familie\Desktop\befall\Defogger.exe[2692] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                  0000000075eba2ba 1 byte [62]
.text   C:\Users\familie\Desktop\befall\Defogger.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000075a11465 2 bytes [A1, 75]
.text   C:\Users\familie\Desktop\befall\Defogger.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               0000000075a114bb 2 bytes [A1, 75]
.text   ...                                                                                                                                                       * 2
.text   C:\Windows\system32\conhost.exe[3040] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Users\familie\Desktop\befall\FRST64.exe[2876] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                    00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\notepad.exe[1636] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\notepad.exe[2464] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Windows\system32\AUDIODG.EXE[4008] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                                               00000000775ceecd 1 byte [62]
.text   C:\Users\familie\Desktop\befall\5hyhw3i0.exe[3640] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                  0000000075eba2ba 1 byte [62]

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\svchost.exe [1136:4272]                                                                                                               000007fef96044e0
Thread  C:\Windows\System32\svchost.exe [628:2120]                                                                                                                000007fef7ce9688

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000c76485abb                                                                               
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000c76485abb@04180f388e02                                                                  0x28 0x93 0xD5 0x43 ...
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000c76485abb@bc767090c47c                                                                  0x29 0xB8 0x97 0x31 ...
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000c76485abb (not active ControlSet)                                                           
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000c76485abb@04180f388e02                                                                      0x28 0x93 0xD5 0x43 ...
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000c76485abb@bc767090c47c                                                                      0x29 0xB8 0x97 0x31 ...

---- EOF - GMER 2.1 ----

Malewarebytes:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.04.08.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16521
familie :: FAMILIE-PC [Administrator]

08.04.2014 14:39:37
mbam-log-2014-04-08 (14-39-37).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 222853
Laufzeit: 3 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Ist hier was ungewöhnliches zu finden?

schrauber · 08.04.2014, 17:08

hi,

Rechner ist sauber. Email Account Passwort ändern und gut ist

08.04.2014, 17:08	#2
schrauber /// the machine /// TB-Ausbilder	BSI Email Account gehackt. PC mit Trojaner befallen? hi, Rechner ist sauber. Email Account Passwort ändern und gut ist __________________ __________________

BSI Email Account gehackt. PC mit Trojaner befallen?

Log-Analyse und Auswertung: BSI Email Account gehackt. PC mit Trojaner befallen?

BSI Email Account gehackt. PC mit Trojaner befallen?

BSI Email Account gehackt. PC mit Trojaner befallen?

Ähnliche Themen: BSI Email Account gehackt. PC mit Trojaner befallen?