| |
| |||||||
Log-Analyse und Auswertung: Windows 8, Windows PC-Repair Virus und wohl noch andereWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
29.04.2014, 14:43
| #16 |
| /// TB-Ausbilder   |  Windows 8, Windows PC-Repair Virus und wohl noch andere Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen! |
|
30.04.2014, 13:16
| #17 |
 | Windows 8, Windows PC-Repair Virus und wohl noch andere Sorry, war im Streß und hatte früher keine Zeit.
__________________Der Rechner läuft prima und auch die Browser scheinen jetzt wieder okay. Hierfür schon mal ein riesiges Dankeschön. Bin total happy! Nachstehend die zwei Reports... FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-04-2014 01 Ran by Bodo (administrator) on AKOYAE6240T on 30-04-2014 14:04:54 Running from C:\Users\Bodo\Desktop Windows 8.1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Windows\System32\wlanext.exe () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe () C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe () C:\Program Files\CyberLink\Shared files\RichVideo64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe () C:\Program Files (x86)\PHotkey\PHotkey.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe () C:\Program Files (x86)\PHotkey\Atouch64.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe () C:\Program Files (x86)\PHotkey\POsd.exe () C:\Program Files (x86)\PHotkey\GPMTray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe (Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (MyHeritage) C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe (AimerSoft) C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe\glcnd.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Irfan Skiljan) C:\Program Files (x86)\IrfanView\i_view32.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FLAEDAC.tmp (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Adobe Systems, Incorporated) C:\Program Files (x86)\Adobe\Adobe Photoshop CS2\Photoshop.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Ghisler Software GmbH) C:\totalcmd\TOTALCMD64.EXE (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653208 2013-09-13] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor) HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated) HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink) HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.) HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [Family Tree Builder Update] => C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe [2532864 2013-12-09] (MyHeritage) HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [1691136 2012-05-31] (AimerSoft) HKLM-x32\...\Run: [] => [X] Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1 HKU\S-1-5-21-4152838901-865744110-646186296-1001\...\MountPoints2: {381baa29-47b3-11e3-8279-806e6f6e6963} - "E:\autorun.exe" Autorun\autorun.hta HKU\S-1-5-21-4152838901-865744110-646186296-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {381baa29-47b3-11e3-8279-806e6f6e6963} - "E:\autorun.exe" Autorun\autorun.hta HKU\S-1-5-21-4152838901-865744110-646186296-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {381baa29-47b3-11e3-8279-806e6f6e6963} - "E:\autorun.exe" Autorun\autorun.hta HKU\S-1-5-21-4152838901-865744110-646186296-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\MountPoints2: {381baa29-47b3-11e3-8279-806e6f6e6963} - "E:\autorun.exe" Autorun\autorun.hta HKU\S-1-5-21-4152838901-865744110-646186296-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-3\...\MountPoints2: {381baa29-47b3-11e3-8279-806e6f6e6963} - "E:\autorun.exe" Autorun\autorun.hta HKU\S-1-5-21-4152838901-865744110-646186296-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-4\...\MountPoints2: {381baa29-47b3-11e3-8279-806e6f6e6963} - "E:\autorun.exe" Autorun\autorun.hta HKU\S-1-5-21-4152838901-865744110-646186296-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-5\...\MountPoints2: {381baa29-47b3-11e3-8279-806e6f6e6963} - "E:\autorun.exe" Autorun\autorun.hta HKU\S-1-5-21-4152838901-865744110-646186296-500-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [Power2GoExpress8] => NA HKU\S-1-5-21-4152838901-865744110-646186296-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Power2GoExpress8] => NA Startup: C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\6l09uqgq.default FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll () FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF SearchPlugin: C:\Users\Bodo\AppData\Roaming\Mozilla\Firefox\Profiles\6l09uqgq.default\searchplugins\yahoo_ff.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [] Chrome: ======= CHR Extension: (Google Docs) - C:\Users\Bodo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-23] CHR Extension: (Google Drive) - C:\Users\Bodo\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-23] CHR Extension: (YouTube) - C:\Users\Bodo\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-23] CHR Extension: (Google-Suche) - C:\Users\Bodo\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-23] CHR Extension: (Google Wallet) - C:\Users\Bodo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-23] CHR Extension: (Google Mail) - C:\Users\Bodo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-23] ==================== Services (Whitelisted) ================= S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-01-09] (Adobe Systems) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-20] (Avira Operations GmbH & Co. KG) R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink) R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink) S2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [103936 2014-01-13] (Freemake) R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation) S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2014-01-22] (IObit) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-10-31] (Microsoft Corporation) R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] () S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG) S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider) R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation) R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink) S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation) S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation) S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation) S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-30] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation) R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation) S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation) S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation) R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider) S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2013-10-22] () S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation) R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation ) S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation) S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated) S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation) R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation) R3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-30 14:04 - 2014-04-30 14:05 - 00018458 _____ () C:\Users\Bodo\Desktop\FRST.txt 2014-04-30 11:53 - 2014-04-30 12:02 - 00000000 ____D () C:\Users\Bodo\HP 2014-04-29 17:11 - 2014-04-30 12:08 - 00000000 ____D () C:\Users\Bodo\Documents\OSUH 2014-04-25 06:07 - 2014-04-25 05:36 - 00024064 _____ () C:\WINDOWS\zoek-delete.exe 2014-04-25 05:39 - 2014-04-25 06:17 - 00016599 _____ () C:\zoek-results.log 2014-04-25 05:36 - 2014-04-25 06:04 - 00000000 ____D () C:\zoek_backup 2014-04-24 21:36 - 2014-04-24 21:36 - 00001254 _____ () C:\Users\Bodo\Desktop\JRT.txt 2014-04-24 21:22 - 2014-04-24 21:22 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-04-24 21:18 - 2014-04-24 21:18 - 01016261 _____ (Thisisu) C:\Users\Bodo\Desktop\JRT.exe 2014-04-24 21:17 - 2014-04-24 21:18 - 01016261 _____ (Thisisu) C:\Users\Bodo\Downloads\JRT.exe 2014-04-24 20:09 - 2014-04-27 13:37 - 00000000 __RDO () C:\Users\Bodo\SkyDrive 2014-04-24 10:19 - 2014-04-24 14:47 - 00000000 ____D () C:\Users\Bodo\Documents\GfK 2014-04-23 16:28 - 2014-04-30 14:04 - 00000000 ____D () C:\Users\Bodo\Desktop\FRST-OlderVersion 2014-04-23 16:21 - 2014-04-23 16:21 - 00017590 _____ () C:\Users\Bodo\Desktop\mbam.txt 2014-04-23 15:41 - 2014-04-23 15:41 - 00368145 _____ () C:\Users\Bodo\avirameldung1.odt 2014-04-23 15:35 - 2014-04-23 13:50 - 00023266 _____ () C:\Users\Bodo\Documents\untitled_0_2.odt 2014-04-23 14:57 - 2014-04-30 13:16 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-04-23 14:55 - 2014-04-23 14:55 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-23 14:55 - 2014-04-23 14:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-04-23 14:55 - 2014-04-23 14:55 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-23 14:55 - 2014-04-23 14:55 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-04-23 14:55 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-04-23 14:55 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-04-23 14:55 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-04-23 14:08 - 2014-04-23 14:30 - 00000000 ____D () C:\AdwCleaner 2014-04-23 13:53 - 2014-04-23 13:53 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Bodo\Desktop\mbam-setup-2.0.1.1004.exe 2014-04-23 13:42 - 2014-04-23 13:53 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Bodo\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-23 13:38 - 2014-04-23 13:37 - 01345299 _____ () C:\Users\Bodo\Desktop\adwcleaner.exe 2014-04-23 13:37 - 2014-04-23 13:37 - 01345299 _____ () C:\Users\Bodo\Downloads\adwcleaner.exe 2014-04-22 13:46 - 2014-04-22 13:46 - 08615086 _____ () C:\Users\Bodo\Documents\The Rainbows - My Baby Baby Balla Balla (1966)_HQ.mp4 2014-04-21 15:45 - 2014-04-30 14:04 - 00000000 ____D () C:\FRST 2014-04-21 15:42 - 2014-04-30 14:04 - 02060800 _____ (Farbar) C:\Users\Bodo\Desktop\FRST64.exe 2014-04-21 09:48 - 2014-04-21 09:48 - 00797552 _____ (Reimage®) C:\Users\Bodo\Downloads\ReimageRepair.exe 2014-04-15 01:28 - 2014-04-15 01:28 - 02279222 _____ () C:\Users\Bodo\Documents\HappyBD2.psd 2014-04-11 16:40 - 2014-04-27 00:00 - 00005120 _____ () C:\Users\Bodo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-04-11 11:38 - 2014-04-11 11:38 - 03766207 _____ () C:\Users\Bodo\Documents\4GMenue.psd 2014-04-11 11:37 - 2014-04-11 11:37 - 04303370 _____ () C:\Users\Bodo\Documents\3GMenue.psd 2014-04-09 09:53 - 2014-03-10 12:35 - 02008408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2014-04-09 09:53 - 2014-03-10 12:35 - 00377176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys 2014-04-09 09:53 - 2014-03-06 11:19 - 01287576 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2014-04-09 09:53 - 2014-03-06 08:10 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2014-04-09 09:52 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-04-09 09:52 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-04-09 09:52 - 2014-03-06 11:02 - 01109424 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2014-04-09 09:52 - 2014-03-06 08:17 - 00835584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2014-04-09 09:48 - 2014-04-09 09:48 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb 2014-04-09 09:48 - 2014-04-09 09:48 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb 2014-04-06 18:46 - 2014-04-04 17:02 - 00009866 _____ () C:\Users\Bodo\Documents\untitled_0_1.odt 2014-04-06 15:48 - 2014-04-06 15:48 - 00001906 _____ () C:\Users\Bodo\Desktop\IrfanView Thumbnails.lnk 2014-04-06 15:48 - 2014-04-06 15:48 - 00001018 _____ () C:\Users\Bodo\Desktop\IrfanView.lnk 2014-04-06 15:48 - 2014-04-06 15:48 - 00000000 ____D () C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView 2014-04-06 15:48 - 2014-04-06 15:48 - 00000000 ____D () C:\Users\Bodo\AppData\Roaming\IrfanView 2014-04-06 15:48 - 2014-04-06 15:48 - 00000000 ____D () C:\Program Files (x86)\IrfanView 2014-04-06 15:45 - 2014-04-06 15:46 - 02179728 _____ (Irfan Skiljan) C:\Users\Bodo\Downloads\iview437g_setup.exe 2014-04-03 19:53 - 2014-04-04 15:13 - 00026653 _____ () C:\Users\Bodo\Documents\AGGreifswald1404a.odt 2014-04-03 09:11 - 2014-04-03 10:01 - 00027376 _____ () C:\Users\Bodo\Documents\ojkhamm1404.odt 2014-04-02 12:04 - 2014-04-26 23:39 - 00000000 ____D () C:\Users\Bodo\Documents\AfD 2014-04-01 12:23 - 2014-04-01 12:26 - 00000000 ____D () C:\Users\Bodo\Documents\Fax 2014-04-01 10:19 - 2014-04-01 10:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-04-01 09:32 - 2014-04-01 10:35 - 00001110 _____ () C:\WINDOWS\setup.log 2014-04-01 09:32 - 1998-11-17 12:44 - 00328704 _____ (InstallShield Software Corporation ) C:\WINDOWS\IsUn0407.exe 2014-04-01 09:29 - 2014-04-01 09:29 - 17821354 _____ (AVM Berlin ) C:\Users\Bodo\Downloads\FRITZ_fax_3.07.04.exe 2014-04-01 05:31 - 2014-04-01 05:31 - 01591300 _____ () C:\Users\Bodo\Downloads\2.mpg 2014-03-31 11:43 - 2014-04-02 11:53 - 00000000 ____D () C:\Users\Bodo\Documents\Jobcenter ==================== One Month Modified Files and Folders ======= 2014-04-30 14:05 - 2014-04-30 14:04 - 00018458 _____ () C:\Users\Bodo\Desktop\FRST.txt 2014-04-30 14:04 - 2014-04-23 16:28 - 00000000 ____D () C:\Users\Bodo\Desktop\FRST-OlderVersion 2014-04-30 14:04 - 2014-04-21 15:45 - 00000000 ____D () C:\FRST 2014-04-30 14:04 - 2014-04-21 15:42 - 02060800 _____ (Farbar) C:\Users\Bodo\Desktop\FRST64.exe 2014-04-30 14:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-04-30 13:48 - 2013-12-19 00:54 - 01063766 _____ () C:\WINDOWS\WindowsUpdate.log 2014-04-30 13:38 - 2014-02-15 17:07 - 00000346 _____ () C:\WINDOWS\Tasks\HP Photo Creations Communicator.job 2014-04-30 13:38 - 2014-01-25 12:37 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-04-30 13:28 - 2013-12-23 17:07 - 00001130 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-30 13:16 - 2014-04-23 14:57 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-04-30 12:19 - 2013-12-19 01:02 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4152838901-865744110-646186296-1001 2014-04-30 12:08 - 2014-04-29 17:11 - 00000000 ____D () C:\Users\Bodo\Documents\OSUH 2014-04-30 12:02 - 2014-04-30 11:53 - 00000000 ____D () C:\Users\Bodo\HP 2014-04-30 11:53 - 2013-12-18 23:48 - 00000000 ____D () C:\Users\Bodo 2014-04-30 09:29 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-04-30 00:28 - 2013-12-23 17:09 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-04-30 00:28 - 2013-12-23 17:07 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-29 22:14 - 2014-03-18 23:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-04-28 19:38 - 2014-01-25 12:37 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2014-04-27 13:37 - 2014-04-24 20:09 - 00000000 __RDO () C:\Users\Bodo\SkyDrive 2014-04-27 00:00 - 2014-04-11 16:40 - 00005120 _____ () C:\Users\Bodo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-04-26 23:47 - 2014-01-05 16:25 - 00000000 ____D () C:\Users\Bodo\AppData\Roaming\vlc 2014-04-26 23:39 - 2014-04-02 12:04 - 00000000 ____D () C:\Users\Bodo\Documents\AfD 2014-04-26 22:21 - 2013-10-07 07:32 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat 2014-04-26 22:21 - 2013-10-07 07:32 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat 2014-04-26 22:21 - 2013-10-07 07:11 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-04-25 06:17 - 2014-04-25 05:39 - 00016599 _____ () C:\zoek-results.log 2014-04-25 06:13 - 2013-10-07 07:06 - 00329222 _____ () C:\WINDOWS\PFRO.log 2014-04-25 06:13 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-04-25 06:04 - 2014-04-25 05:36 - 00000000 ____D () C:\zoek_backup 2014-04-25 05:36 - 2014-04-25 06:07 - 00024064 _____ () C:\WINDOWS\zoek-delete.exe 2014-04-24 21:36 - 2014-04-24 21:36 - 00001254 _____ () C:\Users\Bodo\Desktop\JRT.txt 2014-04-24 21:22 - 2014-04-24 21:22 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-04-24 21:18 - 2014-04-24 21:18 - 01016261 _____ (Thisisu) C:\Users\Bodo\Desktop\JRT.exe 2014-04-24 21:18 - 2014-04-24 21:17 - 01016261 _____ (Thisisu) C:\Users\Bodo\Downloads\JRT.exe 2014-04-24 20:09 - 2013-12-15 13:04 - 00000000 __RDO () C:\Users\Bodo\SkyDrive.old 2014-04-24 14:47 - 2014-04-24 10:19 - 00000000 ____D () C:\Users\Bodo\Documents\GfK 2014-04-23 16:21 - 2014-04-23 16:21 - 00017590 _____ () C:\Users\Bodo\Desktop\mbam.txt 2014-04-23 15:50 - 2013-12-24 00:55 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-04-23 15:47 - 2013-10-07 08:12 - 90655440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2014-04-23 15:41 - 2014-04-23 15:41 - 00368145 _____ () C:\Users\Bodo\avirameldung1.odt 2014-04-23 15:40 - 2014-03-10 17:58 - 00000000 ____D () C:\Users\Bodo\Art 2014-04-23 14:55 - 2014-04-23 14:55 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-23 14:55 - 2014-04-23 14:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-04-23 14:55 - 2014-04-23 14:55 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-23 14:55 - 2014-04-23 14:55 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-04-23 14:30 - 2014-04-23 14:08 - 00000000 ____D () C:\AdwCleaner 2014-04-23 14:29 - 2013-12-19 00:53 - 00001009 _____ () C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-04-23 14:29 - 2013-12-15 13:01 - 00001224 _____ () C:\Users\Bodo\Desktop\ALDI Süd Blumen Service.lnk 2014-04-23 14:29 - 2013-12-15 13:01 - 00001200 _____ () C:\Users\Bodo\Desktop\ALDI Süd Reisen.lnk 2014-04-23 14:29 - 2013-12-15 13:01 - 00001156 _____ () C:\Users\Bodo\Desktop\ALDI Talk.lnk 2014-04-23 14:29 - 2013-12-15 13:01 - 00001136 _____ () C:\Users\Bodo\Desktop\ALDI Süd Startseite.lnk 2014-04-23 14:29 - 2013-10-22 12:55 - 00001120 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk 2014-04-23 14:29 - 2013-10-22 12:55 - 00001114 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Welcome.lnk 2014-04-23 14:00 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2014-04-23 13:53 - 2014-04-23 13:53 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Bodo\Desktop\mbam-setup-2.0.1.1004.exe 2014-04-23 13:53 - 2014-04-23 13:42 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Bodo\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-23 13:50 - 2014-04-23 15:35 - 00023266 _____ () C:\Users\Bodo\Documents\untitled_0_2.odt 2014-04-23 13:37 - 2014-04-23 13:38 - 01345299 _____ () C:\Users\Bodo\Desktop\adwcleaner.exe 2014-04-23 13:37 - 2014-04-23 13:37 - 01345299 _____ () C:\Users\Bodo\Downloads\adwcleaner.exe 2014-04-23 02:24 - 2013-12-26 06:02 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-04-23 02:24 - 2013-12-26 06:02 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-04-22 13:46 - 2014-04-22 13:46 - 08615086 _____ () C:\Users\Bodo\Documents\The Rainbows - My Baby Baby Balla Balla (1966)_HQ.mp4 2014-04-21 14:01 - 2013-08-22 16:44 - 00563328 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-04-21 13:52 - 2014-02-21 12:35 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-04-21 13:51 - 2013-10-07 10:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2014-04-21 13:51 - 2013-08-22 22:59 - 00000000 ____D () C:\WINDOWS\ShellNew 2014-04-21 13:50 - 2014-01-09 19:47 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8 2014-04-21 13:50 - 2013-10-07 07:25 - 00000000 ____D () C:\Program Files (x86)\MSBuild 2014-04-21 13:47 - 2013-08-22 15:25 - 00000076 _____ () C:\WINDOWS\win.ini 2014-04-21 13:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2014-04-21 09:48 - 2014-04-21 09:48 - 00797552 _____ (Reimage®) C:\Users\Bodo\Downloads\ReimageRepair.exe 2014-04-21 04:43 - 2013-12-15 13:03 - 00000000 ____D () C:\Users\Bodo\Documents\Youcam 2014-04-20 14:00 - 2013-12-19 20:34 - 00001309 _____ () C:\Users\Public\Desktop\YTD Video Downloader.lnk 2014-04-15 01:28 - 2014-04-15 01:28 - 02279222 _____ () C:\Users\Bodo\Documents\HappyBD2.psd 2014-04-14 04:47 - 2013-12-19 13:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-04-13 22:41 - 2013-10-08 13:17 - 00000000 ____D () C:\ProgramData\Realtek 2014-04-11 11:38 - 2014-04-11 11:38 - 03766207 _____ () C:\Users\Bodo\Documents\4GMenue.psd 2014-04-11 11:37 - 2014-04-11 11:37 - 04303370 _____ () C:\Users\Bodo\Documents\3GMenue.psd 2014-04-09 09:48 - 2014-04-09 09:48 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb 2014-04-09 09:48 - 2014-04-09 09:48 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb 2014-04-06 15:48 - 2014-04-06 15:48 - 00001906 _____ () C:\Users\Bodo\Desktop\IrfanView Thumbnails.lnk 2014-04-06 15:48 - 2014-04-06 15:48 - 00001018 _____ () C:\Users\Bodo\Desktop\IrfanView.lnk 2014-04-06 15:48 - 2014-04-06 15:48 - 00000000 ____D () C:\Users\Bodo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView 2014-04-06 15:48 - 2014-04-06 15:48 - 00000000 ____D () C:\Users\Bodo\AppData\Roaming\IrfanView 2014-04-06 15:48 - 2014-04-06 15:48 - 00000000 ____D () C:\Program Files (x86)\IrfanView 2014-04-06 15:46 - 2014-04-06 15:45 - 02179728 _____ (Irfan Skiljan) C:\Users\Bodo\Downloads\iview437g_setup.exe 2014-04-04 17:02 - 2014-04-06 18:46 - 00009866 _____ () C:\Users\Bodo\Documents\untitled_0_1.odt 2014-04-04 15:13 - 2014-04-03 19:53 - 00026653 _____ () C:\Users\Bodo\Documents\AGGreifswald1404a.odt 2014-04-03 10:01 - 2014-04-03 09:11 - 00027376 _____ () C:\Users\Bodo\Documents\ojkhamm1404.odt 2014-04-03 09:51 - 2014-04-23 14:55 - 00088280 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-23 14:55 - 00063192 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-23 14:55 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-04-02 11:53 - 2014-03-31 11:43 - 00000000 ____D () C:\Users\Bodo\Documents\Jobcenter 2014-04-01 12:26 - 2014-04-01 12:23 - 00000000 ____D () C:\Users\Bodo\Documents\Fax 2014-04-01 10:35 - 2014-04-01 09:32 - 00001110 _____ () C:\WINDOWS\setup.log 2014-04-01 10:19 - 2014-04-01 10:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-04-01 09:29 - 2014-04-01 09:29 - 17821354 _____ (AVM Berlin ) C:\Users\Bodo\Downloads\FRITZ_fax_3.07.04.exe 2014-04-01 05:31 - 2014-04-01 05:31 - 01591300 _____ () C:\Users\Bodo\Downloads\2.mpg 2014-03-31 03:16 - 2014-04-09 09:52 - 23134208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-03-31 01:57 - 2014-04-09 09:52 - 17073152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll Some content of TEMP: ==================== C:\Users\Bodo\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-26 02:05 ==================== End Of Log ============================ Und hier der zweite... Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-04-2014 01
Ran by Bodo at 2014-04-30 14:06:47
Running from C:\Users\Bodo\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
337 GAMES (HKCU\...\337Games) (Version: 1.1.1.0 - )
AbiWord 2.9.4 (HKLM-x32\...\AbiWord2) (Version: 2.9.4 - AbiSource Developers)
Adobe Bridge 1.0 (x32 Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (x32 Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop CS2 (x32 Version: 9.0 - Adobe Systems, Inc.) Hidden
Adobe Stock Photos 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Ahnenblatt 2.74 (HKLM-x32\...\Ahnenblatt_is1) (Version: 2.74.0.1 - Dirk Boettcher)
Aimersoft DVD Ripper(Build 3.0.0.2) (HKLM-x32\...\Aimersoft DVD Ripper_is1) (Version: - Aimersoft Software)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink Home Cinema 10 (x32 Version: 10.3025 - CyberLink Corp.) Hidden
CyberLink LabelPrint 2.5 (x32 Version: 2.5.0.5415 - CyberLink Corp.) Hidden
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3807_46074 - CyberLink Corp.) Hidden
CyberLink PhotoDirector 3 (x32 Version: 3.0.1.4017 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (x32 Version: 8.0.0.3202 - CyberLink Corp.) Hidden
CyberLink PowerDirector 11 (Version: 11.0.0.3215 - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (x32 Version: 10.0.5426.02 - CyberLink Corp.) Hidden
CyberLink PowerDVD Copy 1.5 (x32 Version: 1.5.0.3725a - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
CyberLink YouCam 5 (x32 Version: 5.0.3318.0 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Easy CD-DA Extractor 2010 (HKLM-x32\...\Easy CD-DA Extractor 2010) (Version: 2010 - Poikosoft)
FormatFactory 3.1.1 (HKLM-x32\...\FormatFactory) (Version: 3.1.1 - Free Time)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Freemake Video Converter Version 4.1.2 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.2 - Ellora Assets Corporation)
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
HP Deskjet 1050 J410 series - Grundlegende Software für das Gerät (HKLM\...\{C3F12DD0-54B1-4B2B-A82B-FA43502BC550}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Deskjet 1050 J410 series Hilfe (HKLM-x32\...\{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}) (Version: 140.0.66.66 - Hewlett Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.12412 - HP)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3309 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Intel(R) Trusted Execution Engine (Version: 1.1.1.1 - Intel Corporation) Hidden
Intel(R) Trusted Execution Engine Driver (Version: 1.0.0.1050 - Intel Corporation) Hidden
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.1.7.2405 - IObit)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
LibreOffice 4.1 Help Pack (German) (HKLM-x32\...\{43295475-62CA-4F25-B46C-43C59258780E}) (Version: 4.1.4.2 - The Document Foundation)
LibreOffice 4.1.4.2 (HKLM-x32\...\{94E11973-ED58-47A0-907C-ABF6D95C5DD8}) (Version: 4.1.4.2 - The Document Foundation)
Lollipop (HKCU\...\lollipop_01031042) (Version: - Lollipop Network, S.L.) <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Expression Web 4 (HKLM-x32\...\Web_4.0.1460.0) (Version: 4.0.1460.0 - Microsoft Corporation)
Microsoft Expression Web 4 (x32 Version: 4.0.1460.0 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
Mozilla Thunderbird 24.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MyHeritage Family Tree Builder (HKLM-x32\...\Family Tree Builder) (Version: 7.0.0.7129 - MyHeritage.com)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0092 - Pegatron Corporation)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.093013 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7040 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0227 - REALTEK Semiconductor Corp.)
Studie zur Verbesserung von HP Deskjet 1050 J410 series Produkten (HKLM\...\{B099E941-4789-46A1-9B14-01CFD04E03B3}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
XMedia Recode Version 3.1.7.8 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.7.8 - XMedia Recode)
Yahoo Community Smartbar (HKLM-x32\...\{D7403121-68C2-48BC-874D-048015E60DF0}) (Version: 10.179.66.13636 - Linkury Inc.) <==== ATTENTION
Yahoo Community Smartbar Engine (HKCU\...\{993cbed8-bf92-4638-bb47-6cb1272c92ff}) (Version: 10.179.66.13636 - Linkury Inc.) <==== ATTENTION
YTD Toolbar v9.0 (HKLM-x32\...\{9D47532D-59B3-4E15-8069-2E3FC4DA3E92}) (Version: 9.0 - Spigot, Inc.)
YTD Video Downloader 4.8 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8 - GreenTree Applications SRL)
==================== Restore Points =========================
25-04-2014 17:48:54 Geplanter Prüfpunkt
29-04-2014 10:16:49 Windows Update
==================== Hosts content: ==========================
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {038E750F-4B89-4ADF-B5DC-AB57853CA00A} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {04A27B59-655B-4872-ACDF-6B22CA9A6D78} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2014-02-15] ()
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {2EE106B8-5CCF-4253-A23C-26866F6BD9C1} - \Plus-HD-1.3-updater No Task File <==== ATTENTION
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {4445933D-9960-456A-97EC-D67E119103A6} - \Plus-HD-1.3-enabler No Task File <==== ATTENTION
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {7421C5EB-253C-434A-A0D7-45EDC9F80DAF} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-04-23] (Microsoft Corporation)
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {790BB5FC-CE15-41F3-BA92-74C1C4C95EC9} - System32\Tasks\HPCustParticipation HP Deskjet 1050 J410 series => C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPCustPartic.exe [2012-10-02] (Hewlett-Packard Co.)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {8CEBADF6-73BA-4635-95B1-5630C760570B} - \Plus-HD-1.3-codedownloader No Task File <==== ATTENTION
Task: {8E866B41-CF47-4DD2-86BE-3BA0E6F4DC25} - System32\Tasks\Microsoft\Office\Office First Run Task => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-10-31] (Microsoft Corporation)
Task: {93DD8BD0-F48E-4FE0-98D3-482CB8AED3E4} - \Plus-HD-1.3-firefoxinstaller No Task File <==== ATTENTION
Task: {9514645B-9F2A-4777-BE65-6EE5E0E17226} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-23] (Google Inc.)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {AA98B172-10EC-4467-AF6B-52CFF605BC9A} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-01-27] (Microsoft Corporation)
Task: {BEC9C1C3-AD4E-4354-8F98-A6469B37DE8E} - \Plus-HD-1.3-chromeinstaller No Task File <==== ATTENTION
Task: {BF2088D2-306F-4D9C-9899-7188D50E06E1} - \Re-markit Update No Task File <==== ATTENTION
Task: {CD423634-93DB-4DA3-AE6E-52D4FEC97836} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-23] (Google Inc.)
Task: {CDBC83C8-5E0C-4B1F-B67A-FAC9805B3B57} - System32\Tasks\Uninstaller_SkipUac_Administrator => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2014-01-22] (IObit)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DF8990FA-5798-455D-BA2D-60CB8985A4F1} - \Re-markit_wd No Task File <==== ATTENTION
Task: {E203C98C-6294-4879-809F-2FF5AAB87394} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-14] (Synaptics Incorporated)
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {FF6B227B-3D3A-4BEB-A425-B5D3F8EDB02F} - System32\Tasks\Dolby Selector => C:\Program Files\Dolby Digital Plus\ddp.exe [2013-08-08] (Dolby Laboratories Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
Task: C:\WINDOWS\Tasks\Uninstaller_SkipUac_Administrator.job => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
==================== Loaded Modules (whitelisted) =============
2013-10-08 13:22 - 2013-06-27 10:56 - 00160768 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2013-10-08 13:17 - 2013-09-26 21:08 - 00061440 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2013-12-19 17:00 - 2013-08-23 15:45 - 00386216 _____ () C:\Program Files\Microsoft Office 15\ClientX64\c2rui.dll
2013-12-19 17:00 - 2013-10-31 10:08 - 00520872 _____ () C:\Program Files\Microsoft Office 15\ClientX64\c2r64.dll
2013-12-19 17:00 - 2013-10-31 10:07 - 00618152 _____ () C:\Program Files\Microsoft Office 15\ClientX64\StreamServer.dll
2013-10-07 09:29 - 2013-03-06 15:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2013-10-08 13:22 - 2013-09-11 12:41 - 02216960 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2013-10-08 13:22 - 2010-12-17 15:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2013-10-08 13:22 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-10-08 13:22 - 2013-07-18 16:41 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2013-08-08 17:53 - 2013-08-08 17:53 - 00050904 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2010-03-23 15:09 - 2010-03-23 15:33 - 00126208 _____ () C:\Program Files\Easy CD-DA Extractor 2010\ezcddax64.dll
2013-12-19 13:32 - 2013-12-09 12:37 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-10-08 13:22 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-10-08 13:22 - 2009-12-18 16:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2013-10-07 09:28 - 2013-08-05 09:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 16:48 - 2013-08-05 16:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-03-18 23:04 - 2014-03-18 23:04 - 03018864 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-03-18 23:04 - 2014-03-18 23:04 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-03-18 23:04 - 2014-03-18 23:04 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-04-10 20:39 - 2014-04-02 03:57 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\chrome_elf.dll
2014-04-10 20:39 - 2014-04-02 03:57 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\libglesv2.dll
2014-04-10 20:39 - 2014-04-02 03:57 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\libegl.dll
2014-04-10 20:39 - 2014-04-02 03:57 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll
2014-04-10 20:39 - 2014-04-02 03:58 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll
2014-04-10 20:39 - 2014-04-02 03:57 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ffmpegsumo.dll
2014-04-06 15:48 - 2014-04-06 15:48 - 00054784 _____ () C:\Program Files (x86)\IrfanView\Languages\DEUTSCH.DLL
2005-04-06 08:52 - 2005-04-06 08:52 - 01327104 _____ () C:\Program Files (x86)\Adobe\Adobe Photoshop CS2\Photoshop.dll
2014-04-10 20:39 - 2014-04-02 03:58 - 13691720 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:DE406C3E
AlternateDataStreams: C:\Users\Bodo\SkyDrive:ms-properties
AlternateDataStreams: C:\Users\Bodo\SkyDrive.old:ms-properties
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/30/2014 02:08:33 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:31 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:28 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:26 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:22 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:20 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:18 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:16 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/30/2014 02:08:14 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (04/28/2014 02:30:09 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.
Error: (04/27/2014 01:35:52 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (04/27/2014 01:35:25 PM) (Source: DCOM) (User: AKOYAE6240T)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (04/27/2014 01:35:25 PM) (Source: DCOM) (User: AKOYAE6240T)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (04/27/2014 01:35:25 PM) (Source: DCOM) (User: AKOYAE6240T)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (04/27/2014 01:35:25 PM) (Source: DCOM) (User: AKOYAE6240T)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (04/27/2014 01:35:25 PM) (Source: DCOM) (User: AKOYAE6240T)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (04/27/2014 01:35:25 PM) (Source: DCOM) (User: AKOYAE6240T)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (04/27/2014 01:35:25 PM) (Source: DCOM) (User: AKOYAE6240T)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (04/27/2014 01:35:24 PM) (Source: DCOM) (User: AKOYAE6240T)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Microsoft Office Sessions:
=========================
Error: (04/30/2014 02:08:35 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:33 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:31 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:28 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:26 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:24 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:22 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:20 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:18 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
Error: (04/30/2014 02:08:16 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
==================== Memory info ===========================
Percentage of memory in use: 70%
Total physical RAM: 3976.19 MB
Available physical RAM: 1175.09 MB
Total Pagefile: 12680.19 MB
Available Pagefile: 4675.75 MB
Total Virtual: 131072 MB
Available Virtual: 131071.85 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:404.05 GB) (Free:324.14 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:45.69 GB) NTFS
Drive e: (sbon88p5) (CDROM) (Total:4 GB) (Free:0 GB) CDFS
Drive f: (DRIVE-N-GO) (Fixed) (Total:931.28 GB) (Free:510.5 GB) FAT32
Drive g: (CANON_DC) (Removable) (Total:1.92 GB) (Free:1.68 GB) FAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 932 GB) (Disk ID: E0375D22)
Partition 1: (Active) - (Size=932 GB) - (Type=0C)
========================================================
Disk: 2 (Size: 2 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
01.05.2014, 13:13
| #18 |
| /// TB-Ausbilder | Windows 8, Windows PC-Repair Virus und wohl noch andere Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern.
__________________Im Anschluss daran räumen wir auf und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
HKLM-x32\...\Run: [] => [X]
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Task: {2EE106B8-5CCF-4253-A23C-26866F6BD9C1} - \Plus-HD-1.3-updater No Task File <==== ATTENTION
Task: {4445933D-9960-456A-97EC-D67E119103A6} - \Plus-HD-1.3-enabler No Task File <==== ATTENTION
Task: {8CEBADF6-73BA-4635-95B1-5630C760570B} - \Plus-HD-1.3-codedownloader No Task File <==== ATTENTION
Task: {93DD8BD0-F48E-4FE0-98D3-482CB8AED3E4} - \Plus-HD-1.3-firefoxinstaller No Task File <==== ATTENTION
Task: {BEC9C1C3-AD4E-4354-8F98-A6469B37DE8E} - \Plus-HD-1.3-chromeinstaller No Task File <==== ATTENTION
Task: {BF2088D2-306F-4D9C-9899-7188D50E06E1} - \Re-markit Update No Task File <==== ATTENTION
Task: {DF8990FA-5798-455D-BA2D-60CB8985A4F1} - \Re-markit_wd No Task File <==== ATTENTION
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 ESET Online Scanner
Schritt 3 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
02.05.2014, 13:06
| #19 |
| | Windows 8, Windows PC-Repair Virus und wohl noch andere Nachstehend die Fixlog.txt zu Schritt 1, Schritte 2 und 3 folgen später Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-05-2014
Ran by Bodo at 2014-05-02 09:44:24 Run:1
Running from C:\Users\Bodo\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
HKLM-x32\...\Run: [] => [X]
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Task: {2EE106B8-5CCF-4253-A23C-26866F6BD9C1} - \Plus-HD-1.3-updater No Task File <==== ATTENTION
Task: {4445933D-9960-456A-97EC-D67E119103A6} - \Plus-HD-1.3-enabler No Task File <==== ATTENTION
Task: {8CEBADF6-73BA-4635-95B1-5630C760570B} - \Plus-HD-1.3-codedownloader No Task File <==== ATTENTION
Task: {93DD8BD0-F48E-4FE0-98D3-482CB8AED3E4} - \Plus-HD-1.3-firefoxinstaller No Task File <==== ATTENTION
Task: {BEC9C1C3-AD4E-4354-8F98-A6469B37DE8E} - \Plus-HD-1.3-chromeinstaller No Task File <==== ATTENTION
Task: {BF2088D2-306F-4D9C-9899-7188D50E06E1} - \Re-markit Update No Task File <==== ATTENTION
Task: {DF8990FA-5798-455D-BA2D-60CB8985A4F1} - \Re-markit_wd No Task File <==== ATTENTION
end
*****************
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
C:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully.
C:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2EE106B8-5CCF-4253-A23C-26866F6BD9C1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2EE106B8-5CCF-4253-A23C-26866F6BD9C1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-1.3-updater => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4445933D-9960-456A-97EC-D67E119103A6} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4445933D-9960-456A-97EC-D67E119103A6} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-1.3-enabler => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8CEBADF6-73BA-4635-95B1-5630C760570B} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8CEBADF6-73BA-4635-95B1-5630C760570B} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-1.3-codedownloader => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{93DD8BD0-F48E-4FE0-98D3-482CB8AED3E4} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{93DD8BD0-F48E-4FE0-98D3-482CB8AED3E4} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-1.3-firefoxinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BEC9C1C3-AD4E-4354-8F98-A6469B37DE8E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BEC9C1C3-AD4E-4354-8F98-A6469B37DE8E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-1.3-chromeinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BF2088D2-306F-4D9C-9899-7188D50E06E1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BF2088D2-306F-4D9C-9899-7188D50E06E1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Re-markit Update => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DF8990FA-5798-455D-BA2D-60CB8985A4F1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DF8990FA-5798-455D-BA2D-60CB8985A4F1} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Re-markit_wd => Key deleted successfully.
The system needed a reboot.
==== End of Fixlog ====
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1f1aa77ba47a4d4a866c8441521ab35c
# engine=18105
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-02 11:06:56
# local_time=2014-05-02 01:06:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode=1799 16775165 100 94 11729 12446978 4471 0
# compatibility_mode=5893 16776574 100 94 4249817 16345113 0 0
# scanned=294426
# found=6
# cleaned=0
# scan_time=10375
sh=1985BA727A081634DF8C8BF337418A20EAD11DE9 ft=1 fh=1df23621d4bad3c2 vn="Variante von Win32/AdWare.AddLyrics.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit\Re-markit_wd.exe.vir"
sh=1C940244383FC28EAF6ECC8A0B8635A9A0A22EBC ft=1 fh=c71c00112acf662a vn="Variante von Win32/AdWare.AddLyrics.AF Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit\ReMarkit_up.exe.vir"
sh=7243AF2124B24A4C7AE382020320B9AC4E342184 ft=1 fh=736eab52356df221 vn="Win32/AdWare.AddLyrics.AE Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit\Uninstall.exe.vir"
sh=86FD2D88F3C4675471D14644D2A2D8A0B08BA2F4 ft=1 fh=5d2300031434a965 vn="NSIS/StartPage.CC Trojaner" ac=I fn="C:\Users\Bodo\Downloads\vlc-2.1.2-win64.exe"
sh=99EC1C2A38AE98BCBF42E778E551C2C518C08DFD ft=1 fh=c71c0011d154cc06 vn="Variante von MSIL/Adware.PullUpdate.A Anwendung" ac=I fn="C:\Windows.old\Users\Bodo\AppData\Local\Temp\nsg15E7.tmp\Helper.dll"
sh=B6D3C19766BEAF1CB7A87D94DC48655C4CA22936 ft=1 fh=89e28e52b82c6968 vn="Variante von MSIL/Adware.PullUpdate.A Anwendung" ac=I fn="C:\Windows.old\Users\Bodo\AppData\Local\Temp\nsnEC2E.tmp\Helper.dll"
|
|
02.05.2014, 14:11
| #20 | |
| /// TB-Ausbilder | Windows 8, Windows PC-Repair Virus und wohl noch andereZitat:
SecurityCheck bitte ausführen, dann haben wirs bald geschafft.  |
|
02.05.2014, 22:06
| #21 |
| | Windows 8, Windows PC-Repair Virus und wohl noch andere Und hier noch die chekup.txt... Code:
ATTFilter Results of screen317's Security Check version 0.99.82 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Windows Defender Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Adobe Flash Player 13.0.0.206 Mozilla Firefox (28.0) Mozilla Thunderbird (24.5.0) Google Chrome 34.0.1847.116 Google Chrome 34.0.1847.131 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` |
|
03.05.2014, 10:24
| #22 |
| /// TB-Ausbilder | Windows 8, Windows PC-Repair Virus und wohl noch andere Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
C:\Users\Bodo\Downloads\vlc-2.1.2-win64.exe
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1
Prüfe bitte auch (regelmässig) ob folgende Links fehlende Updates bei deinen Plugins zeigen: Schritt 2 Die Reihenfolge ist hier entscheidend.
Schritt 3 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
|
04.05.2014, 09:45
| #23 |
| | Windows 8, Windows PC-Repair Virus und wohl noch andere Hier die Fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-05-2014
Ran by Bodo at 2014-05-04 09:06:05 Run:2
Running from C:\Users\Bodo\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
C:\Users\Bodo\Downloads\vlc-2.1.2-win64.exe
end
*****************
C:\Users\Bodo\Downloads\vlc-2.1.2-win64.exe => Moved successfully.
==== End of Fixlog ====
Oder ist das alles nur Bauernfängerei von WinZip? |
|
04.05.2014, 11:18
| #24 | |
| /// TB-Ausbilder | Windows 8, Windows PC-Repair Virus und wohl noch andereZitat:
 Deinstalliere diesen Mist sofort wieder! Noch Fragen? |
|
05.05.2014, 03:23
| #25 |
| | Windows 8, Windows PC-Repair Virus und wohl noch andere Habe sofort nach Deiner Antwort über die Systemsteuerung das Programm ganz normal deinstalliert. Dauerte allerdings nur 2 Sekunden und dann kam eine Page vom Anbieter mit Dank für die Nutzung. Und ferner ist mir aufgefallen daß bei mir jetzt unter Programme deinstallieren ein "intensiv deinstallieren" angeboten wird. Es ist ein am 22.01.2014 installiertes Programm namens IObit Uninstaller. Ich kann mich nicht erinnern dies installiert zu haben. Auch geht die Auswahl "Organisieren" nicht mehr! Und der Link für den Winzip Malware Protector war am Ende meiner vorherigen Antwort eingeblendet. Ich habe erst später gesehen, daß es eine Google-Werbung war. |
|
05.05.2014, 14:06
| #26 |
| /// TB-Ausbilder | Windows 8, Windows PC-Repair Virus und wohl noch andere Zum Problem mit "Organisieren" fällt mir leider nichts ein...  Gibt es sonst noch Probleme? |
|
07.05.2014, 03:54
| #27 |
| | Windows 8, Windows PC-Repair Virus und wohl noch andere Ich habe ja die neueste Version von Firefox jetzt drauf und den jetzt zum Standardbrowser gewählt, vorher Chrome. Allerdings kann ich über Firefox jetzt nichts mehr drucken, wie z.B. Kontoumsätze. Der Drucker schiebt nur die entsprechende Anzahl leerer Seiten raus. Über Chrome gehen die gleichen Drucke aber einwandfrei. Beim PluginCheck kommt die Meldung, daß Firefox und Flash aktuell sind und Java und Adobe Reader nicht installiert oder aktiviert sind. Beim Mozilla PluginCheck wird angezeigt zu Photo Gallery und Google Update ein "unbekanntes Ergebnis" und als Aktion der Button "Suchen". Soll ich da was updaten oder aktivieren bzw. installieren, oder ist das unwichtig? |
|
07.05.2014, 16:58
| #28 | |
| /// TB-Ausbilder | Windows 8, Windows PC-Repair Virus und wohl noch andereZitat:
Adobe Reader Download Haken bei "Optionales Angebot" entfernen. Ich bin froh, dass wir helfen konnten  In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
|
Linear-Darstellung
