Hallo,

ich habe bemerkt, dass mein Malwarebytes nicht mehr aktiv ist. Es lässt sich nicht mehr starten, auch nicht mit den 16 Chameläon Tools.

Hier schon mal die gewünschten Logfiles:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Administrator (administrator) on KILLERBOYPC on 17-05-2014 15:28:50
Running from C:\Users\Administrator\Desktop
Platform: Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(MalwareBytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\mbam-chameleon.pif
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(MalwareBytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\rundll32.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188552 2013-05-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3053808 2013-04-24] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-05-22] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [77088 2013-07-24] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [TelevisionFanatic EPM Support] => "C:\PROGRA~2\TELEVI~1\bar\1.bin\64medint.exe" T8EPMSUP.DLL,S
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Runonce: [C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\lmmfp] - cmd /C rd "C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\lmmfp" /s/q [X]
HKLM-x32\...\Runonce: [C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\equage] - cmd /C rd "C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\equage" /s/q [X]
HKLM-x32\...\Runonce: [C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\afklfty] - cmd /C rd "C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\afklfty" /s/q [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\Windows\SysWOW64\nvinit.dll => c:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs-x32: , C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
Startup: C:\Users\Toool66\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareBlaster.lnk
ShortcutTarget: SpywareBlaster.lnk -> C:\Program Files (x86)\SpywareBlaster\spywareblaster.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {995F4BA9-CC4A-41A0-B361-FA996141DF9F} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUfY-qCWBcsCA2IlsBaak5pAHw7hPcIlhbvkZDLeOdnUCLoumjpKkr4AGfdEV-1IbrUMQJpg8DeZht3IKhRzlMy6Npv4uqs2aGxXdq1COfKlmrFL3qj6ifKJc95-9DQdk,&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUfY-qCWBcsCA2IlsBaak5pAHw7hPcIlhbvkZDLeOdnUCLoumjpKkr4AGfdEV-1IbrUMQJpg8DeZht3IKhRzlMy6Npv4uqs2aGxXdq1COfKlmrFL3qj6ifKJc95-9DQdk,&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUfY-qCWBcsCA2IlsBaak5pAHw7hPcIlhbvkZDLeOdnUCLoumjpKkr4AGfdEV-1IbrUMQJpg8DeZht3IKhRzlMy6Npv4uqs2aGxXdq1COfKlmrFL3qj6ifKJc95-9DQdk,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUfY-qCWBcsCA2IlsBaak5pAHw7hPcIlhbvkZDLeOdnUCLoumjpKkr4AGfdEV-1IbrUMQJpg8DeZht3IKhRzlMy6Npv4uqs2aGxXdq1COfKlmrFL3qj6ifKJc95-9DQdk,&q={searchTerms}
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-11-12]

Chrome: 
=======
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchKeyword: search.snapdo.com
CHR DefaultSearchProvider: Web
CHR DefaultSearchURL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUfY-qCWBcsCA2IlsBaak5pAHw7hPcIlhbvkZDLeOdnUCLoumjpKkr4AGfdEV-1IbrUMQJpg8DeZht3IKhRzlMy6Npv4uqs2aGxXdq1COfKlmrFL3qj6ifKJc95-9DQdk,&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Google Drive) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-07]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-07]
CHR Extension: (Google-Suche) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-07]
CHR Extension: (Google Wallet) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-07]
CHR Extension: (Google Mail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-08] (Hewlett-Packard Development Company, L.P.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-05-08] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-05-08] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [245832 2013-05-17] (Realtek Semiconductor)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [994360 2011-10-14] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [399416 2011-10-14] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation)
S2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [X]

==================== Drivers (Whitelisted) ====================

R3 Apowersoft_AudioDevice; C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-07-22] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 HtcVCom32; C:\Windows\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [88280 2014-05-17] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99800 2013-05-08] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [408136 2013-05-09] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2715208 2013-05-28] (Realtek Semiconductor Corporation                           )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [29424 2013-04-24] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-24] (Synaptics Incorporated)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-17 15:27 - 2014-05-17 15:28 - 00019473 _____ () C:\Users\Administrator\Desktop\FRST.txt
2014-05-17 15:26 - 2014-05-17 15:27 - 02067456 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64 (1).exe
2014-05-17 15:25 - 2014-05-17 15:25 - 02067456 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2014-05-17 15:23 - 2014-05-17 15:23 - 00000488 _____ () C:\Users\Administrator\Desktop\defogger_disable.log
2014-05-17 15:22 - 2014-05-17 15:22 - 00050477 _____ () C:\Users\Administrator\Desktop\Defogger.exe
2014-05-17 12:01 - 2014-05-17 15:28 - 00000000 ____D () C:\FRST
2014-05-17 11:55 - 2014-05-17 11:55 - 00000000 _____ () C:\Users\Administrator\defogger_reenable
2014-05-17 11:27 - 2014-05-17 11:27 - 00000000 ____D () C:\Program Files (x86)\12345TMP
2014-05-12 23:52 - 2014-05-13 00:08 - 00000000 ____D () C:\Users\Administrator\Desktop\Deep House
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diagram Designer
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Program Files (x86)\MeeSoft
2014-05-12 01:45 - 2014-05-12 01:45 - 00007859 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2014-05-10 20:22 - 2014-05-17 12:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide_Angle_Software
2014-05-10 20:22 - 2014-05-10 20:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide Angle Software
2014-05-03 23:18 - 2014-05-03 23:19 - 00000000 ____D () C:\Users\Administrator\Desktop\Halbschale
2014-05-03 22:26 - 2014-05-03 22:26 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2014-05-01 15:02 - 2014-05-01 15:03 - 00263884 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-05-01 14:37 - 2014-05-01 14:37 - 00000000 ____D () C:\Users\Administrator\Desktop\Dresden
2014-04-28 23:14 - 2014-04-28 23:14 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-04-27 13:45 - 2014-04-27 13:45 - 00000000 ____D () C:\Users\Administrator\Documents\Syncios
2014-04-25 18:09 - 2014-05-17 12:46 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-04-25 15:32 - 2014-05-17 11:21 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Samsung
2014-04-25 15:32 - 2014-05-17 11:21 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Samsung
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\Documents\samsung
2014-04-24 11:40 - 2014-04-24 11:47 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\HTC
2014-04-24 11:37 - 2014-04-24 11:40 - 00000000 ____D () C:\Users\Administrator\Documents\HTC
2014-04-24 11:35 - 2014-04-24 11:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Downloaded Installations
2014-04-23 17:35 - 2014-04-23 17:35 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-04-22 17:40 - 2014-04-22 17:47 - 00000000 ____D () C:\Users\Administrator\Documents\Apowersoft Free Screen Recorder
2014-04-22 17:39 - 2014-04-22 17:39 - 00001435 _____ () C:\Users\Public\Desktop\Apowersoft.lnk
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apowersoft
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Program Files (x86)\Apowersoft
2014-04-22 17:39 - 2013-06-02 04:56 - 00031920 _____ (Wondershare) C:\Windows\system32\Drivers\Apowersoft_AudioDevice.sys
2014-04-22 17:39 - 2013-06-01 20:07 - 00443568 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftScreenCapturing.dll
2014-04-22 17:39 - 2013-06-01 20:07 - 00271536 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftScreenCapturingFilter.dll
2014-04-22 17:39 - 2013-06-01 20:07 - 00181424 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftVideoMixerFilter.dll
2014-04-22 16:25 - 2014-04-22 16:25 - 00003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-20 14:20 - 2014-04-20 14:20 - 00004096 ____H () C:\Users\Administrator\AppData\Local\keyfile3.drm
2014-04-18 20:29 - 2014-04-22 16:27 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\vlc
2014-04-18 12:36 - 2014-04-18 12:36 - 00000889 _____ () C:\Users\Public\Desktop\GIMP 2.lnk

==================== One Month Modified Files and Folders =======

2014-05-17 15:28 - 2014-05-17 15:27 - 00019473 _____ () C:\Users\Administrator\Desktop\FRST.txt
2014-05-17 15:28 - 2014-05-17 12:01 - 00000000 ____D () C:\FRST
2014-05-17 15:27 - 2014-05-17 15:26 - 02067456 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64 (1).exe
2014-05-17 15:25 - 2014-05-17 15:25 - 02067456 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2014-05-17 15:23 - 2014-05-17 15:23 - 00000488 _____ () C:\Users\Administrator\Desktop\defogger_disable.log
2014-05-17 15:22 - 2014-05-17 15:22 - 00050477 _____ () C:\Users\Administrator\Desktop\Defogger.exe
2014-05-17 15:21 - 2013-11-19 02:58 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-17 15:17 - 2013-09-27 19:10 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1966542787-1984559558-3704198819-500
2014-05-17 15:15 - 2014-03-30 18:27 - 00000000 ____D () C:\Users\Administrator\AppData\Local\CrashDumps
2014-05-17 15:11 - 2013-11-09 15:04 - 01817123 _____ () C:\Windows\WindowsUpdate.log
2014-05-17 15:02 - 2013-11-09 20:18 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-17 15:02 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-05-17 14:48 - 2013-12-07 12:14 - 00000000 ____D () C:\Users\Administrator
2014-05-17 14:24 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-05-17 14:05 - 2013-11-19 02:58 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-17 14:02 - 2013-11-09 20:18 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-17 13:57 - 2013-11-09 20:18 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-17 13:57 - 2013-11-09 20:18 - 00003872 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-17 13:38 - 2014-04-15 20:28 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-17 13:03 - 2013-12-07 12:17 - 00000000 ____D () C:\Users\Administrator\Documents\Youcam
2014-05-17 13:03 - 2013-07-22 19:32 - 00815890 _____ () C:\Windows\system32\perfh007.dat
2014-05-17 13:03 - 2013-07-22 19:32 - 00184324 _____ () C:\Windows\system32\perfc007.dat
2014-05-17 13:03 - 2012-07-26 09:28 - 01952854 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-17 12:55 - 2014-03-16 19:19 - 00312864 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-17 12:55 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-17 12:53 - 2013-11-09 15:05 - 00000000 ____D () C:\Users\Toool66
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-17 12:50 - 2014-03-31 22:15 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\streamripper
2014-05-17 12:50 - 2014-03-21 23:34 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mp3tag
2014-05-17 12:50 - 2014-03-19 23:59 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Winamp
2014-05-17 12:50 - 2013-12-07 12:15 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-17 12:50 - 2013-12-07 12:15 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-17 12:49 - 2014-04-06 13:42 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\BOM
2014-05-17 12:49 - 2014-04-05 21:38 - 00000000 ____D () C:\Users\Administrator\AppData\Local\gtk-2.0
2014-05-17 12:47 - 2014-03-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Mp3tag
2014-05-17 12:47 - 2013-11-22 21:20 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-17 12:47 - 2013-11-22 21:20 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-17 12:47 - 2013-11-10 16:21 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-05-17 12:47 - 2013-11-09 22:56 - 00000000 ____D () C:\Program Files (x86)\PKR
2014-05-17 12:47 - 2013-07-22 11:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft SkyDrive
2014-05-17 12:46 - 2014-04-25 18:09 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-05-17 12:46 - 2014-04-15 20:28 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-17 12:40 - 2014-05-10 20:22 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide_Angle_Software
2014-05-17 12:37 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\registration
2014-05-17 12:35 - 2012-07-26 07:38 - 00000000 ____D () C:\Windows\system32\Sysprep
2014-05-17 11:55 - 2014-05-17 11:55 - 00000000 _____ () C:\Users\Administrator\defogger_reenable
2014-05-17 11:27 - 2014-05-17 11:27 - 00000000 ____D () C:\Program Files (x86)\12345TMP
2014-05-17 11:21 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Samsung
2014-05-17 11:21 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Samsung
2014-05-16 22:44 - 2012-08-04 00:23 - 01137558 _____ () C:\Windows\PFRO.log
2014-05-13 00:08 - 2014-05-12 23:52 - 00000000 ____D () C:\Users\Administrator\Desktop\Deep House
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diagram Designer
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Program Files (x86)\MeeSoft
2014-05-12 01:46 - 2014-04-05 21:36 - 00000000 ____D () C:\Users\Administrator\.gimp-2.8
2014-05-12 01:45 - 2014-05-12 01:45 - 00007859 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2014-05-10 20:35 - 2014-05-10 20:22 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide Angle Software
2014-05-05 18:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-04 12:06 - 2012-07-26 09:21 - 00074025 _____ () C:\Windows\setupact.log
2014-05-03 23:19 - 2014-05-03 23:18 - 00000000 ____D () C:\Users\Administrator\Desktop\Halbschale
2014-05-03 22:26 - 2014-05-03 22:26 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2014-05-02 10:51 - 2013-11-09 23:08 - 00000000 ____D () C:\Users\Toool66\Desktop\Sound div
2014-05-01 15:03 - 2014-05-01 15:02 - 00263884 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-05-01 14:37 - 2014-05-01 14:37 - 00000000 ____D () C:\Users\Administrator\Desktop\Dresden
2014-04-29 18:27 - 2014-03-17 23:21 - 00073112 _____ () C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-28 23:14 - 2014-04-28 23:14 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-04-27 13:45 - 2014-04-27 13:45 - 00000000 ____D () C:\Users\Administrator\Documents\Syncios
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\Documents\samsung
2014-04-24 19:04 - 2014-04-15 20:43 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-24 11:47 - 2014-04-24 11:40 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\HTC
2014-04-24 11:40 - 2014-04-24 11:37 - 00000000 ____D () C:\Users\Administrator\Documents\HTC
2014-04-24 11:37 - 2014-03-21 23:11 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Apple Computer
2014-04-24 11:37 - 2013-12-07 12:16 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apple Computer
2014-04-24 11:36 - 2013-09-27 17:19 - 00031028 _____ () C:\Windows\DPINST.LOG
2014-04-24 11:35 - 2014-04-24 11:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Downloaded Installations
2014-04-23 17:35 - 2014-04-23 17:35 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-04-22 17:47 - 2014-04-22 17:40 - 00000000 ____D () C:\Users\Administrator\Documents\Apowersoft Free Screen Recorder
2014-04-22 17:39 - 2014-04-22 17:39 - 00001435 _____ () C:\Users\Public\Desktop\Apowersoft.lnk
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apowersoft
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Program Files (x86)\Apowersoft
2014-04-22 16:27 - 2014-04-18 20:29 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\vlc
2014-04-22 16:25 - 2014-04-22 16:25 - 00003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-20 14:20 - 2014-04-20 14:20 - 00004096 ____H () C:\Users\Administrator\AppData\Local\keyfile3.drm
2014-04-18 13:16 - 2013-11-09 23:11 - 00000000 ____D () C:\Toool66
2014-04-18 12:36 - 2014-04-18 12:36 - 00000889 _____ () C:\Users\Public\Desktop\GIMP 2.lnk

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 22:40

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by Administrator at 2014-05-17 15:29:13
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================


==================== Installed Programs ======================

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Apowersoft kostenloser Bildschirmrekorder V1.3.2 (HKLM-x32\...\{4EFA42DB-E4EC-4537-9DF3-5158D08A9785}_is1) (Version: 1.3.2 - Apowersoft)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Biet-O-Matic v2.14.12 (HKLM-x32\...\Biet-O-Matic v2.14.12) (Version: 2.14.12 - BOM Development Team)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.1.2922 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 5.0.1.2922 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Free YouTube Download Manager (HKLM-x32\...\{48fb0fd3-d029-4533-a87e-8021976f2b42}) (Version: 1.0.0 - Freetec)
Free YouTube Download Manager (x32 Version: 1.0.0 - Freetec) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM-x32\...\{07F6DC37-0857-4B68-A675-4E35989E85E3}) (Version: 6.0.15.1 - Hewlett-Packard Company)
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKCU\...\HPConnectedMusic) (Version: 1.1 (build 106) hp - Meridian Audio Ltd)
HP CoolSense (HKLM-x32\...\{59F8C5AA-91BD-423D-BF05-09A80F39898F}) (Version: 2.10.62 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Deskjet 2540 series Basic Device Software (HKLM\...\{BD1EFE20-246B-451F-B900-F1214324DF5F}) (Version: 30.0.1093.41190 - Hewlett-Packard Co.)
HP Documentation (HKLM-x32\...\{61245005-66F1-4001-AEE8-2E2D36F65C28}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Postscript Converter (Version: 4.0.4100 - Hewlett-Packard) Hidden
HP Quick Start (HKLM-x32\...\{BB27C290-AB30-4D9E-A5D1-88745AAE42E9}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Recovery Manager (x32 Version: 11.00 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6838.4521 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{C88F84E5-AE23-44BD-922C-2ABEACACAF7A}) (Version: 7.2.23.56 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\...\{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}) (Version: 1.0.10 - Hewlett-Packard Company)
HP Utility Center (HKLM\...\{A48BD764-CFDF-40A5-A07A-710908044F5D}) (Version: 2.2.2 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.3.1520 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3224 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.6.0.1033 - Intel Corporation) Hidden
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.9 - HTC)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
LPT System Updater Service (x32 Version: 1.0.0.0 - LPT) Hidden <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mp3tag v2.58 (HKLM-x32\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
No23 Recorder (HKLM-x32\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden
NVIDIA Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 11.10.13 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
Opera Stable 20.0.1387.91 (HKLM-x32\...\Opera 20.0.1387.91) (Version: 20.0.1387.91 - Opera Software ASA)
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.1 - pdfforge)
Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
PKR (HKLM-x32\...\PKR) (Version:  - PKR Ltd)
Realtek Card Reader (HKLM-x32\...\{F0A8BF4A-972F-41E0-9800-1EFE3BF28266}) (Version: 1.1.9200.15 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.15.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6923 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.00.12.0906 - REALTEK Semiconductor Corp.)
Secunia PSI (2.0.0.4003) (HKLM-x32\...\Secunia PSI) (Version: 2.0.0.4003 - Secunia)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Shopping Helper Smartbar (HKLM-x32\...\{7DD65DA0-AD4F-4974-AAC6-5834DD7F6841}) (Version: 11.43.63.16271 - ReSoft Ltd.) <==== ATTENTION
Shopping Helper Smartbar Engine (HKCU\...\{8d3ae6d7-fb6c-49c2-b28b-b69f15da3ab5}) (Version: 11.43.63.16271 - ReSoft Ltd.) <==== ATTENTION
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version:  - )
Switch Sound File Converter (HKLM-x32\...\Switch) (Version: 4.60 - NCH Software)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.5.3.3 - Synaptics Incorporated)
Syncios Version 3.0.1 (HKLM-x32\...\{068A5D84-8419-4BDE-9689-FE65F412EFBB}_is1) (Version: 3.0.1 - Anvsoft, Inc.)
VirtualDJ Home FREE (HKLM-x32\...\{A6AC699F-8315-40CA-8F70-E917494978AB}) (Version: 7.4 - Atomix Productions)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.65  - Nullsoft, Inc)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WinRAR 5.01 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

==================== Restore Points  =========================

25-04-2014 08:42:27 Windows Update
28-04-2014 21:02:02 Windows Update
01-05-2014 14:57:47 Removed Microsoft Silverlight
10-05-2014 18:20:53 Tune Sweeper wird installiert
16-05-2014 20:49:29 Tune Sweeper wird entfernt
17-05-2014 10:27:47 Wiederherstellungsvorgang

==================== Hosts content: ==========================

2012-07-26 07:26 - 2014-03-02 12:35 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {37189418-64E2-45E7-A8E8-3B40A769493F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-06-07] (Hewlett-Packard Company)
Task: {3BD43A05-13F1-46CE-8B57-8C271F7D2E9E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard)
Task: {42677D5E-46B9-4F04-8DE3-5C9584689B79} - System32\Tasks\Microsoft\Windows\Setup\Windows Upgrade Notification Task => C:\Windows\system32\NotificationUI.exe [2014-01-31] (Microsoft Corporation)
Task: {8C9BF7B3-C406-495B-8845-A7519BC5E859} - \Software Updater Ui No Task File <==== ATTENTION
Task: {94EC293F-62BE-4AAB-BC92-95BD13574519} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-17] (Adobe Systems Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {B99678B9-9A75-4DE5-95F0-CF6B31EA3B94} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)
Task: {C606D238-6D5E-484C-8871-21CD71851958} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2013-06-07] (Hewlett-Packard Development Company, L.P.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {CA646F2F-80CF-4E15-BFA6-5C8878122724} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-09] (Google Inc.)
Task: {D355AFDB-B0D8-4659-9E20-C34FAD71A66B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-09] (Google Inc.)
Task: {E13B8762-ABA1-4F8B-B6D7-4979F79E5442} - \Software Updater No Task File <==== ATTENTION
Task: {E66DF2B5-469D-4E8F-A1B2-5776AD438030} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {EA9BF889-EAB3-49CF-BD1A-3167D5B09B0D} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2014-01-31] (Microsoft Corporation)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-03-12 01:05 - 2014-03-04 16:35 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-09-27 17:29 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-11-09 20:10 - 2013-10-10 20:14 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-27 17:20 - 2013-05-08 23:23 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-03-12 01:05 - 2014-03-04 16:35 - 00014280 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/17/2014 03:15:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 34.0.1847.116, Zeitstempel: 0x533b63bd
Name des fehlerhaften Moduls: chrome.dll, Version: 34.0.1847.116, Zeitstempel: 0x533b5e41
Ausnahmecode: 0x80000003
Fehleroffset: 0x0042860b
ID des fehlerhaften Prozesses: 0x17e4
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (05/17/2014 03:12:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 34.0.1847.116, Zeitstempel: 0x533b63bd
Name des fehlerhaften Moduls: chrome.dll, Version: 34.0.1847.116, Zeitstempel: 0x533b5e41
Ausnahmecode: 0x80000003
Fehleroffset: 0x0042860b
ID des fehlerhaften Prozesses: 0x17dc
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (05/17/2014 03:12:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.500, Zeitstempel: 0x533d8de2
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0xb58
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5

Error: (05/17/2014 03:06:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.500, Zeitstempel: 0x533d8de2
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0xb88
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5

Error: (05/17/2014 02:58:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 34.0.1847.116, Zeitstempel: 0x533b63bd
Name des fehlerhaften Moduls: chrome.dll, Version: 34.0.1847.116, Zeitstempel: 0x533b5e41
Ausnahmecode: 0x80000003
Fehleroffset: 0x0042860b
ID des fehlerhaften Prozesses: 0x158c
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (05/17/2014 02:54:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.500, Zeitstempel: 0x533d8de2
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x1214
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5

Error: (05/17/2014 02:44:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.500, Zeitstempel: 0x533d8de2
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0xd24
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5

Error: (05/17/2014 02:42:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 34.0.1847.116, Zeitstempel: 0x533b63bd
Name des fehlerhaften Moduls: chrome.dll, Version: 34.0.1847.116, Zeitstempel: 0x533b5e41
Ausnahmecode: 0x80000003
Fehleroffset: 0x0042860b
ID des fehlerhaften Prozesses: 0x140c
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (05/17/2014 02:34:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.500, Zeitstempel: 0x533d8de2
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x4d4
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5

Error: (05/17/2014 02:22:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.500, Zeitstempel: 0x533d8de2
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x1500
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5


System errors:
=============
Error: (05/17/2014 01:34:30 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Andrea RT Filters Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/17/2014 01:08:15 PM) (Source: DCOM) (EventID: 10005) (User: KillerboyPC)
Description: 1053hpqwmiexNicht verfügbar{F5539356-2F02-40D4-999E-FA61F45FE12E}

Error: (05/17/2014 01:08:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Software Framework Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (05/17/2014 01:08:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst HP Software Framework Service erreicht.

Error: (05/17/2014 01:07:02 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}

Error: (05/17/2014 01:06:07 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde nicht richtig gestartet.

Error: (05/17/2014 00:59:45 PM) (Source: DCOM) (EventID: 10005) (User: KillerboyPC)
Description: 1053hpqwmiexNicht verfügbar{F5539356-2F02-40D4-999E-FA61F45FE12E}

Error: (05/17/2014 00:59:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Software Framework Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (05/17/2014 00:59:44 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst HP Software Framework Service erreicht.

Error: (05/17/2014 00:58:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (05/17/2014 03:15:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe34.0.1847.116533b63bdchrome.dll34.0.1847.116533b5e41800000030042860b17e401cf71d206b76efcC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\chrome.dll449d60b1-ddc5-11e3-be98-a0481c20c9db

Error: (05/17/2014 03:12:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe34.0.1847.116533b63bdchrome.dll34.0.1847.116533b5e41800000030042860b17dc01cf71d1aeddff4fC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\chrome.dllecfa9ab4-ddc4-11e3-be98-a0481c20c9db

Error: (05/17/2014 03:12:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.500533d8de2MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fdb5801cf71d19d5f2acbC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dlldb475179-ddc4-11e3-be98-a0481c20c9db

Error: (05/17/2014 03:06:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.500533d8de2MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fdb8801cf71d0d4e5e7acC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dll12ed0db6-ddc4-11e3-be98-a0481c20c9db

Error: (05/17/2014 02:58:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe34.0.1847.116533b63bdchrome.dll34.0.1847.116533b5e41800000030042860b158c01cf71cfadd23b3eC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\chrome.dllec2a719c-ddc2-11e3-be98-a0481c20c9db

Error: (05/17/2014 02:54:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.500533d8de2MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd121401cf71cf2c07e6b2C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dll6c35f50a-ddc2-11e3-be98-a0481c20c9db

Error: (05/17/2014 02:44:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.500533d8de2MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fdd2401cf71cdbf52a0c9C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dllfd22f01c-ddc0-11e3-be98-a0481c20c9db

Error: (05/17/2014 02:42:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe34.0.1847.116533b63bdchrome.dll34.0.1847.116533b5e41800000030042860b140c01cf71cd795fbbeaC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\chrome.dllb86ae99a-ddc0-11e3-be98-a0481c20c9db

Error: (05/17/2014 02:34:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.500533d8de2MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd4d401cf71cc583c66beC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dll96222b37-ddbf-11e3-be98-a0481c20c9db

Error: (05/17/2014 02:22:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.500533d8de2MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd150001cf71caabbe6d1fC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dllea465312-ddbd-11e3-be98-a0481c20c9db


CodeIntegrity Errors:
===================================
  Date: 2014-03-02 11:35:04.189
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Percentage of memory in use: 27%
Total physical RAM: 7962.14 MB
Available physical RAM: 5761.11 MB
Total Pagefile: 9178.14 MB
Available Pagefile: 6809.15 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:910.13 GB) (Free:715.28 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:20.61 GB) (Free:2.08 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 298DD091)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-17 15:41:53
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000038 TOSHIBA_MQ01ABD100 rev.AX001C 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\uxdyykod.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\Windows\System32\win32k.sys!W32pServiceTable                                                                      fffff960001ede00 7 bytes [00, 77, 82, 01, 00, 57, F2]
.text   C:\Windows\System32\win32k.sys!W32pServiceTable + 8                                                                  fffff960001ede08 7 bytes [01, 42, C0, FF, 00, 17, DB]

---- User code sections - GMER 2.1 ----

.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                     000007fc16ed25a0 8 bytes JMP 000007fd16630340
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                   000007fc16ed6b20 9 bytes JMP 000007fd16630298
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                            000007fc16f557b0 7 bytes JMP 000007fd16630260
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                    000007fc16f71514 7 bytes JMP 000007fd166302d0
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                              000007fc16f84824 1 byte JMP 000007fd16630228
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW + 2                          000007fc16f84826 5 bytes {JMP 0xffffffffff6aba04}
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                            000007fc16f848b8 8 bytes JMP 000007fd166301f0
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                     000007fc16f84edc 8 bytes JMP 000007fd16630308
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                 000007fc16641f60 7 bytes JMP 000007fd166300d8
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                      000007fc16641fe0 5 bytes JMP 000007fd16630180
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                               000007fc16644a20 5 bytes JMP 000007fd16630110
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                   000007fc166483b0 6 bytes JMP 000007fd16630148
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                             000007fc16653bd8 5 bytes JMP 000007fd166301b8
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\USER32.dll!CreateWindowExW                                      000007fc1744c5b0 7 bytes JMP 000007fd16630420
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                           000007fc174531f0 1 byte JMP 000007fd16630378
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo + 2                       000007fc174531f2 7 bytes {JMP 0xffffffffff1dd188}
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                  000007fc174533e0 5 bytes JMP 000007fd166303e8
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                  000007fc17457160 5 bytes JMP 000007fd166303b0
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                000007fc169d1070 8 bytes JMP 000007fd16630490
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                              000007fc169f0c10 8 bytes JMP 000007fd16630458
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                     000007fc14556d10 5 bytes JMP 000007fd14540110
.text   C:\Windows\system32\dwm.exe[940] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                      000007fc1455d060 5 bytes JMP 000007fd145400d8
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[580] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690     000007fc12591532 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[580] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698     000007fc1259153a 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[580] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246   000007fc1259165a 4 bytes [59, 12, FC, 07]
.text   C:\Windows\system32\nvvsvc.exe[640] C:\Windows\system32\MSIMG32.dll!GradientFill + 690                               000007fc12591532 4 bytes [59, 12, FC, 07]
.text   C:\Windows\system32\nvvsvc.exe[640] C:\Windows\system32\MSIMG32.dll!GradientFill + 698                               000007fc1259153a 4 bytes [59, 12, FC, 07]
.text   C:\Windows\system32\nvvsvc.exe[640] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246                             000007fc1259165a 4 bytes [59, 12, FC, 07]
.text   C:\Windows\system32\nvvsvc.exe[640] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                     000007fc1743177a 4 bytes [43, 17, FC, 07]
.text   C:\Windows\system32\nvvsvc.exe[640] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                     000007fc17431782 4 bytes [43, 17, FC, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1132] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690              000007fc12591532 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1132] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698              000007fc1259153a 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1132] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246            000007fc1259165a 4 bytes [59, 12, FC, 07]
.text   C:\Windows\System32\spoolsv.exe[1448] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                   000007fc1743177a 4 bytes [43, 17, FC, 07]
.text   C:\Windows\System32\spoolsv.exe[1448] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                   000007fc17431782 4 bytes [43, 17, FC, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2840] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690      000007fc12591532 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2840] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698      000007fc1259153a 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2840] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246    000007fc1259165a 4 bytes [59, 12, FC, 07]
.text   C:\Windows\system32\svchost.exe[1892] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                   000007fc1743177a 4 bytes [43, 17, FC, 07]
.text   C:\Windows\system32\svchost.exe[1892] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                   000007fc17431782 4 bytes [43, 17, FC, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4060] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690            000007fc12591532 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4060] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698            000007fc1259153a 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4060] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246          000007fc1259165a 4 bytes [59, 12, FC, 07]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1220] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306     000007fc1743177a 4 bytes [43, 17, FC, 07]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1220] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314     000007fc17431782 4 bytes [43, 17, FC, 07]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[3760] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306  000007fc1743177a 4 bytes [43, 17, FC, 07]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[3760] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314  000007fc17431782 4 bytes [43, 17, FC, 07]

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\csrss.exe [576:600]                                                                              fffff960009a75e8

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                unknown MBR code

---- EOF - GMER 2.1 ----
         

Beim Start von GMER gabs noch ein paar Fehlermeldungen:

C:\Windows\system\config\system: Der Prozess kann auf die Datei nicht zurgeifen da sie von einem anderen Prozess verwendet wird.

C:\users\Administrator\ntuser.dat: Der Prozess kann auf die Datei nicht zurgeifen da sie von einem anderen Prozess verwendet wird.


Ich hatte mit eurer Hilfe vor ein paar Wochen gerade alles bereinigt. Jatzt hat mein Sohn mit meinem Rechner das Betriebssystem an seinem Handy reparieren wollen .... Daher wahrscheinlich die neuen Probleme. Jetzt hat er Rechnerverbot !


Bitte um Hilfe ....


Gruß
Hans-Jürgen

hi,

Adware & Co. deinstallieren

• Lade Dir bitte von hier Revo Uninstaller herunter.
• Installiere und starte das Programm.
• Suche im Uninstallerfeld nach den Programmen, die unter:
  
  diesen Zusatz haben:
  
• Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:




Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo, anbei die Combofix.txt:

ComboFix 14-05-16.01 - Administrator 18.05.2014  16:18:58.1.4 - x64
Microsoft Windows 8  6.2.9200.0.1252.49.1031.18.7962.6532 [GMT 2:00]
ausgeführt von:: c:\users\Administrator\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\TelevisionFanatic
c:\program files (x86)\TelevisionFanatic\bar\Settings\s_pid.dat
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-04-18 bis 2014-05-18  ))))))))))))))))))))))))))))))
.
.
2014-05-18 14:25 . 2014-05-18 14:25	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2014-05-18 14:25 . 2014-05-18 14:25	--------	d-----w-	c:\users\Toool66\AppData\Local\temp
2014-05-18 14:25 . 2014-05-18 14:25	--------	d-----w-	c:\users\Public\AppData\Local\temp
2014-05-18 14:25 . 2014-05-18 14:25	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-05-17 10:01 . 2014-05-17 13:29	--------	d-----w-	C:\FRST
2014-05-17 09:27 . 2014-05-17 09:27	--------	d-----w-	c:\program files (x86)\12345TMP
2014-05-11 23:49 . 2014-05-11 23:49	--------	d-----w-	c:\program files (x86)\MeeSoft
2014-05-10 18:22 . 2014-05-17 10:40	--------	d-----w-	c:\users\Administrator\AppData\Local\Wide_Angle_Software
2014-05-10 18:22 . 2014-05-10 18:35	--------	d-----w-	c:\users\Administrator\AppData\Local\Wide Angle Software
2014-05-03 20:26 . 2014-05-03 20:26	--------	d-----w-	c:\windows\system32\%LOCALAPPDATA%
2014-04-28 21:14 . 2014-04-28 21:14	--------	d-----w-	c:\program files (x86)\MSXML 4.0
2014-04-25 16:09 . 2014-05-17 10:46	--------	d-----w-	c:\program files (x86)\7-Zip
2014-04-25 14:57 . 2014-05-05 16:55	--------	d-----w-	c:\users\Administrator\AppData\Local\ElevatedDiagnostics
2014-04-25 13:32 . 2014-05-17 09:21	--------	d-----w-	c:\users\Administrator\AppData\Local\Samsung
2014-04-25 13:32 . 2014-05-17 09:21	--------	d-----w-	c:\users\Administrator\AppData\Roaming\Samsung
2014-04-25 13:29 . 2014-05-17 09:21	--------	d-----w-	c:\programdata\Samsung
2014-04-24 09:40 . 2014-04-24 09:47	--------	d-----w-	c:\users\Administrator\AppData\Roaming\HTC
2014-04-24 09:35 . 2014-04-24 09:35	--------	d-----w-	c:\users\Administrator\AppData\Local\Downloaded Installations
2014-04-24 09:31 . 2014-04-24 09:31	--------	d-----w-	C:\Temp
2014-04-24 09:31 . 2014-04-24 09:31	--------	d-----w-	c:\programdata\HTC
2014-04-23 15:35 . 2014-04-23 15:35	119512	----a-w-	c:\windows\system32\drivers\48230029.sys
2014-04-22 15:39 . 2014-04-22 15:39	--------	d-----w-	c:\users\Administrator\AppData\Roaming\Apowersoft
2014-04-22 15:39 . 2014-04-22 15:39	--------	d-----w-	c:\program files (x86)\Apowersoft
2014-04-22 15:39 . 2013-06-02 02:56	31920	----a-w-	c:\windows\system32\drivers\Apowersoft_AudioDevice.sys
2014-04-22 15:39 . 2013-06-01 18:07	443568	---ha-w-	c:\windows\SysWow64\ApowersoftScreenCapturing.dll
2014-04-22 15:39 . 2013-06-01 18:07	271536	---ha-w-	c:\windows\SysWow64\ApowersoftScreenCapturingFilter.dll
2014-04-22 15:39 . 2013-06-01 18:07	181424	---ha-w-	c:\windows\SysWow64\ApowersoftVideoMixerFilter.dll
2014-04-19 11:40 . 2014-04-19 11:40	--------	d-----w-	c:\windows\ServiceProfiles\LocalService\winhttp
2014-04-18 18:29 . 2014-04-22 14:27	--------	d-----w-	c:\users\Administrator\AppData\Roaming\vlc
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-17 11:38 . 2014-04-15 18:28	88280	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-04-24 17:04 . 2014-04-15 18:43	119512	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-09 01:01 . 2013-11-16 20:24	90655440	----a-w-	c:\windows\system32\MRT.exe
2014-04-03 07:51 . 2014-04-15 18:28	63192	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-04-03 07:50 . 2014-03-03 18:47	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-03-31 21:18 . 2013-11-16 09:15	78296	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-31 21:18 . 2013-11-16 09:15	694232	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-07 00:48 . 2014-04-12 10:09	1766400	----a-w-	c:\windows\SysWow64\wininet.dll
2014-03-07 00:47 . 2014-04-12 10:09	2877952	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-03-07 00:08 . 2014-04-12 10:09	51712	----a-w-	c:\windows\system32\ie4uinit.exe
2014-03-07 00:08 . 2014-04-12 10:09	2240000	----a-w-	c:\windows\system32\wininet.dll
2014-03-07 00:08 . 2014-04-12 10:09	1365504	----a-w-	c:\windows\system32\urlmon.dll
2014-03-07 00:08 . 2014-04-12 10:09	915968	----a-w-	c:\windows\system32\uxtheme.dll
2014-03-07 00:08 . 2014-04-12 10:09	603136	----a-w-	c:\windows\system32\msfeeds.dll
2014-03-07 00:08 . 2014-04-12 10:09	19273216	----a-w-	c:\windows\system32\mshtml.dll
2014-03-07 00:08 . 2014-04-12 10:09	855552	----a-w-	c:\windows\system32\jscript.dll
2014-03-07 00:08 . 2014-04-12 10:09	3959808	----a-w-	c:\windows\system32\jscript9.dll
2014-03-07 00:08 . 2014-04-12 10:09	15404544	----a-w-	c:\windows\system32\ieframe.dll
2014-03-07 00:08 . 2014-04-12 10:09	2648576	----a-w-	c:\windows\system32\iertutil.dll
2014-03-04 14:35 . 2014-03-11 23:05	9728064	----a-w-	c:\windows\SysWow64\nvcuda.dll
2014-03-04 14:35 . 2014-03-11 23:05	9690424	----a-w-	c:\windows\SysWow64\nvopencl.dll
2014-03-04 14:35 . 2014-03-11 23:05	892704	----a-w-	c:\windows\system32\NvIFR64.dll
2014-03-04 14:35 . 2014-03-11 23:05	877856	----a-w-	c:\windows\system32\NvFBC64.dll
2014-03-04 14:35 . 2014-03-11 23:05	863064	----a-w-	c:\windows\SysWow64\NvIFR.dll
2014-03-04 14:35 . 2014-03-11 23:05	846168	----a-w-	c:\windows\SysWow64\NvFBC.dll
2014-03-04 14:35 . 2014-03-11 23:05	484296	----a-w-	c:\windows\system32\nvEncodeAPI64.dll
2014-03-04 14:35 . 2014-03-11 23:05	409544	----a-w-	c:\windows\SysWow64\nvEncodeAPI.dll
2014-03-04 14:35 . 2014-03-11 23:05	377688	----a-w-	c:\windows\system32\NvIFROpenGL.dll
2014-03-04 14:35 . 2014-03-11 23:05	353504	----a-w-	c:\windows\system32\nvoglshim64.dll
2014-03-04 14:35 . 2014-03-11 23:05	33736	----a-w-	c:\windows\system32\drivers\nvpciflt.sys
2014-03-04 14:35 . 2014-03-11 23:05	333600	----a-w-	c:\windows\SysWow64\NvIFROpenGL.dll
2014-03-04 14:35 . 2014-03-11 23:05	31474976	----a-w-	c:\windows\system32\nvoglv64.dll
2014-03-04 14:35 . 2014-03-11 23:05	3143456	----a-w-	c:\windows\system32\nvcuvid.dll
2014-03-04 14:35 . 2014-03-11 23:05	305600	----a-w-	c:\windows\SysWow64\nvoglshim32.dll
2014-03-04 14:35 . 2014-03-11 23:05	2958792	----a-w-	c:\windows\SysWow64\nvcuvid.dll
2014-03-04 14:35 . 2014-03-11 23:05	2783008	----a-w-	c:\windows\system32\nvcuvenc.dll
2014-03-04 14:35 . 2014-03-11 23:05	2411976	----a-w-	c:\windows\SysWow64\nvcuvenc.dll
2014-03-04 14:35 . 2014-03-11 23:05	23716640	----a-w-	c:\windows\SysWow64\nvoglv32.dll
2014-03-04 14:35 . 2014-03-11 23:05	1885472	----a-w-	c:\windows\system32\nvdispco6433523.dll
2014-03-04 14:35 . 2014-03-11 23:05	18302384	----a-w-	c:\windows\system32\nvwgf2umx.dll
2014-03-04 14:35 . 2014-03-11 23:05	17755424	----a-w-	c:\windows\system32\nvd3dumx.dll
2014-03-04 14:35 . 2014-03-11 23:05	15783992	----a-w-	c:\windows\SysWow64\nvwgf2um.dll
2014-03-04 14:35 . 2014-03-11 23:05	1516488	----a-w-	c:\windows\system32\nvdispgenco6433523.dll
2014-03-04 14:35 . 2014-03-11 23:05	14709720	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2014-03-04 14:35 . 2014-03-11 23:05	12708128	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2014-03-04 14:35 . 2014-03-11 23:05	11636176	----a-w-	c:\windows\system32\nvcuda.dll
2014-03-04 14:35 . 2014-03-11 23:05	11589272	----a-w-	c:\windows\system32\nvopencl.dll
2014-03-04 14:35 . 2014-03-11 23:05	2715264	----a-w-	c:\windows\SysWow64\nvapi.dll
2014-03-04 14:35 . 2014-03-11 23:05	25255256	----a-w-	c:\windows\system32\nvcompiler.dll
2014-03-04 14:35 . 2014-03-11 23:05	17561544	----a-w-	c:\windows\SysWow64\nvcompiler.dll
2014-03-04 14:35 . 2013-09-27 15:28	947808	----a-w-	c:\windows\system32\nvumdshimx.dll
2014-03-04 14:35 . 2013-09-27 15:28	832936	----a-w-	c:\windows\SysWow64\nvumdshim.dll
2014-03-04 14:35 . 2013-09-27 15:28	174296	----a-w-	c:\windows\system32\nvinitx.dll
2014-03-04 14:35 . 2013-09-27 15:28	148016	----a-w-	c:\windows\SysWow64\nvinit.dll
2014-03-04 14:35 . 2013-09-27 15:28	3093280	----a-w-	c:\windows\system32\nvapi64.dll
2014-03-04 13:06 . 2013-09-27 15:29	6714312	----a-w-	c:\windows\system32\nvcpl.dll
2014-03-04 13:06 . 2013-09-27 15:29	3497816	----a-w-	c:\windows\system32\nvsvc64.dll
2014-03-04 13:05 . 2013-09-27 15:29	922968	----a-w-	c:\windows\system32\nvvsvc.exe
2014-03-04 13:05 . 2013-09-27 15:29	64968	----a-w-	c:\windows\system32\nvshext.dll
2014-03-04 13:05 . 2013-09-27 15:29	2558808	----a-w-	c:\windows\system32\nvsvcr.dll
2014-03-04 13:05 . 2013-09-27 15:29	67072	----a-w-	c:\windows\system32\nv3dappshextr.dll
2014-03-04 13:05 . 2013-09-27 15:29	386336	----a-w-	c:\windows\system32\nvmctray.dll
2014-03-04 13:05 . 2013-09-27 15:29	1075032	----a-w-	c:\windows\system32\nv3dappshext.dll
2014-03-04 13:05 . 2013-09-27 15:29	3649185	----a-w-	c:\windows\system32\nvcoproc.bin
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouCam Service"="c:\program files (x86)\CyberLink\YouCam\YouCamService.exe" [2013-05-22 267224]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-12 43848]
"AccelerometerSysTrayApplet"="c:\program files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe" [2013-07-24 77088]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
.
c:\users\Toool66\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
SpywareBlaster.lnk - c:\program files (x86)\SpywareBlaster\spywareblaster.exe [2014-3-6 2557544]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-10-14 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll c:\windows\SysWOW64\nvinit.dll
.
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys;c:\windows\SYSNATIVE\DRIVERS\HtcVComV64.sys [x]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf.sys [x]
R3 RTSPER;Realtek PCIE Card Reader - PER;c:\windows\system32\DRIVERS\RtsPer.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPer.sys [x]
R3 SmbDrv;SmbDrv;c:\windows\System32\drivers\Smb_driver_AMDASF.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_AMDASF.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\System32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.EXE;c:\program files\Realtek\Audio\HDA\AERTSr64.EXE [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
S3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys;c:\windows\SYSNATIVE\drivers\Apowersoft_AudioDevice.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter;c:\windows\system32\DRIVERS\rtwlane.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlane.sys [x]
S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
S3 WirelessButtonDriver;HP Wireless Button Driver Service;c:\windows\System32\drivers\WirelessButtonDriver64.sys;c:\windows\SYSNATIVE\drivers\WirelessButtonDriver64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
apphost	REG_MULTI_SZ   	apphostsvc
iissvcs	REG_MULTI_SZ   	w3svc was
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-19 12:05]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2013-05-28 7188552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-07-03 165872]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-07-03 407536]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-07-03 444400]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-02-05 2234144]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-02-05 1179576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-TelevisionFanatic EPM Support - c:\progra~2\TELEVI~1\bar\1.bin\64medint.exe
Wow6432Node-HKLM-Run-mobilegeni daemon - c:\program files (x86)\Mobogenie\DaemonProcess.exe
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{C88F84E5-AE23-44BD-922C-2ABEACACAF7A} - c:\program files (x86)\InstallShield Installation Information\{C88F84E5-AE23-44BD-922C-2ABEACACAF7A}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{25A3A431-30BB-47C8-AD6A-E1063801134F}"=hex:51,66,7a,6c,4c,1d,3b,1b,21,bb,b8,
   3a,8a,66,a3,08,b6,69,a4,46,39,4b,5e,57
"{3A2D5EBA-F86D-4BD3-A177-019765996711}"=hex:51,66,7a,6c,4c,1d,3b,1b,aa,41,36,
   25,5c,ae,b8,04,ba,74,44,d7,64,d3,2a,09
"{E76FD755-C1BA-4DCB-9F13-99BD91223ADE}"=hex:51,66,7a,6c,4c,1d,3b,1b,45,c8,74,
   f8,8b,97,a0,02,84,10,dc,fd,90,68,77,c6
"{AE07101B-46D4-4A98-AF68-0333EA26E113}"=hex:51,66,7a,6c,4c,1d,3b,1b,0b,0f,1c,
   b1,e5,10,f3,05,b4,6b,46,73,eb,6c,ac,0b
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (Administrator)
"Timestamp"=hex:a5,dd,0f,70,b5,5b,cf,01
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,82,dc,de,b5,90,87,2b,47,ae,80,47,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,82,dc,de,b5,90,87,2b,47,ae,80,47,\
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice]
@Denied: (2) (Administrator)
"Hash"="DbE4aEOS7jM="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\UserChoice]
@Denied: (2) (Administrator)
"Hash"="IGDIAU64ON4="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\UserChoice]
@Denied: (2) (Administrator)
"Hash"="VZqDwSoEmrw="
"ProgId"="WMP11.AssocFile.3G2"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\UserChoice]
@Denied: (2) (Administrator)
"Hash"="nlfmDLAC9zk="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\UserChoice]
@Denied: (2) (Administrator)
"Hash"="71qyqQzGGBk="
"ProgId"="HPConnectedMusic.aac"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adt\UserChoice]
@Denied: (2) (Administrator)
"Hash"="KvM3JWIMk58="
"ProgId"="WMP11.AssocFile.ADTS"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adts\UserChoice]
@Denied: (2) (Administrator)
"Hash"="8FmIwpRmbU8="
"ProgId"="WMP11.AssocFile.ADTS"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Hash"="K8r9GzhNc3Q="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (Administrator)
"Hash"="296c7mJNs74="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (Administrator)
"Hash"="pEyFoULS4LM="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (Administrator)
"Hash"="VJ8Gwriiu8A="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (Administrator)
"Hash"="0PeCpjlg3Eo="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (Administrator)
"Hash"="V43GnDniEGY="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (Administrator)
"Hash"="po6CAgRT6sw="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (Administrator)
"Hash"="BWCbT4Vr+eM="
"ProgId"="OISjpegfile"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]
@Denied: (2) (Administrator)
"Hash"="rs3E/dulF6I="
"ProgId"="HPConnectedMusic.m4a"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\UserChoice]
@Denied: (2) (Administrator)
"Hash"="Kh3+TOYnCYo="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice]
@Denied: (2) (Administrator)
"Hash"="pMFvuasoZDY="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MP2\UserChoice]
@Denied: (2) (Administrator)
"Hash"="+5hD0UbKJME="
"ProgId"="WMP11.AssocFile.MP3"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (Administrator)
"Hash"="JpeEKl2qITw="
"ProgId"="WMP11.AssocFile.MP3"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]
@Denied: (2) (Administrator)
"Hash"="A3GHCBl89Sc="
"ProgId"="WMP11.AssocFile.MP4"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\UserChoice]
@Denied: (2) (Administrator)
"Hash"="/GZpo6Z7AtY="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (Administrator)
"Hash"="TWwrly1pcc4="
"ProgId"="WMP11.AssocFile.MPEG"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MPE\UserChoice]
@Denied: (2) (Administrator)
"Hash"="EwWirX726jA="
"ProgId"="WMP11.AssocFile.MPEG"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
@Denied: (2) (Administrator)
"Hash"="HSuDsh7Z++U="
"ProgId"="WMP11.AssocFile.MPEG"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Hash"="Fin0PnJYWMk="
"ProgId"="WMP11.AssocFile.MPEG"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\UserChoice]
@Denied: (2) (Administrator)
"Hash"="JiZ3fJldNQw="
"ProgId"="WMP11.AssocFile.M2TS"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.oxps\UserChoice]
@Denied: (2) (Administrator)
"Hash"="Y0BmFO9ggoM="
"ProgId"="AppX86746z2101ayy2ygv3g96e4eqdf8r99j"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
@Denied: (2) (Administrator)
"Hash"="/dnO9QtZM1M="
"ProgId"="AcroExch.Document.11"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (Administrator)
"Hash"="++VJYCjJRQU="
"ProgId"="Winamp.PlayList"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (Administrator)
"Hash"="CuzZCwSQ2I0="
"ProgId"="OISpngfile"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (Administrator)
"Hash"="82039revAS4="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (Administrator)
"Hash"="MsyafMIJS0Y="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\UserChoice]
@Denied: (2) (Administrator)
"Hash"="Mu/Stg7MKdA="
"ProgId"="WMP11.AssocFile.TTS"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\UserChoice]
@Denied: (2) (Administrator)
"Hash"="JM/FbPlkTOg="
"ProgId"="WMP11.AssocFile.TTS"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\UserChoice]
@Denied: (2) (Administrator)
"Hash"="u8ai6yrZ/ms="
"ProgId"="txtfile"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (Administrator)
"Hash"="umF1T5CbdSQ="
"ProgId"="HPConnectedMusic.wav"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\UserChoice]
@Denied: (2) (Administrator)
"Hash"="HfvSd5MhcqY="
"ProgId"="AppX9vdwcvrwnbettpahnt26jswq0n8hgyah"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
@Denied: (2) (Administrator)
"Hash"="jt+CqKdk2mY="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (Administrator)
"Hash"="TeW3xdYTwDc="
"ProgId"="HPConnectedMusic.wma"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
@Denied: (2) (Administrator)
"Hash"="eVk6ExZc7l4="
"ProgId"="AppXhjhjmgrfm2d7rd026az898dy2p1pcsyt"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WPL\UserChoice]
@Denied: (2) (Administrator)
"Hash"="Z68XXQH0kfg="
"ProgId"="WMP11.AssocFile.WPL"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xps\UserChoice]
@Denied: (2) (Administrator)
"Hash"="HNhvTWEadFA="
"ProgId"="AppX86746z2101ayy2ygv3g96e4eqdf8r99j"
.
[HKEY_USERS\S-1-5-21-1966542787-1984559558-3704198819-500CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\UserChoice]
@Denied: (2) (Administrator)
"Hash"="VmJ7oNy5FWs="
"ProgId"="7-Zip.zip"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2014-05-18  16:27:44
ComboFix-quarantined-files.txt  2014-05-18 14:27
.
Vor Suchlauf: 20 Verzeichnis(se), 759.716.155.392 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 759.609.532.416 Bytes frei
.
- - End Of File - - E1D0B9C59B8608B55E63B55A347FBDEB
5FB38429D5D77768867C76DCBDB35194
         

Danke und Gruss

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo,

bei der Installation von Malwarebytes kommen folgende Fehlermeldungen:

4x

Interner Fehler:
Expression Error `RuntimeError (at57:177):
External exception E06D7363.`

1x

Runtime Error (49:252):
External exception E06D7363.`

1x

Interner Fehler:
Expression Error `RuntimeError (at35:89):
External exception E06D7363.`


Malwarebytes lässt sich nach dieser Installation nicht starten

Habe dann trotzdem noch adwcleaner und JRT installiert und laufen lassen.

Hier die Logfiles:

adwcleaner:

# AdwCleaner v3.210 - Bericht erstellt am 20/05/2014 um 22:51:21
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Administrator - KILLERBOYPC
# Gestartet von : C:\Users\Administrator\Desktop\adwcleaner_3.210.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\TelevisionFanatic
Ordner Gelöscht : C:\Users\Administrator\AppData\LocalLow\TelevisionFanatic
Ordner Gelöscht : C:\Users\Administrator\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Administrator\Documents\Mobogenie
Ordner Gelöscht : C:\Users\Toool66\AppData\Local\TelevisionFanatic
Ordner Gelöscht : C:\Users\Toool66\AppData\LocalLow\TelevisionFanatic

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\TelevisionFanatic
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\TelevisionFanatic
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Google Chrome v

[ Datei : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ Datei : C:\Users\Toool66\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [4775 octets] - [20/05/2014 22:50:40]
AdwCleaner[S0].txt - [4321 octets] - [20/05/2014 22:51:21]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4381 octets] ##########
         

JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by Administrator on 20.05.2014 at 22:58:09,01
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.05.2014 at 23:02:27,44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Dann habe ich noch einmal versucht Malwarebytes zu installieren ... leider mit den gleichen Fehlermeldungen und auch jetzt lässt sich Malwarebytes nicht starten.

Hmmmm......


Gruß
Hans-Jürgen

Oh, hier noch das neue FRST:


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Administrator (administrator) on KILLERBOYPC on 20-05-2014 23:20:33
Running from C:\Users\Administrator\Desktop
Platform: Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188552 2013-05-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3053808 2013-04-24] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-05-22] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [77088 2013-07-24] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\Windows\SysWOW64\nvinit.dll => c:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs-x32:  C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
Startup: C:\Users\Toool66\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareBlaster.lnk
ShortcutTarget: SpywareBlaster.lnk -> C:\Program Files (x86)\SpywareBlaster\spywareblaster.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {995F4BA9-CC4A-41A0-B361-FA996141DF9F} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-11-12]

Chrome: 
=======
CHR HomePage: 
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchKeyword: search.snapdo.com
CHR DefaultSearchProvider: Web
CHR DefaultSearchURL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUfY-qCWBcsCA2IlsBaak5pAHw7hPcIlhbvkZDLeOdnUCLoumjpKkr4AGfdEV-1IbrUMQJpg8DeZht3IKhRzlMy6Npv4uqs2aGxXdq1COfKlmrFL3qj6ifKJc95-9DQdk,&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Google Drive) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-07]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-07]
CHR Extension: (Google-Suche) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-07]
CHR Extension: (Google Wallet) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-07]
CHR Extension: (Google Mail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-08] (Hewlett-Packard Development Company, L.P.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-05-08] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-05-08] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [245832 2013-05-17] (Realtek Semiconductor)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [994360 2011-10-14] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [399416 2011-10-14] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation)
S2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [X]

==================== Drivers (Whitelisted) ====================

R3 Apowersoft_AudioDevice; C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-07-22] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 HtcVCom32; C:\Windows\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99800 2013-05-08] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [408136 2013-05-09] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2715208 2013-05-28] (Realtek Semiconductor Corporation                           )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [29424 2013-04-24] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-24] (Synaptics Incorporated)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-20 23:05 - 2014-05-20 23:12 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-20 23:05 - 2014-05-20 23:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-20 23:05 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-20 23:05 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-20 23:05 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-20 23:02 - 2014-05-20 23:18 - 00000620 _____ () C:\Users\Administrator\Desktop\JRT.txt
2014-05-20 22:54 - 2014-05-20 22:54 - 00004489 _____ () C:\Users\Administrator\Desktop\AdwCleaner[S0].txt
2014-05-20 22:50 - 2014-05-20 22:51 - 00000000 ____D () C:\AdwCleaner
2014-05-20 22:50 - 2014-05-20 22:50 - 01016261 _____ (Thisisu) C:\Users\Administrator\Desktop\JRT.exe
2014-05-20 22:50 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-20 22:48 - 2014-05-20 22:48 - 01326389 _____ () C:\Users\Administrator\Desktop\adwcleaner_3.210.exe
2014-05-20 22:41 - 2014-05-20 22:41 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-19 18:02 - 2014-05-19 18:02 - 00000000 _____ () C:\Users\Administrator\Desktop\v1JSftdc.txt
2014-05-18 19:27 - 2014-05-18 19:27 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Desktop\mbam-setup-2.0.1.1004.exe
2014-05-18 18:48 - 2014-05-18 18:48 - 00034799 _____ () C:\Users\Administrator\Desktop\ComboFix.txt
2014-05-18 16:27 - 2014-05-18 16:27 - 00034799 _____ () C:\ComboFix.txt
2014-05-18 16:10 - 2014-05-18 16:27 - 00000000 ____D () C:\Qoobox
2014-05-18 16:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-18 16:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-18 16:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-18 16:07 - 2014-05-18 16:08 - 05200990 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe
2014-05-18 15:41 - 2014-05-18 15:41 - 00001271 _____ () C:\Users\Administrator\Desktop\Revo Uninstaller.lnk
2014-05-18 15:01 - 2014-05-18 15:01 - 00384040 _____ () C:\Windows\Minidump\051814-20781-01.dmp
2014-05-17 15:54 - 2014-05-18 15:01 - 00000000 ____D () C:\Windows\Minidump
2014-05-17 15:54 - 2014-05-17 15:54 - 00294760 _____ () C:\Windows\Minidump\051714-37109-01.dmp
2014-05-17 15:53 - 2014-05-18 15:01 - 559241673 _____ () C:\Windows\MEMORY.DMP
2014-05-17 15:38 - 2014-05-17 15:41 - 00009091 _____ () C:\Users\Administrator\Desktop\Gmer.txt
2014-05-17 15:30 - 2014-05-17 15:30 - 00380416 _____ () C:\Users\Administrator\Desktop\Gmer-19357.exe
2014-05-17 15:29 - 2014-05-17 15:29 - 00032273 _____ () C:\Users\Administrator\Desktop\Addition.txt
2014-05-17 15:27 - 2014-05-20 23:20 - 00016702 _____ () C:\Users\Administrator\Desktop\FRST.txt
2014-05-17 15:26 - 2014-05-17 15:27 - 02067456 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64 (1).exe
2014-05-17 15:25 - 2014-05-17 15:25 - 02067456 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2014-05-17 15:23 - 2014-05-17 15:23 - 00000488 _____ () C:\Users\Administrator\Desktop\defogger_disable.log
2014-05-17 15:22 - 2014-05-17 15:22 - 00050477 _____ () C:\Users\Administrator\Desktop\Defogger.exe
2014-05-17 12:01 - 2014-05-20 23:20 - 00000000 ____D () C:\FRST
2014-05-17 11:55 - 2014-05-17 11:55 - 00000000 _____ () C:\Users\Administrator\defogger_reenable
2014-05-17 11:27 - 2014-05-17 11:27 - 00000000 ____D () C:\Program Files (x86)\12345TMP
2014-05-12 23:52 - 2014-05-13 00:08 - 00000000 ____D () C:\Users\Administrator\Desktop\Deep House
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diagram Designer
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Program Files (x86)\MeeSoft
2014-05-12 01:45 - 2014-05-12 01:45 - 00007859 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2014-05-10 20:22 - 2014-05-17 12:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide_Angle_Software
2014-05-10 20:22 - 2014-05-10 20:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide Angle Software
2014-05-03 23:18 - 2014-05-03 23:19 - 00000000 ____D () C:\Users\Administrator\Desktop\Halbschale
2014-05-03 22:26 - 2014-05-03 22:26 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2014-05-01 15:02 - 2014-05-01 15:03 - 00263884 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-05-01 14:37 - 2014-05-01 14:37 - 00000000 ____D () C:\Users\Administrator\Desktop\Dresden
2014-04-28 23:14 - 2014-04-28 23:14 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-04-27 13:45 - 2014-04-27 13:45 - 00000000 ____D () C:\Users\Administrator\Documents\Syncios
2014-04-25 18:09 - 2014-05-17 12:46 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-04-25 15:32 - 2014-05-17 11:21 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Samsung
2014-04-25 15:32 - 2014-05-17 11:21 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Samsung
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\Documents\samsung
2014-04-24 11:40 - 2014-04-24 11:47 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\HTC
2014-04-24 11:37 - 2014-04-24 11:40 - 00000000 ____D () C:\Users\Administrator\Documents\HTC
2014-04-24 11:35 - 2014-04-24 11:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Downloaded Installations
2014-04-23 17:35 - 2014-04-23 17:35 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-04-22 17:40 - 2014-04-22 17:47 - 00000000 ____D () C:\Users\Administrator\Documents\Apowersoft Free Screen Recorder
2014-04-22 17:39 - 2014-04-22 17:39 - 00001435 _____ () C:\Users\Public\Desktop\Apowersoft.lnk
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apowersoft
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Program Files (x86)\Apowersoft
2014-04-22 17:39 - 2013-06-02 04:56 - 00031920 _____ (Wondershare) C:\Windows\system32\Drivers\Apowersoft_AudioDevice.sys
2014-04-22 17:39 - 2013-06-01 20:07 - 00443568 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftScreenCapturing.dll
2014-04-22 17:39 - 2013-06-01 20:07 - 00271536 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftScreenCapturingFilter.dll
2014-04-22 17:39 - 2013-06-01 20:07 - 00181424 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftVideoMixerFilter.dll
2014-04-22 16:25 - 2014-04-22 16:25 - 00003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-20 14:20 - 2014-04-20 14:20 - 00004096 ____H () C:\Users\Administrator\AppData\Local\keyfile3.drm

==================== One Month Modified Files and Folders =======

2014-05-20 23:21 - 2014-05-17 15:27 - 00016702 _____ () C:\Users\Administrator\Desktop\FRST.txt
2014-05-20 23:21 - 2013-11-19 02:58 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-20 23:20 - 2014-05-17 12:01 - 00000000 ____D () C:\FRST
2014-05-20 23:18 - 2014-05-20 23:02 - 00000620 _____ () C:\Users\Administrator\Desktop\JRT.txt
2014-05-20 23:13 - 2013-11-09 15:04 - 01978230 _____ () C:\Windows\WindowsUpdate.log
2014-05-20 23:12 - 2014-05-20 23:05 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-20 23:12 - 2014-05-20 23:05 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-20 23:12 - 2014-03-30 18:27 - 00000000 ____D () C:\Users\Administrator\AppData\Local\CrashDumps
2014-05-20 23:05 - 2013-09-27 19:10 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1966542787-1984559558-3704198819-500
2014-05-20 23:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-05-20 22:58 - 2013-07-22 19:32 - 00831158 _____ () C:\Windows\system32\perfh007.dat
2014-05-20 22:58 - 2013-07-22 19:32 - 00188760 _____ () C:\Windows\system32\perfc007.dat
2014-05-20 22:58 - 2012-07-26 09:28 - 01952854 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-20 22:54 - 2014-05-20 22:54 - 00004489 _____ () C:\Users\Administrator\Desktop\AdwCleaner[S0].txt
2014-05-20 22:54 - 2013-12-07 12:17 - 00000000 ____D () C:\Users\Administrator\Documents\Youcam
2014-05-20 22:52 - 2012-08-04 00:23 - 01139988 _____ () C:\Windows\PFRO.log
2014-05-20 22:52 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-20 22:51 - 2014-05-20 22:50 - 00000000 ____D () C:\AdwCleaner
2014-05-20 22:51 - 2014-04-15 20:30 - 00001046 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-20 22:50 - 2014-05-20 22:50 - 01016261 _____ (Thisisu) C:\Users\Administrator\Desktop\JRT.exe
2014-05-20 22:48 - 2014-05-20 22:48 - 01326389 _____ () C:\Users\Administrator\Desktop\adwcleaner_3.210.exe
2014-05-20 22:41 - 2014-05-20 22:41 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-19 18:02 - 2014-05-19 18:02 - 00000000 _____ () C:\Users\Administrator\Desktop\v1JSftdc.txt
2014-05-18 19:27 - 2014-05-18 19:27 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Desktop\mbam-setup-2.0.1.1004.exe
2014-05-18 18:48 - 2014-05-18 18:48 - 00034799 _____ () C:\Users\Administrator\Desktop\ComboFix.txt
2014-05-18 16:27 - 2014-05-18 16:27 - 00034799 _____ () C:\ComboFix.txt
2014-05-18 16:27 - 2014-05-18 16:10 - 00000000 ____D () C:\Qoobox
2014-05-18 16:25 - 2012-07-26 07:26 - 00000215 _____ () C:\Windows\system.ini
2014-05-18 16:10 - 2014-03-02 12:29 - 00000000 ____D () C:\Windows\erdnt
2014-05-18 16:08 - 2014-05-18 16:07 - 05200990 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe
2014-05-18 15:41 - 2014-05-18 15:41 - 00001271 _____ () C:\Users\Administrator\Desktop\Revo Uninstaller.lnk
2014-05-18 15:41 - 2014-03-01 21:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-18 15:21 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-18 15:01 - 2014-05-18 15:01 - 00384040 _____ () C:\Windows\Minidump\051814-20781-01.dmp
2014-05-18 15:01 - 2014-05-17 15:54 - 00000000 ____D () C:\Windows\Minidump
2014-05-18 15:01 - 2014-05-17 15:53 - 559241673 _____ () C:\Windows\MEMORY.DMP
2014-05-17 19:19 - 2013-11-09 20:18 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-17 15:54 - 2014-05-17 15:54 - 00294760 _____ () C:\Windows\Minidump\051714-37109-01.dmp
2014-05-17 15:53 - 2014-03-16 19:19 - 00312832 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-17 15:41 - 2014-05-17 15:38 - 00009091 _____ () C:\Users\Administrator\Desktop\Gmer.txt
2014-05-17 15:30 - 2014-05-17 15:30 - 00380416 _____ () C:\Users\Administrator\Desktop\Gmer-19357.exe
2014-05-17 15:29 - 2014-05-17 15:29 - 00032273 _____ () C:\Users\Administrator\Desktop\Addition.txt
2014-05-17 15:27 - 2014-05-17 15:26 - 02067456 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64 (1).exe
2014-05-17 15:25 - 2014-05-17 15:25 - 02067456 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2014-05-17 15:23 - 2014-05-17 15:23 - 00000488 _____ () C:\Users\Administrator\Desktop\defogger_disable.log
2014-05-17 15:22 - 2014-05-17 15:22 - 00050477 _____ () C:\Users\Administrator\Desktop\Defogger.exe
2014-05-17 14:48 - 2013-12-07 12:14 - 00000000 ____D () C:\Users\Administrator
2014-05-17 14:24 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-05-17 14:05 - 2013-11-19 02:58 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-17 12:53 - 2013-11-09 15:05 - 00000000 ____D () C:\Users\Toool66
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-17 12:50 - 2014-03-31 22:15 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\streamripper
2014-05-17 12:50 - 2014-03-21 23:34 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mp3tag
2014-05-17 12:50 - 2014-03-19 23:59 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Winamp
2014-05-17 12:50 - 2013-12-07 12:15 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-17 12:50 - 2013-12-07 12:15 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-17 12:49 - 2014-04-06 13:42 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\BOM
2014-05-17 12:49 - 2014-04-05 21:38 - 00000000 ____D () C:\Users\Administrator\AppData\Local\gtk-2.0
2014-05-17 12:47 - 2014-03-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Mp3tag
2014-05-17 12:47 - 2013-11-22 21:20 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-17 12:47 - 2013-11-22 21:20 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-17 12:47 - 2013-11-10 16:21 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-05-17 12:47 - 2013-11-09 22:56 - 00000000 ____D () C:\Program Files (x86)\PKR
2014-05-17 12:47 - 2013-07-22 11:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft SkyDrive
2014-05-17 12:46 - 2014-04-25 18:09 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-05-17 12:40 - 2014-05-10 20:22 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide_Angle_Software
2014-05-17 12:37 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\registration
2014-05-17 12:35 - 2012-07-26 07:38 - 00000000 ____D () C:\Windows\system32\Sysprep
2014-05-17 11:55 - 2014-05-17 11:55 - 00000000 _____ () C:\Users\Administrator\defogger_reenable
2014-05-17 11:27 - 2014-05-17 11:27 - 00000000 ____D () C:\Program Files (x86)\12345TMP
2014-05-17 11:21 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Samsung
2014-05-17 11:21 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Samsung
2014-05-13 00:08 - 2014-05-12 23:52 - 00000000 ____D () C:\Users\Administrator\Desktop\Deep House
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diagram Designer
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Program Files (x86)\MeeSoft
2014-05-12 01:46 - 2014-04-05 21:36 - 00000000 ____D () C:\Users\Administrator\.gimp-2.8
2014-05-12 01:45 - 2014-05-12 01:45 - 00007859 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2014-05-10 20:35 - 2014-05-10 20:22 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide Angle Software
2014-05-04 12:06 - 2012-07-26 09:21 - 00074025 _____ () C:\Windows\setupact.log
2014-05-03 23:19 - 2014-05-03 23:18 - 00000000 ____D () C:\Users\Administrator\Desktop\Halbschale
2014-05-03 22:26 - 2014-05-03 22:26 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2014-05-02 10:51 - 2013-11-09 23:08 - 00000000 ____D () C:\Users\Toool66\Desktop\Sound div
2014-05-01 15:03 - 2014-05-01 15:02 - 00263884 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-05-01 14:37 - 2014-05-01 14:37 - 00000000 ____D () C:\Users\Administrator\Desktop\Dresden
2014-04-29 18:27 - 2014-03-17 23:21 - 00073112 _____ () C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-28 23:14 - 2014-04-28 23:14 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-04-27 13:45 - 2014-04-27 13:45 - 00000000 ____D () C:\Users\Administrator\Documents\Syncios
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\Documents\samsung
2014-04-24 19:04 - 2014-04-15 20:43 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-24 11:47 - 2014-04-24 11:40 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\HTC
2014-04-24 11:40 - 2014-04-24 11:37 - 00000000 ____D () C:\Users\Administrator\Documents\HTC
2014-04-24 11:37 - 2014-03-21 23:11 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Apple Computer
2014-04-24 11:37 - 2013-12-07 12:16 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apple Computer
2014-04-24 11:36 - 2013-09-27 17:19 - 00031028 _____ () C:\Windows\DPINST.LOG
2014-04-24 11:35 - 2014-04-24 11:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Downloaded Installations
2014-04-23 17:35 - 2014-04-23 17:35 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-04-22 17:47 - 2014-04-22 17:40 - 00000000 ____D () C:\Users\Administrator\Documents\Apowersoft Free Screen Recorder
2014-04-22 17:39 - 2014-04-22 17:39 - 00001435 _____ () C:\Users\Public\Desktop\Apowersoft.lnk
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apowersoft
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Program Files (x86)\Apowersoft
2014-04-22 16:27 - 2014-04-18 20:29 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\vlc
2014-04-22 16:25 - 2014-04-22 16:25 - 00003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-20 14:20 - 2014-04-20 14:20 - 00004096 ____H () C:\Users\Administrator\AppData\Local\keyfile3.drm

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\temp\avgnt.exe
C:\Users\Administrator\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 18:12

==================== End Of Log ============================
         

--- --- ---

--- --- ---



Danke und Gruß
Han-Jürgen

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Hallo,

habe alles wie angegeben ausgeführt. Anbei die Logfiles:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=de325d1533a0574fbbb282c2517aa3de
# engine=18354
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-21 04:50:45
# local_time=2014-05-21 06:50:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode=1799 16775165 100 94 71571 19262203 64343 0
# compatibility_mode=5893 16776574 100 88 367039 18036974 0 0
# scanned=62200
# found=0
# cleaned=0
# scan_time=1484
         

 Results of screen317's Security Check version 0.99.83  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
 WMI entry may not exist for antivirus; attempting automatic update. 
 Avira successfully updated! 
`````````Anti-malware/Other Utilities Check:````````` 
 SpywareBlaster 5.0    
 Secunia PSI (2.0.0.4003)   
 Adobe Flash Player 	13.0.0.214  
 Adobe Reader XI  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

und das neue FRST:


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Administrator (administrator) on KILLERBOYPC on 21-05-2014 19:03:49
Running from C:\Users\Administrator\Desktop
Platform: Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188552 2013-05-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3053808 2013-04-24] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-05-22] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [77088 2013-07-24] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\Windows\SysWOW64\nvinit.dll => c:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs-x32:  C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
Startup: C:\Users\Toool66\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareBlaster.lnk
ShortcutTarget: SpywareBlaster.lnk -> C:\Program Files (x86)\SpywareBlaster\spywareblaster.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {995F4BA9-CC4A-41A0-B361-FA996141DF9F} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-11-12]

Chrome: 
=======
CHR HomePage: 
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchKeyword: search.snapdo.com
CHR DefaultSearchProvider: Web
CHR DefaultSearchURL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUfY-qCWBcsCA2IlsBaak5pAHw7hPcIlhbvkZDLeOdnUCLoumjpKkr4AGfdEV-1IbrUMQJpg8DeZht3IKhRzlMy6Npv4uqs2aGxXdq1COfKlmrFL3qj6ifKJc95-9DQdk,&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Google Drive) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-07]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-07]
CHR Extension: (Google-Suche) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-07]
CHR Extension: (Google Wallet) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-07]
CHR Extension: (Google Mail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-08] (Hewlett-Packard Development Company, L.P.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-05-08] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-05-08] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [245832 2013-05-17] (Realtek Semiconductor)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [994360 2011-10-14] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [399416 2011-10-14] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation)
S2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [X]

==================== Drivers (Whitelisted) ====================

R3 Apowersoft_AudioDevice; C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-07-22] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 HtcVCom32; C:\Windows\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99800 2013-05-08] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [408136 2013-05-09] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2715208 2013-05-28] (Realtek Semiconductor Corporation                           )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [29424 2013-04-24] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-24] (Synaptics Incorporated)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-21 19:03 - 2014-05-21 19:03 - 00016702 _____ () C:\Users\Administrator\Desktop\FRST.txt
2014-05-21 19:03 - 2014-05-21 19:03 - 00000000 ____D () C:\ Malwarebytes Anti-Malware 
2014-05-21 19:01 - 2014-05-21 19:01 - 00000792 _____ () C:\Users\Administrator\Desktop\checkup.txt
2014-05-21 18:55 - 2014-05-21 18:55 - 00854367 _____ () C:\Users\Administrator\Desktop\SecurityCheck.exe
2014-05-20 23:22 - 2014-05-20 23:22 - 00036081 _____ () C:\Users\Administrator\Desktop\FRST2.txt
2014-05-20 23:05 - 2014-05-21 19:03 - 00000708 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-20 23:05 - 2014-05-20 23:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-20 23:05 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-20 23:05 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-20 23:05 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-20 23:02 - 2014-05-20 23:18 - 00000620 _____ () C:\Users\Administrator\Desktop\JRT.txt
2014-05-20 22:54 - 2014-05-20 22:54 - 00004489 _____ () C:\Users\Administrator\Desktop\AdwCleaner[S0].txt
2014-05-20 22:50 - 2014-05-20 22:51 - 00000000 ____D () C:\AdwCleaner
2014-05-20 22:50 - 2014-05-20 22:50 - 01016261 _____ (Thisisu) C:\Users\Administrator\Desktop\JRT.exe
2014-05-20 22:50 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-20 22:48 - 2014-05-20 22:48 - 01326389 _____ () C:\Users\Administrator\Desktop\adwcleaner_3.210.exe
2014-05-20 22:41 - 2014-05-20 22:41 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-19 18:02 - 2014-05-19 18:02 - 00000000 _____ () C:\Users\Administrator\Desktop\v1JSftdc.txt
2014-05-18 19:27 - 2014-05-18 19:27 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Desktop\mbam-setup-2.0.1.1004.exe
2014-05-18 18:48 - 2014-05-18 18:48 - 00034799 _____ () C:\Users\Administrator\Desktop\ComboFix.txt
2014-05-18 16:27 - 2014-05-18 16:27 - 00034799 _____ () C:\ComboFix.txt
2014-05-18 16:10 - 2014-05-18 16:27 - 00000000 ____D () C:\Qoobox
2014-05-18 16:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-18 16:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-18 16:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-18 16:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-18 16:07 - 2014-05-18 16:08 - 05200990 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe
2014-05-18 15:41 - 2014-05-18 15:41 - 00001271 _____ () C:\Users\Administrator\Desktop\Revo Uninstaller.lnk
2014-05-18 15:01 - 2014-05-18 15:01 - 00384040 _____ () C:\Windows\Minidump\051814-20781-01.dmp
2014-05-17 15:54 - 2014-05-18 15:01 - 00000000 ____D () C:\Windows\Minidump
2014-05-17 15:54 - 2014-05-17 15:54 - 00294760 _____ () C:\Windows\Minidump\051714-37109-01.dmp
2014-05-17 15:53 - 2014-05-18 15:01 - 559241673 _____ () C:\Windows\MEMORY.DMP
2014-05-17 15:38 - 2014-05-17 15:41 - 00009091 _____ () C:\Users\Administrator\Desktop\Gmer.txt
2014-05-17 15:30 - 2014-05-17 15:30 - 00380416 _____ () C:\Users\Administrator\Desktop\Gmer-19357.exe
2014-05-17 15:29 - 2014-05-17 15:29 - 00032273 _____ () C:\Users\Administrator\Desktop\Addition.txt
2014-05-17 15:27 - 2014-05-20 23:21 - 00036081 _____ () C:\Users\Administrator\Desktop\FRST1.txt
2014-05-17 15:26 - 2014-05-17 15:27 - 02067456 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64 (1).exe
2014-05-17 15:25 - 2014-05-17 15:25 - 02067456 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2014-05-17 15:23 - 2014-05-17 15:23 - 00000488 _____ () C:\Users\Administrator\Desktop\defogger_disable.log
2014-05-17 15:22 - 2014-05-17 15:22 - 00050477 _____ () C:\Users\Administrator\Desktop\Defogger.exe
2014-05-17 12:01 - 2014-05-21 19:03 - 00000000 ____D () C:\FRST
2014-05-17 11:55 - 2014-05-17 11:55 - 00000000 _____ () C:\Users\Administrator\defogger_reenable
2014-05-17 11:27 - 2014-05-17 11:27 - 00000000 ____D () C:\Program Files (x86)\12345TMP
2014-05-12 23:52 - 2014-05-13 00:08 - 00000000 ____D () C:\Users\Administrator\Desktop\Deep House
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diagram Designer
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Program Files (x86)\MeeSoft
2014-05-12 01:45 - 2014-05-12 01:45 - 00007859 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2014-05-10 20:22 - 2014-05-17 12:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide_Angle_Software
2014-05-10 20:22 - 2014-05-10 20:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide Angle Software
2014-05-03 23:18 - 2014-05-03 23:19 - 00000000 ____D () C:\Users\Administrator\Desktop\Halbschale
2014-05-03 22:26 - 2014-05-03 22:26 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2014-05-01 15:02 - 2014-05-01 15:03 - 00263884 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-05-01 14:37 - 2014-05-01 14:37 - 00000000 ____D () C:\Users\Administrator\Desktop\Dresden
2014-04-28 23:14 - 2014-04-28 23:14 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-04-27 13:45 - 2014-04-27 13:45 - 00000000 ____D () C:\Users\Administrator\Documents\Syncios
2014-04-25 18:09 - 2014-05-17 12:46 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-04-25 15:32 - 2014-05-17 11:21 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Samsung
2014-04-25 15:32 - 2014-05-17 11:21 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Samsung
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\Documents\samsung
2014-04-24 11:40 - 2014-04-24 11:47 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\HTC
2014-04-24 11:37 - 2014-04-24 11:40 - 00000000 ____D () C:\Users\Administrator\Documents\HTC
2014-04-24 11:35 - 2014-04-24 11:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Downloaded Installations
2014-04-23 17:35 - 2014-04-23 17:35 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-04-22 17:40 - 2014-04-22 17:47 - 00000000 ____D () C:\Users\Administrator\Documents\Apowersoft Free Screen Recorder
2014-04-22 17:39 - 2014-04-22 17:39 - 00001435 _____ () C:\Users\Public\Desktop\Apowersoft.lnk
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apowersoft
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Program Files (x86)\Apowersoft
2014-04-22 17:39 - 2013-06-02 04:56 - 00031920 _____ (Wondershare) C:\Windows\system32\Drivers\Apowersoft_AudioDevice.sys
2014-04-22 17:39 - 2013-06-01 20:07 - 00443568 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftScreenCapturing.dll
2014-04-22 17:39 - 2013-06-01 20:07 - 00271536 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftScreenCapturingFilter.dll
2014-04-22 17:39 - 2013-06-01 20:07 - 00181424 ____H (Bytescout) C:\Windows\SysWOW64\ApowersoftVideoMixerFilter.dll
2014-04-22 16:25 - 2014-04-22 16:25 - 00003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== One Month Modified Files and Folders =======

2014-05-21 19:04 - 2014-05-21 19:03 - 00016702 _____ () C:\Users\Administrator\Desktop\FRST.txt
2014-05-21 19:03 - 2014-05-21 19:03 - 00000000 ____D () C:\ Malwarebytes Anti-Malware 
2014-05-21 19:03 - 2014-05-20 23:05 - 00000708 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-21 19:03 - 2014-05-17 12:01 - 00000000 ____D () C:\FRST
2014-05-21 19:03 - 2014-03-30 18:27 - 00000000 ____D () C:\Users\Administrator\AppData\Local\CrashDumps
2014-05-21 19:02 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-05-21 19:01 - 2014-05-21 19:01 - 00000792 _____ () C:\Users\Administrator\Desktop\checkup.txt
2014-05-21 18:55 - 2014-05-21 18:55 - 00854367 _____ () C:\Users\Administrator\Desktop\SecurityCheck.exe
2014-05-21 18:29 - 2013-11-09 15:04 - 01051748 _____ () C:\Windows\WindowsUpdate.log
2014-05-21 18:21 - 2013-11-19 02:58 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-21 17:52 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-05-21 17:51 - 2013-11-16 22:24 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-21 17:51 - 2013-11-16 22:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-21 17:51 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-21 17:47 - 2013-09-27 19:10 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1966542787-1984559558-3704198819-500
2014-05-21 17:38 - 2013-07-22 19:32 - 00831158 _____ () C:\Windows\system32\perfh007.dat
2014-05-21 17:38 - 2013-07-22 19:32 - 00188760 _____ () C:\Windows\system32\perfc007.dat
2014-05-21 17:38 - 2012-07-26 09:28 - 01952854 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-21 17:35 - 2013-12-07 12:17 - 00000000 ____D () C:\Users\Administrator\Documents\Youcam
2014-05-20 23:22 - 2014-05-20 23:22 - 00036081 _____ () C:\Users\Administrator\Desktop\FRST2.txt
2014-05-20 23:21 - 2014-05-17 15:27 - 00036081 _____ () C:\Users\Administrator\Desktop\FRST1.txt
2014-05-20 23:18 - 2014-05-20 23:02 - 00000620 _____ () C:\Users\Administrator\Desktop\JRT.txt
2014-05-20 23:12 - 2014-05-20 23:05 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-20 22:54 - 2014-05-20 22:54 - 00004489 _____ () C:\Users\Administrator\Desktop\AdwCleaner[S0].txt
2014-05-20 22:52 - 2012-08-04 00:23 - 01139988 _____ () C:\Windows\PFRO.log
2014-05-20 22:52 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-20 22:51 - 2014-05-20 22:50 - 00000000 ____D () C:\AdwCleaner
2014-05-20 22:51 - 2014-04-15 20:30 - 00001046 _____ () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-20 22:50 - 2014-05-20 22:50 - 01016261 _____ (Thisisu) C:\Users\Administrator\Desktop\JRT.exe
2014-05-20 22:48 - 2014-05-20 22:48 - 01326389 _____ () C:\Users\Administrator\Desktop\adwcleaner_3.210.exe
2014-05-20 22:41 - 2014-05-20 22:41 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-19 18:02 - 2014-05-19 18:02 - 00000000 _____ () C:\Users\Administrator\Desktop\v1JSftdc.txt
2014-05-18 19:27 - 2014-05-18 19:27 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Desktop\mbam-setup-2.0.1.1004.exe
2014-05-18 18:48 - 2014-05-18 18:48 - 00034799 _____ () C:\Users\Administrator\Desktop\ComboFix.txt
2014-05-18 16:27 - 2014-05-18 16:27 - 00034799 _____ () C:\ComboFix.txt
2014-05-18 16:27 - 2014-05-18 16:10 - 00000000 ____D () C:\Qoobox
2014-05-18 16:25 - 2012-07-26 07:26 - 00000215 _____ () C:\Windows\system.ini
2014-05-18 16:10 - 2014-03-02 12:29 - 00000000 ____D () C:\Windows\erdnt
2014-05-18 16:08 - 2014-05-18 16:07 - 05200990 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe
2014-05-18 15:41 - 2014-05-18 15:41 - 00001271 _____ () C:\Users\Administrator\Desktop\Revo Uninstaller.lnk
2014-05-18 15:41 - 2014-03-01 21:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-18 15:21 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-18 15:01 - 2014-05-18 15:01 - 00384040 _____ () C:\Windows\Minidump\051814-20781-01.dmp
2014-05-18 15:01 - 2014-05-17 15:54 - 00000000 ____D () C:\Windows\Minidump
2014-05-18 15:01 - 2014-05-17 15:53 - 559241673 _____ () C:\Windows\MEMORY.DMP
2014-05-17 19:19 - 2013-11-09 20:18 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-17 15:54 - 2014-05-17 15:54 - 00294760 _____ () C:\Windows\Minidump\051714-37109-01.dmp
2014-05-17 15:53 - 2014-03-16 19:19 - 00312832 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-17 15:41 - 2014-05-17 15:38 - 00009091 _____ () C:\Users\Administrator\Desktop\Gmer.txt
2014-05-17 15:30 - 2014-05-17 15:30 - 00380416 _____ () C:\Users\Administrator\Desktop\Gmer-19357.exe
2014-05-17 15:29 - 2014-05-17 15:29 - 00032273 _____ () C:\Users\Administrator\Desktop\Addition.txt
2014-05-17 15:27 - 2014-05-17 15:26 - 02067456 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64 (1).exe
2014-05-17 15:25 - 2014-05-17 15:25 - 02067456 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2014-05-17 15:23 - 2014-05-17 15:23 - 00000488 _____ () C:\Users\Administrator\Desktop\defogger_disable.log
2014-05-17 15:22 - 2014-05-17 15:22 - 00050477 _____ () C:\Users\Administrator\Desktop\Defogger.exe
2014-05-17 14:48 - 2013-12-07 12:14 - 00000000 ____D () C:\Users\Administrator
2014-05-17 14:05 - 2013-11-19 02:58 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-17 12:53 - 2013-11-09 15:05 - 00000000 ____D () C:\Users\Toool66
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-17 12:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-17 12:50 - 2014-03-31 22:15 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\streamripper
2014-05-17 12:50 - 2014-03-21 23:34 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mp3tag
2014-05-17 12:50 - 2014-03-19 23:59 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Winamp
2014-05-17 12:50 - 2013-12-07 12:15 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-17 12:50 - 2013-12-07 12:15 - 00000000 ___RD () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-17 12:49 - 2014-04-06 13:42 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\BOM
2014-05-17 12:49 - 2014-04-05 21:38 - 00000000 ____D () C:\Users\Administrator\AppData\Local\gtk-2.0
2014-05-17 12:47 - 2014-03-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Mp3tag
2014-05-17 12:47 - 2013-11-22 21:20 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-17 12:47 - 2013-11-22 21:20 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-17 12:47 - 2013-11-10 16:21 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-05-17 12:47 - 2013-11-09 22:56 - 00000000 ____D () C:\Program Files (x86)\PKR
2014-05-17 12:47 - 2013-07-22 11:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft SkyDrive
2014-05-17 12:46 - 2014-04-25 18:09 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-05-17 12:40 - 2014-05-10 20:22 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide_Angle_Software
2014-05-17 12:37 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\registration
2014-05-17 12:35 - 2012-07-26 07:38 - 00000000 ____D () C:\Windows\system32\Sysprep
2014-05-17 11:55 - 2014-05-17 11:55 - 00000000 _____ () C:\Users\Administrator\defogger_reenable
2014-05-17 11:27 - 2014-05-17 11:27 - 00000000 ____D () C:\Program Files (x86)\12345TMP
2014-05-17 11:21 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Samsung
2014-05-17 11:21 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Samsung
2014-05-13 00:08 - 2014-05-12 23:52 - 00000000 ____D () C:\Users\Administrator\Desktop\Deep House
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diagram Designer
2014-05-12 01:49 - 2014-05-12 01:49 - 00000000 ____D () C:\Program Files (x86)\MeeSoft
2014-05-12 01:46 - 2014-04-05 21:36 - 00000000 ____D () C:\Users\Administrator\.gimp-2.8
2014-05-12 01:45 - 2014-05-12 01:45 - 00007859 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2014-05-10 20:35 - 2014-05-10 20:22 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Wide Angle Software
2014-05-04 12:06 - 2012-07-26 09:21 - 00074025 _____ () C:\Windows\setupact.log
2014-05-03 23:19 - 2014-05-03 23:18 - 00000000 ____D () C:\Users\Administrator\Desktop\Halbschale
2014-05-03 22:26 - 2014-05-03 22:26 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2014-05-02 10:51 - 2013-11-09 23:08 - 00000000 ____D () C:\Users\Toool66\Desktop\Sound div
2014-05-01 15:03 - 2014-05-01 15:02 - 00263884 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-05-01 14:37 - 2014-05-01 14:37 - 00000000 ____D () C:\Users\Administrator\Desktop\Dresden
2014-04-29 18:27 - 2014-03-17 23:21 - 00073112 _____ () C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-28 23:14 - 2014-04-28 23:14 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-04-27 13:45 - 2014-04-27 13:45 - 00000000 ____D () C:\Users\Administrator\Documents\Syncios
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-04-25 15:32 - 2014-04-25 15:32 - 00000000 ____D () C:\Users\Administrator\Documents\samsung
2014-04-24 19:04 - 2014-04-15 20:43 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-24 11:47 - 2014-04-24 11:40 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\HTC
2014-04-24 11:40 - 2014-04-24 11:37 - 00000000 ____D () C:\Users\Administrator\Documents\HTC
2014-04-24 11:37 - 2014-03-21 23:11 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Apple Computer
2014-04-24 11:37 - 2013-12-07 12:16 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apple Computer
2014-04-24 11:36 - 2013-09-27 17:19 - 00031028 _____ () C:\Windows\DPINST.LOG
2014-04-24 11:35 - 2014-04-24 11:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Downloaded Installations
2014-04-23 17:35 - 2014-04-23 17:35 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-04-22 17:47 - 2014-04-22 17:40 - 00000000 ____D () C:\Users\Administrator\Documents\Apowersoft Free Screen Recorder
2014-04-22 17:39 - 2014-04-22 17:39 - 00001435 _____ () C:\Users\Public\Desktop\Apowersoft.lnk
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Apowersoft
2014-04-22 17:39 - 2014-04-22 17:39 - 00000000 ____D () C:\Program Files (x86)\Apowersoft
2014-04-22 16:27 - 2014-04-18 20:29 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\vlc
2014-04-22 16:25 - 2014-04-22 16:25 - 00003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\temp\avgnt.exe
C:\Users\Administrator\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 18:12

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Danke und Gruß
Hans-Jürgen

Hi,


hier noch eine Anmerkung:

Ich hatte das Gefühl, dass der Scan von Eset relativ schnell ging (Es hängt ja auch noch meine Externe Festplatte dran). Habe aber keine Erfahrung und kann nicht irklich sagen, ob die Dauer normal oder zu kurz war. Er war fertig al der Rechner in Energiesparmodus gegangen ist und ich Enter gedrückt habe.

Nach dem aktuellen Neustart habe ich übrigens plötzlich ein neues Icon "Heimnetzgruppe" auf meinem Desktop. Ob das was zu bedeuten hat kann ich leider nicht sagen...

Oh mann ....


Danke und Gruß
Hans-Jürgen

Das icon kannste einfach löschen.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hallo Schrauber,

zunächst einmal vielen Dank für deine Geduld und die Hilfe.

Leider bestehen weiterhin folgende Probleme:

Nachdem ich die Windows Updates wieder aktiviert hatte und auch gleich das erste Update gelaufen war war die Fixlog.txt vom Desktop verschwunden

Das Windows Wartungscenter sagt immer noch, dass der Windows Defender deaktiviert ist und sowohl "Virenschutz" als auch "Schutz vor Spyware" sind deaktiviert. Das drücken auf den "jetzt aktivieren" Button führt in beiden Fällen lediglich dazu, dass ein Explorer Fenster mit dem Verzeichnis c:\Windows\System32 auf geht. Hierin ist - neben allen anderen Ordnern und Dateien- ausschiesslich der Ordner "DRVSTORE" in blauer Schrift zu sehen. ???

Weiterhin lässt sich Malwarebytes nicht Installieren; auch nicht nach Deinstallation und neustart

Es kommen nach wie vor die oben beschriebenen Fehlermeldung.

Alles andere habe ich soweit gemacht....



((

Danke und Gruß
Hans-Jürgen

Mach das mal bitte:
http://www.trojaner-board.de/126216-...epair-aio.html

Hi,

wenn ich mir das Logfile so anschaue habe ich den Eindruck es hat hier so einiges zerschossen ??

Mittlerweile habe ich es geschafft malwarebytes über chameleon zu installieren.

Dann habe ich mir gedacht es wäre evt. hilfreich Avira zu deinstallieren und neu zu installieren in der Hoffung der Windows Defender würde sich wieder neu aufsetzen. Deinstallation war Erfolgreich, neu installieren lässt es sich nicht -> Installationsfehler - na super

Hier mal das Logfile vom Winrepair:

System Variables
--------------------------------------------------------------------------------
OS: Windows 8
OS Architecture: 64-bit
OS Version: 6.2.9200
OS Service Pack: 
Computer Name: KILLERBOYPC
Windows Drive: C:\
Windows Path: C:\Windows
Current Profile: C:\Users\Administrator
Current Profile SID: S-1-5-21-1966542787-1984559558-3704198819-500
Current Profile Classes: S-1-5-21-1966542787-1984559558-3704198819-500_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\Administrator\AppData\Local
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 0 Days 00:46:37

Process Count: 82
Commit Total: 1,67 GB
Commit Limit: 15,78 GB
Commit Peak: 2,85 GB
Handle Count: 20366
Kernel Total: 521,73 MB
Kernel Paged: 374,96 MB
Kernel Non Paged: 146,78 MB
System Cache: 6,00 GB
Thread Count: 768
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 7,78 GB
Memory Used: 1,55 GB(19,8968%)
Memory Avail.: 6,23 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 7,78 GB
Memory Used: 1,26 GB(16,2485%)
Memory Avail.: 6,51 GB
--------------------------------------------------------------------------------

Starting Repairs...
   Start (24.05.2014 00:23:08)

01 - Reset Registry Permissions 01/03
   HKEY_CURRENT_USER & Sub Keys
   Start (24.05.2014 00:23:11)
   Running Repair Under Current User Account
   Done (24.05.2014 00:23:17)

01 - Reset Registry Permissions 02/03
   HKEY_LOCAL_MACHINE & Sub Keys
   Start (24.05.2014 00:23:17)
   Running Repair Under System Account
   Done (24.05.2014 00:24:26)

01 - Reset Registry Permissions 03/03
   HKEY_CLASSES_ROOT & Sub Keys
   Start (24.05.2014 00:24:26)
   Running Repair Under System Account
   Done (24.05.2014 00:24:48)

02 - Reset File Permissions: C:
   C: & Sub Folders
   Start (24.05.2014 00:24:48)
   Running Repair Under System Account
   Done (24.05.2014 00:33:31)

02 - Reset File Permissions: D:
   D: & Sub Folders
   Start (24.05.2014 00:33:31)
   Running Repair Under System Account
   Done (24.05.2014 00:33:42)

02 - Reset File Permissions: All Profiles
   C:\Users & Sub Folders
   Start (24.05.2014 00:33:42)
   Running Repair Under System Account
   Done (24.05.2014 00:35:08)

02 - Reset File Permissions: Current Profile
   C:\Users\Administrator & Sub Folders
   Start (24.05.2014 00:35:08)
   Running Repair Under System Account
   Done (24.05.2014 00:35:16)

02 - Reset File Permissions: Cleanup
   Repairing Restricted Folders Permissions To Avoid Infinite Loops
   Start (24.05.2014 00:35:16)
   Running Repair Under System Account
Processing ACL of: <\\?\C:\Documents and Settings>
Reading the SD from <\\?\C:\Documents and Settings> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\ProgramData\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Desktop>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Documents>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Favorites>
Reading the SD from <\\?\C:\ProgramData\Favorites> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\ProgramData\Start Menu>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Templates>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\All Users\Application Data>
Reading the SD from <\\?\C:\Users\All Users\Application Data> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\All Users\Desktop>
Reading the SD from <\\?\C:\Users\All Users\Desktop> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\All Users\Documents>
Reading the SD from <\\?\C:\Users\All Users\Documents> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\All Users\Favorites>
Reading the SD from <\\?\C:\Users\All Users\Favorites> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\All Users\Start Menu>
Reading the SD from <\\?\C:\Users\All Users\Start Menu> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\All Users\Templates>
Reading the SD from <\\?\C:\Users\All Users\Templates> failed with: Das System kann den angegebenen Pfad nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann den angegebenen Pfad nicht finden.

Processing ACL of: <\\?\C:\Users\Default User>
Reading the SD from <\\?\C:\Users\Default User> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Default\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Cookies>
Reading the SD from <\\?\C:\Users\Default\Cookies> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Default\Local Settings>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\My Documents>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\NetHood>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\PrintHood>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Recent>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\SendTo>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Start Menu>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Templates>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\History>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\Temporary Internet Files>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Music>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Pictures>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Videos>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Public\Documents\My Music>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Public\Documents\My Pictures>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Public\Documents\My Videos>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Administrator\Application Data>
Reading the SD from <\\?\C:\Users\Administrator\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Cookies>
Reading the SD from <\\?\C:\Users\Administrator\Cookies> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Local Settings>
Reading the SD from <\\?\C:\Users\Administrator\Local Settings> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\My Documents>
Reading the SD from <\\?\C:\Users\Administrator\My Documents> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\NetHood>
Reading the SD from <\\?\C:\Users\Administrator\NetHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\PrintHood>
Reading the SD from <\\?\C:\Users\Administrator\PrintHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Recent>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Administrator\SendTo>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Administrator\Start Menu>
Reading the SD from <\\?\C:\Users\Administrator\Start Menu> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Templates>
Reading the SD from <\\?\C:\Users\Administrator\Templates> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\AppData\Local\Application Data>
Reading the SD from <\\?\C:\Users\Administrator\AppData\Local\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\AppData\Local\History>
Reading the SD from <\\?\C:\Users\Administrator\AppData\Local\History> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\AppData\Local\Temporary Internet Files>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Administrator\Documents\My Music>
Reading the SD from <\\?\C:\Users\Administrator\Documents\My Music> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Documents\My Pictures>
Reading the SD from <\\?\C:\Users\Administrator\Documents\My Pictures> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Administrator\Documents\My Videos>
Reading the SD from <\\?\C:\Users\Administrator\Documents\My Videos> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\Application Data>
Reading the SD from <\\?\C:\Users\Toool66\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\Cookies>
Reading the SD from <\\?\C:\Users\Toool66\Cookies> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\Local Settings>
Reading the SD from <\\?\C:\Users\Toool66\Local Settings> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\My Documents>
Reading the SD from <\\?\C:\Users\Toool66\My Documents> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\NetHood>
Reading the SD from <\\?\C:\Users\Toool66\NetHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\PrintHood>
Reading the SD from <\\?\C:\Users\Toool66\PrintHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\Recent>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Toool66\SendTo>
Reading the SD from <\\?\C:\Users\Toool66\SendTo> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\Start Menu>
Reading the SD from <\\?\C:\Users\Toool66\Start Menu> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\Templates>
Reading the SD from <\\?\C:\Users\Toool66\Templates> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\AppData\Local\Application Data>
Reading the SD from <\\?\C:\Users\Toool66\AppData\Local\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\AppData\Local\History>
Reading the SD from <\\?\C:\Users\Toool66\AppData\Local\History> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\AppData\Local\Temporary Internet Files>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Toool66\Documents\My Music>
Reading the SD from <\\?\C:\Users\Toool66\Documents\My Music> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\Documents\My Pictures>
Reading the SD from <\\?\C:\Users\Toool66\Documents\My Pictures> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Toool66\Documents\My Videos>
Reading the SD from <\\?\C:\Users\Toool66\Documents\My Videos> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

   Done (24.05.2014 00:35:23)

03 - Register System Files
   Start (24.05.2014 00:35:23)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:36:15)

04 - Repair WMI
   Start (24.05.2014 00:36:15)

   Starting Security Center So We Can Export The Security Info.

   Exporting Antivirus Info...
   No Antivirus Products Reported.

   Exporting AntiSpyware Info...
   No AntiSpyware Products Reported.

   Exporting 3rd Party Firewall Info...
   No Firewall Products Reported.

   Running Repair Under Current User Account
   Done (24.05.2014 00:41:14)

05 - Repair Windows Firewall
   Start (24.05.2014 00:41:14)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:41:49)

06 - Repair Internet Explorer
   Start (24.05.2014 00:41:49)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:42:24)

07 - Repair MDAC/MS Jet
   Start (24.05.2014 00:42:25)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:42:41)

08 - Repair Hosts File
   Start (24.05.2014 00:42:41)
   Running Repair Under System Account
   Done (24.05.2014 00:42:44)

09 - Remove Policies Set By Infections
   Start (24.05.2014 00:42:44)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:42:48)

10 - Repair Start Menu Icons Removed By Infections
   Start (24.05.2014 00:42:48)
   Running Repair Under System Account
   Done (24.05.2014 00:42:51)

11 - Repair Icons
   Start (24.05.2014 00:42:51)
   Running Repair Under Current User Account
   Done (24.05.2014 00:42:53)

12 - Repair Winsock & DNS Cache
   Start (24.05.2014 00:42:53)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:43:08)

13 - Remove Temp Files
   Start (24.05.2014 00:43:08)
   Running Repair Under System Account
   Done (24.05.2014 00:43:11)

14 - Repair Proxy Settings
   Start (24.05.2014 00:43:11)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:43:15)

15 - Unhide Non System Files
   Start (24.05.2014 00:43:15)
   C:\ - Total Files Unhidden: 798 - Check Unhidden_Files.txt for list of files unhidden
   D:\ - Total Files Unhidden: 0 - Check Unhidden_Files.txt for list of files unhidden
   Done (24.05.2014 00:43:45)

16 - Repair Windows Updates
   Start (24.05.2014 00:43:45)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:02)

17 - Repair CD/DVD Missing/Not Working
   Start (24.05.2014 00:44:02)
   iTunes was found, adding UpperFilters for iTunes Reg Key
   UpperFilters added?: Wahr
   Done (24.05.2014 00:44:02)

18 - Repair Volume Shadow Copy Service
   Start (24.05.2014 00:44:02)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:09)

19 - Repair Windows Sidebar/Gadgets
   Start (24.05.2014 00:44:09)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:13)

20 - Repair MSI (Windows Installer)
   Start (24.05.2014 00:44:14)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:22)

21 - Repair Windows Snipping Tool
   Start (24.05.2014 00:44:22)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:27)

22.01 - Repair bat Association
   Start (24.05.2014 00:44:27)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:32)

22.02 - Repair cmd Association
   Start (24.05.2014 00:44:32)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:36)

22.03 - Repair com Association
   Start (24.05.2014 00:44:36)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:41)

22.04 - Repair Directory Association
   Start (24.05.2014 00:44:41)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:46)

22.05 - Repair Drive Association
   Start (24.05.2014 00:44:46)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:51)

22.06 - Repair exe Association
   Start (24.05.2014 00:44:51)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:44:55)

22.07 - Repair Folder Association
   Start (24.05.2014 00:44:55)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:00)

22.08 - Repair inf Association
   Start (24.05.2014 00:45:00)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:05)

22.09 - Repair lnk (Shortcuts) Association
   Start (24.05.2014 00:45:05)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:10)

22.10 - Repair msc Association
   Start (24.05.2014 00:45:10)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:14)

22.11 - Repair reg Association
   Start (24.05.2014 00:45:14)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:19)

22.12 - Repair scr Association
   Start (24.05.2014 00:45:19)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:24)

23 - Repair Windows Safe Mode
   Start (24.05.2014 00:45:24)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:29)

24 - Repair Print Spooler
   Start (24.05.2014 00:45:29)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:41)

25 - Restore Important Windows Services
   Start (24.05.2014 00:45:41)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:45:58)

26 - Set Windows Services To Default Startup
   Start (24.05.2014 00:45:58)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (24.05.2014 00:46:03)

27 - Repair Windows 8 App Store
   Start (24.05.2014 00:46:03)
   Running Repair Under System Account
   Running Repair Under Current User Account
   Done (24.05.2014 00:46:24)

28 - Repair Windows 8 Component Store
   Start (24.05.2014 00:46:24)
   Running Repair Under Current User Account
   Done (24.05.2014 01:17:42)

29 - Restore Windows 8 COM+ Unmarshalers
   Start (24.05.2014 01:17:42)
   Running Repair Under System Account
   Done (24.05.2014 01:17:44)

Cleaning up empty logs...

All Selected Repairs Done.
   Done (24.05.2014 01:17:44)
   Total Repair Time: 00:54:38


...YOU MUST RESTART YOUR SYSTEM...
   Running Repair Under Current User Account
         

Mittlerweile denke ich es wäre vielleicht das Beste den Rechner neu aufsetzen zu lassen und Windows komplett neu zu installieren.
Naja, früher unter Dos konnte man das ja noch selbst machen. Heute würde ich ihn wohl wegbringen.

Vielleicht hast du ja aber noch einen Rat ?

Danke und Gruß
Hans-Jürgen

Den Avira Neuinstall-Fehler haben aktuell ca 30 meiner User, ich denke eher dass da Avira wieder irgend nen Scheiss zusammen gezimmert hat.

Windows DVD da für ein Inplace Upgrade?

Hi,

habe Windows Repair laufen lassen (cooles Programm). Leider können nicht alle Probleme behoben werden. Ich habe mich jetzt entschlossen den Rechn er platt machen zu lassen und Windows neu aufspielen zu lassen.

Ich würde mir .... wenn ich dann alle Grundkomponenten wie Drucker, Wlan, Malwarebytes, Avira usw... wieder aufgespielt habe gerne ein Mirror machen um jederzeit wieder auf diesen Stand zurückfahren zu können.

Hast du vielleicht einen Tip weches Programm hier zur Zeit "State of the Art" ist ?

Ansonsten noch mal vielen Dank dass es euch gibt und für deine tolle Hilfe. Ich kann diese Seite / diesen Dienst nur Empfehlen und werde das auch wieder im Bewertungsforum zum Ausdruck bringen.

Schöne Grüße,
Hans-Jürgen

ich kenne da eigentlich nur Acronis.

Hi,

nachdem dann irgendwie gar nichts mehr ging hab ich den Rechner neu aufsetzen lassen. Jetzt bin ich dabei alles wieder ein zu richten und wollte gleich die Gelegenheit nutzen mich hier noch mal zu melden.

Erst mal noch mal vielen Lieben Dank für die tolle Hilfe, auch wenns dann doch aussichtslos war.

Hoffentlich hält das dieses mal länger ....

Ich hätte noch eine Frage wenn das ok ist. Früher (auf meinem alten Rechner) hatte ich mir gleich nachdem ich alles wesentliche eingerichtet hatte ein Image gezogen und konnte meinen REchner immer auf "start" zurück setzten wenn ich Probleme hatte.

Macht das denn nicht auch heute noch Sinn ? Und, gibt es vielleicht ein Programm das ihr Empfehlt ?


Viele Liebe Grüsse,

Hans-Jürgen

Uhhhggg, wie schnell man doch vergisst .... ich hatte ja chon eine Antwort bekomen....(peinlich, peinlich)

Also, vielen Dank noch mal, ich schau mir acronis mal an.

Gruß
HJ