Windows7 : Mehrere Trojaner nach Malwarebytes scan

M-K-D-B · 09.06.2014, 10:25

Wieso postest du mir nochmal diese Logdatei?

Meine letzte Antwort gelesen?

ghegon · 09.06.2014, 10:26

sorrymein Fehler.
Falsche Input Datei erwischt.
Kommt gleich

M-K-D-B · 09.06.2014, 10:30

kein Problem.

ghegon · 09.06.2014, 10:30

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:09-06-2014
Ran by georg at 2014-06-09 11:27:15 Run:3
Running from C:\Users\georg\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
Restore From Backup: software
Restore From Backup: system
Restore From Backup: sam
Restore From Backup: security
Reboot:
end
*****************

Error: The restore operation should be done in the recovery mode.
Error: The restore operation should be done in the recovery mode.
Error: The restore operation should be done in the recovery mode.
Error: The restore operation should be done in the recovery mode.


The system needed a reboot. 

==== End of Fixlog ====

M-K-D-B · 09.06.2014, 10:33

Ok, FRST mal bitte in den Reparaturoptionen ausführen:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

ghegon · 09.06.2014, 10:58

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014
Ran by SYSTEM on MININT-L1OGDNG on 09-06-2014 11:51:40
Running from K:\
Platform: Windows 7 Home Premium (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.



==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM\...\Run: [BDRegion] => C:\Program Files\Cyberlink\Shared files\brs.exe [75048 2010-01-19] (cyberlink)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8555040 2010-04-06] (Realtek Semiconductor)
HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM\...\Run: [TrueImageMonitor.exe] => C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [5992064 2011-12-16] (Acronis)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [403616 2011-08-20] (Acronis)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [135536 2010-12-13] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-20] (Apple Inc.)
HKU\anna\...\Policies\system: [LogonHoursAction] 2
HKU\anna\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\eva\...\Policies\system: [LogonHoursAction] 2
HKU\eva\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\georg\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [1837672 2012-10-16] (Hewlett-Packard Co.)
HKU\ghadmin\...\Policies\system: [LogonHoursAction] 2
HKU\ghadmin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\jens\...\Policies\system: [LogonHoursAction] 2
HKU\jens\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\renate\...\Run: [Firefox helper] => C:\Users\renate\AppData\Roaming\Mozilla\Firefox\firefox.exe
HKU\renate\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-13] (Microsoft Corporation)
HKU\renate\...\Policies\system: [LogonHoursAction] 2
HKU\renate\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Testbrowser1\...\Policies\system: [LogonHoursAction] 2
HKU\Testbrowser1\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

========================== Services (Whitelisted) =================

S2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [809224 2011-08-20] (Acronis)
S2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3483600 2012-04-22] (Acronis)
S2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
S2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] ()
S2 syncagentsrv; C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe [5891048 2011-12-16] (Acronis)
S2 uCamMonitor; C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S4 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X]

==================== Drivers (Whitelisted) ====================

S3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17408 2009-05-26] (ArcSoft, Inc.)
S3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-30] ()
S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-13] (Ralink Technology Corp.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2012-01-18] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2012-01-18] ()
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
S0 tdrpman; C:\Windows\System32\DRIVERS\tdrpman.sys [766496 2012-04-22] (Acronis)
S3 USBPNPA; C:\Windows\System32\drivers\CM108.sys [1310720 2007-06-27] (C-Media Inc)
S0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [126144 2011-12-04] (Acronis)
S0 vidsflt61; C:\Windows\System32\DRIVERS\vsflt61.sys [84544 2012-04-22] (Acronis)
S2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files\CyberLink\PowerDVD9\000.fcl [87536 2010-01-19] (CyberLink Corp.)
S5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-13] (Microsoft Corporation)
S3 catchme; \??\C:\Users\georg\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-09 01:37 - 2014-06-09 01:37 - 01072128 _____ (Farbar) C:\Users\georg\Downloads\FRST.exe
2014-06-09 01:22 - 2014-06-09 01:22 - 00000000 ____D () C:\Users\georg\Desktop\FRST-OlderVersion
2014-06-09 01:21 - 2014-06-09 01:21 - 00000136 _____ () C:\Users\georg\Desktop\Fixlist3.txt
2014-06-09 01:10 - 2012-06-02 14:19 - 01933848 _____ (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2014-06-09 01:10 - 2012-06-02 14:19 - 00577048 _____ (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2014-06-09 01:10 - 2012-06-02 14:19 - 00053784 _____ (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2014-06-09 01:10 - 2012-06-02 14:19 - 00045080 _____ (Microsoft Corporation) C:\Windows\System32\wups2.dll
2014-06-09 01:10 - 2012-06-02 14:19 - 00035864 _____ (Microsoft Corporation) C:\Windows\System32\wups.dll
2014-06-09 01:10 - 2012-06-02 14:12 - 02422272 _____ (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2014-06-09 01:10 - 2012-06-02 14:12 - 00088576 _____ (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2014-06-09 01:10 - 2012-06-02 05:19 - 00171904 _____ (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2014-06-09 01:10 - 2012-06-02 05:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2014-06-09 00:15 - 2014-06-09 00:15 - 00000000 ____D () C:\Users\georg\Documents\Subsembly
2014-06-08 22:52 - 2014-06-08 22:52 - 00000000 ____D () C:\Users\testbrowser\AppData\Roaming\Intel Corporation
2014-06-08 09:49 - 2014-06-08 09:49 - 00000244 _____ () C:\Users\georg\Desktop\defogger_enable.log
2014-06-08 08:57 - 2014-06-08 08:57 - 00001158 _____ () C:\Users\georg\Desktop\checkup.txt
2014-06-08 08:49 - 2014-06-08 08:49 - 00854367 _____ () C:\Users\georg\Desktop\SecurityCheck.exe
2014-06-08 05:21 - 2014-06-08 05:22 - 02347384 _____ (ESET) C:\Users\georg\Desktop\esetsmartinstaller_deu.exe
2014-06-06 09:24 - 2014-06-06 09:24 - 00019844 _____ () C:\Users\georg\Desktop\Addition-2.txt
2014-06-06 09:23 - 2014-06-06 09:24 - 00026956 _____ () C:\Users\georg\Desktop\FRST-2.txt
2014-06-06 09:23 - 2014-06-06 09:23 - 00000000 ____D () C:\Users\georg\Desktop\FRST-1
2014-06-06 09:20 - 2014-06-06 09:20 - 00000464 _____ () C:\Users\georg\Desktop\mbam.txt
2014-06-06 08:58 - 2014-06-06 08:58 - 00014857 _____ () C:\Users\georg\Desktop\JRT.txt
2014-06-06 08:56 - 2014-06-06 08:56 - 00000000 ____D () C:\Windows\ERUNT
2014-06-06 08:49 - 2014-06-06 08:52 - 00000000 ____D () C:\AdwCleaner
2014-06-06 08:36 - 2014-06-06 08:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\georg\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-06 08:35 - 2014-06-06 08:35 - 01333465 _____ () C:\Users\georg\Desktop\adwcleaner_3.212.exe
2014-06-06 08:35 - 2014-06-06 08:35 - 01016261 _____ (Thisisu) C:\Users\georg\Desktop\JRT.exe
2014-06-06 08:18 - 2014-06-06 08:18 - 00010402 _____ () C:\Users\georg\Desktop\ghcombofixgh.txt
2014-06-06 08:12 - 2014-06-09 01:37 - 00000000 ____D () C:\Users\georg\AppData\Local\temp
2014-06-06 08:12 - 2014-06-08 22:52 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00010402 _____ () C:\ComboFix.txt
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\Testbrowser1\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\renate\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\jens\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\ghadmin\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\eva\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\anna\AppData\Local\temp
2014-06-06 08:00 - 2011-06-25 22:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-06 08:00 - 2010-11-07 09:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-06 08:00 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-06 08:00 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-06 08:00 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-06 08:00 - 2000-08-30 16:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-06 08:00 - 2000-08-30 16:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-06 08:00 - 2000-08-30 16:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-06 07:59 - 2014-06-06 08:12 - 00000000 ____D () C:\Qoobox
2014-06-06 07:59 - 2014-06-06 08:11 - 00000000 ____D () C:\Windows\erdnt
2014-06-06 07:53 - 2014-06-06 07:53 - 05205146 ____R (Swearware) C:\Users\georg\Desktop\ComboFix.exe
2014-06-06 05:23 - 2014-06-06 05:23 - 00380416 _____ () C:\Users\georg\Downloads\Gmer-19357.exe
2014-06-06 02:02 - 2014-06-06 02:02 - 00027464 _____ () C:\Users\georg\Desktop\Addition-1.txt
2014-06-06 02:01 - 2014-06-09 11:51 - 00000000 ____D () C:\FRST
2014-06-06 02:01 - 2014-06-06 02:02 - 00023347 _____ () C:\Users\georg\Desktop\FRST-1.txt
2014-06-06 02:00 - 2014-06-09 01:22 - 01072128 _____ (Farbar) C:\Users\georg\Desktop\FRST.exe
2014-06-06 01:59 - 2014-06-06 01:59 - 00000472 _____ () C:\Users\georg\Desktop\ghdefogger_disable.log
2014-06-06 01:58 - 2014-06-06 01:58 - 00050477 _____ () C:\Users\georg\Desktop\Defogger.exe
2014-06-05 10:56 - 2014-06-05 10:56 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\Macromedia
2014-06-05 10:54 - 2014-06-05 10:54 - 00000000 ____D () C:\Users\testbrowser\Downloads\antvideo
2014-05-30 00:26 - 2014-05-31 10:01 - 00000000 ____D () C:\Users\georg\Documents\samsung s3 backup

==================== One Month Modified Files and Folders =======

2014-06-09 11:51 - 2014-06-06 02:01 - 00000000 ____D () C:\FRST
2014-06-09 01:43 - 2011-01-14 08:19 - 01836449 _____ () C:\Windows\WindowsUpdate.log
2014-06-09 01:40 - 2010-07-06 12:23 - 01498506 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-06-09 01:37 - 2014-06-09 01:37 - 01072128 _____ (Farbar) C:\Users\georg\Downloads\FRST.exe
2014-06-09 01:37 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\georg\AppData\Local\temp
2014-06-09 01:36 - 2009-07-13 20:34 - 00009888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-09 01:36 - 2009-07-13 20:34 - 00009888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-09 01:28 - 2009-07-13 20:39 - 00184855 _____ () C:\Windows\setupact.log
2014-06-09 01:22 - 2014-06-09 01:22 - 00000000 ____D () C:\Users\georg\Desktop\FRST-OlderVersion
2014-06-09 01:22 - 2014-06-06 02:00 - 01072128 _____ (Farbar) C:\Users\georg\Desktop\FRST.exe
2014-06-09 01:21 - 2014-06-09 01:21 - 00000136 _____ () C:\Users\georg\Desktop\Fixlist3.txt
2014-06-09 01:15 - 2014-01-04 04:25 - 00483328 _____ () C:\Users\georg\Documents\Lauftreff.sub
2014-06-09 01:11 - 2009-07-13 18:37 - 00000000 ____D () C:\Windows\System32\de-DE
2014-06-09 00:15 - 2014-06-09 00:15 - 00000000 ____D () C:\Users\georg\Documents\Subsembly
2014-06-08 23:25 - 2010-07-07 10:31 - 00239036 _____ () C:\Windows\PFRO.log
2014-06-08 22:52 - 2014-06-08 22:52 - 00000000 ____D () C:\Users\testbrowser\AppData\Roaming\Intel Corporation
2014-06-08 22:52 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\temp
2014-06-08 22:51 - 2012-01-13 03:02 - 00000340 __RSH () C:\Users\testbrowser\ntuser.pol
2014-06-08 22:51 - 2012-01-13 03:02 - 00000000 ____D () C:\users\testbrowser
2014-06-08 11:30 - 2011-10-08 23:16 - 00000000 ____D () C:\Users\georg\AppData\Roaming\Skype
2014-06-08 09:49 - 2014-06-08 09:49 - 00000244 _____ () C:\Users\georg\Desktop\defogger_enable.log
2014-06-08 09:49 - 2011-01-14 11:18 - 00000000 ____D () C:\users\georg
2014-06-08 08:57 - 2014-06-08 08:57 - 00001158 _____ () C:\Users\georg\Desktop\checkup.txt
2014-06-08 08:49 - 2014-06-08 08:49 - 00854367 _____ () C:\Users\georg\Desktop\SecurityCheck.exe
2014-06-08 05:22 - 2014-06-08 05:21 - 02347384 _____ (ESET) C:\Users\georg\Desktop\esetsmartinstaller_deu.exe
2014-06-08 05:14 - 2012-01-13 02:59 - 00000008 __RSH () C:\Users\georg\ntuser.pol
2014-06-08 05:13 - 2009-07-13 18:37 - 00000000 ___HD () C:\Windows\System32\GroupPolicy
2014-06-06 11:13 - 2011-01-15 08:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-06 09:24 - 2014-06-06 09:24 - 00019844 _____ () C:\Users\georg\Desktop\Addition-2.txt
2014-06-06 09:24 - 2014-06-06 09:23 - 00026956 _____ () C:\Users\georg\Desktop\FRST-2.txt
2014-06-06 09:23 - 2014-06-06 09:23 - 00000000 ____D () C:\Users\georg\Desktop\FRST-1
2014-06-06 09:20 - 2014-06-06 09:20 - 00000464 _____ () C:\Users\georg\Desktop\mbam.txt
2014-06-06 09:00 - 2012-01-12 11:24 - 00000000 ____D () C:\Users\georg\AppData\Roaming\Malwarebytes
2014-06-06 09:00 - 2012-01-12 11:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-06 08:58 - 2014-06-06 08:58 - 00014857 _____ () C:\Users\georg\Desktop\JRT.txt
2014-06-06 08:56 - 2014-06-06 08:56 - 00000000 ____D () C:\Windows\ERUNT
2014-06-06 08:52 - 2014-06-06 08:49 - 00000000 ____D () C:\AdwCleaner
2014-06-06 08:36 - 2014-06-06 08:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\georg\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-06 08:35 - 2014-06-06 08:35 - 01333465 _____ () C:\Users\georg\Desktop\adwcleaner_3.212.exe
2014-06-06 08:35 - 2014-06-06 08:35 - 01016261 _____ (Thisisu) C:\Users\georg\Desktop\JRT.exe
2014-06-06 08:18 - 2014-06-06 08:18 - 00010402 _____ () C:\Users\georg\Desktop\ghcombofixgh.txt
2014-06-06 08:12 - 2014-06-06 08:12 - 00010402 _____ () C:\ComboFix.txt
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\Testbrowser1\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\renate\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\jens\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\ghadmin\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\eva\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 08:12 - 00000000 ____D () C:\Users\anna\AppData\Local\temp
2014-06-06 08:12 - 2014-06-06 07:59 - 00000000 ____D () C:\Qoobox
2014-06-06 08:12 - 2009-07-13 18:37 - 00000000 ___RD () C:\users\Public
2014-06-06 08:11 - 2014-06-06 07:59 - 00000000 ____D () C:\Windows\erdnt
2014-06-06 08:11 - 2009-07-13 18:04 - 00000215 _____ () C:\Windows\system.ini
2014-06-06 07:53 - 2014-06-06 07:53 - 05205146 ____R (Swearware) C:\Users\georg\Desktop\ComboFix.exe
2014-06-06 05:23 - 2014-06-06 05:23 - 00380416 _____ () C:\Users\georg\Downloads\Gmer-19357.exe
2014-06-06 02:02 - 2014-06-06 02:02 - 00027464 _____ () C:\Users\georg\Desktop\Addition-1.txt
2014-06-06 02:02 - 2014-06-06 02:01 - 00023347 _____ () C:\Users\georg\Desktop\FRST-1.txt
2014-06-06 01:59 - 2014-06-06 01:59 - 00000472 _____ () C:\Users\georg\Desktop\ghdefogger_disable.log
2014-06-06 01:58 - 2014-06-06 01:58 - 00050477 _____ () C:\Users\georg\Desktop\Defogger.exe
2014-06-06 01:48 - 2011-10-08 23:29 - 00000000 ____D () C:\Users\renate\AppData\Roaming\Skype
2014-06-05 10:56 - 2014-06-05 10:56 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\Macromedia
2014-06-05 10:54 - 2014-06-05 10:54 - 00000000 ____D () C:\Users\testbrowser\Downloads\antvideo
2014-06-05 10:54 - 2012-01-13 03:04 - 00000000 ____D () C:\Users\testbrowser\AppData\Roaming\Mozilla
2014-06-05 10:54 - 2012-01-13 03:04 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\Mozilla
2014-06-05 10:37 - 2011-05-17 07:25 - 00000000 ____D () C:\Program Files\Akademische Arbeitsgemeinschaft
2014-06-05 07:03 - 2014-01-04 02:40 - 01767424 _____ () C:\Users\georg\Documents\Home-Bank.sub
2014-05-31 10:01 - 2014-05-30 00:26 - 00000000 ____D () C:\Users\georg\Documents\samsung s3 backup

Some content of TEMP:
====================
C:\Users\georg\AppData\Local\Temp\avgnt.exe
C:\Users\georg\AppData\Local\Temp\Quarantine.exe
C:\Users\testbrowser\AppData\Local\Temp\avgnt.exe


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE Association (whitelisted) =============


==================== Restore Points  =========================

Restore point made on: 2014-05-20 03:08:08
Restore point made on: 2014-05-23 23:11:30
Restore point made on: 2014-05-23 23:24:44
Restore point made on: 2014-05-29 22:07:33
Restore point made on: 2014-06-05 10:23:09
Restore point made on: 2014-06-05 10:36:32
Restore point made on: 2014-06-05 10:41:18
Restore point made on: 2014-06-05 10:50:58
Restore point made on: 2014-06-05 11:55:42
Restore point made on: 2014-06-05 22:07:22
Restore point made on: 2014-06-09 01:10:08

==================== Memory info =========================== 

Percentage of memory in use: 12%
Total physical RAM: 4094.18 MB
Available physical RAM: 3566.59 MB
Total Pagefile: 4092.45 MB
Available Pagefile: 3571.99 MB
Total Virtual: 2047.88 MB
Available Virtual: 1955.12 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:900.41 GB) (Free:697.2 GB) NTFS
Drive d: () (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (Recover) (Fixed) (Total:30 GB) (Free:9.98 GB) NTFS
Drive k: (KINGSTON) (Removable) (Total:14.89 GB) (Free:0.64 GB) FAT32
Drive l: (GEORG-V2) (Removable) (Total:1.86 GB) (Free:1.48 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (zweite-300-platte) (Fixed) (Total:279.48 GB) (Free:45.14 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 279 GB) (Disk ID: 837B837B)
Partition 1: (Active) - (Size=279 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 932 GB) (Disk ID: 168AF31D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=900 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

========================================================
Disk: 5 (Size: 15 GB) (Disk ID: 365823A7)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)

========================================================
Disk: 6 (MBR Code: Windows XP) (Size: 2 GB) (Disk ID: 30A1FECE)
Partition 1: (Active) - (Size=2 GB) - (Type=0B)


LastRegBack: 2014-06-08 06:05

==================== End Of Log ============================

--- --- ---

M-K-D-B · 09.06.2014, 13:47

Ok. Nun folgenden Fix im Reparaturmodus ausführen:

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
Restore From Backup: software
Restore From Backup: system
Restore From Backup: sam
Restore From Backup: security
end

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Wie läuft der Rechner jetzt?

ghegon · 09.06.2014, 18:13

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:09-06-2014
Ran by SYSTEM at 2014-06-09 15:29:00 Run:4
Running from K:\
Boot Mode: Recovery

==============================================

Content of fixlist:
*****************
start
Restore From Backup: software
Restore From Backup: system
Restore From Backup: sam
Restore From Backup: security
end
*****************

Software hive was renamed to software.old
Software hive was successfully restored from backup.
System hive was renamed to system.old
System hive was successfully restored from backup.
SAM hive was renamed to SAM.old
SAM hive was successfully restored from backup.
Security hive was renamed to Security.old
Security hive was successfully restored from backup.

==== End of Fixlog ====

Rechner läuft wieder

SUCHE Funktioniert wieder
Doppelclick geht wieder
SystemSteuerung geht wieder
CMD geht wieder

ok, habe jetzt nochmal alles verifiziert.
Sound bekomme ich nicht mehr zum Laufen.
Sonst scheint alles wieder zu funktionieren.

Soll ich jetzt die abschluss Bereinigung fertigstellen?

M-K-D-B · 10.06.2014, 08:17

Was meinst du mit Abschlussbereinigung feststellen?

Mach mal bitte FRST logfile nochmal:

Starte die FRST.exe erneut. Setze einen Haken vor Addition und drücke auf Scan.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

ghegon · 10.06.2014, 16:20

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014 03
Ran by georg (administrator) on HOME-DESKTOP on 10-06-2014 17:14:27
Running from C:\Users\georg\Desktop
Platform: Microsoft Windows 7 Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Acronis) C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(ArcSoft, Inc.) C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(cyberlink) C:\Program Files\CyberLink\Shared files\brs.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Acronis) C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\HPNetworkCommunicator.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM\...\Run: [BDRegion] => C:\Program Files\Cyberlink\Shared files\brs.exe [75048 2010-01-19] (cyberlink)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8555040 2010-04-07] (Realtek Semiconductor)
HKLM\...\Run: [NPSStartup] => [X]
HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM\...\Run: [Malwarebytes' Anti-Malware] => "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
HKLM\...\Run: [TrueImageMonitor.exe] => C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [5992064 2011-12-16] (Acronis)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [403616 2011-08-21] (Acronis)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [135536 2010-12-13] (Microsoft Corporation)
HKLM\...\Run: [avgnt] => "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKU\S-1-5-21-1378868678-2165211460-215521333-1003\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE35BEA2F683CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\georg\AppData\Roaming\Mozilla\Firefox\Profiles\ybstvj2w.default
FF Homepage: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\georg\AppData\Roaming\Mozilla\Firefox\Profiles\ybstvj2w.default\Extensions\ich@maltegoetz.de [2014-04-30]
FF Extension: Screengrab - C:\Users\georg\AppData\Roaming\Mozilla\Firefox\Profiles\ybstvj2w.default\Extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2011-01-14]
FF Extension: OptimizeGoogle - C:\Users\georg\AppData\Roaming\Mozilla\Firefox\Profiles\ybstvj2w.default\Extensions\optimizegoogle@optimizegoogle.com.xpi [2011-12-11]
FF Extension: Adblock Plus - C:\Users\georg\AppData\Roaming\Mozilla\Firefox\Profiles\ybstvj2w.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-12-11]
FF Extension: BetterPrivacy - C:\Users\georg\AppData\Roaming\Mozilla\Firefox\Profiles\ybstvj2w.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-08-11]
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2013-11-03]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2013-11-03]

========================== Services (Whitelisted) =================

ATTENTION: => Could not perform signature verification. Cryptographic Service is not running.

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [809224 2011-08-21] (Acronis)
R2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3483600 2012-04-22] (Acronis)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] ()
R2 syncagentsrv; C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe [5891048 2011-12-16] (Acronis)
R2 uCamMonitor; C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [X]
S2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [X]
S4 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X]
S2 MBAMService; "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [X]

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17408 2009-05-26] (ArcSoft, Inc.)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-14] (Ralink Technology Corp.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2012-01-18] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2012-01-18] ()
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R0 tdrpman; C:\Windows\System32\DRIVERS\tdrpman.sys [766496 2012-04-22] (Acronis)
S3 USBPNPA; C:\Windows\System32\drivers\CM108.sys [1310720 2007-06-28] (C-Media Inc)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [126144 2011-12-04] (Acronis)
R0 vidsflt61; C:\Windows\System32\DRIVERS\vsflt61.sys [84544 2012-04-22] (Acronis)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files\CyberLink\PowerDVD9\000.fcl [87536 2010-01-20] (CyberLink Corp.)
S2 avgntflt; system32\DRIVERS\avgntflt.sys [X]
S1 avipbb; system32\DRIVERS\avipbb.sys [X]
S1 avkmgr; system32\DRIVERS\avkmgr.sys [X]
S3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys [X]
S1 ssmdrv; system32\DRIVERS\ssmdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-10 17:14 - 2014-06-10 17:14 - 00014486 _____ () C:\Users\georg\Desktop\FRST.txt
2014-06-09 17:20 - 2014-06-09 17:20 - 00000000 ____D () C:\Users\georg\AppData\Local\{48590B53-2D10-47CD-B290-97ACB5071E0F}
2014-06-09 17:07 - 2014-06-09 17:07 - 00000000 ____D () C:\Users\georg\AppData\Local\Apps\2.0
2014-06-09 16:16 - 2014-06-09 16:18 - 137314600 _____ () C:\Users\georg\Downloads\avira_free_antivirus_de_642.exe
2014-06-09 16:15 - 2014-06-09 16:17 - 88882192 _____ (AVAST Software) C:\Users\georg\Downloads\avast_free18_antivirus_setup.exe
2014-06-09 16:14 - 2014-06-09 16:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\georg\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-09 11:59 - 2014-06-09 11:52 - 00021975 _____ () C:\Users\georg\Desktop\FRST-4.txt
2014-06-09 11:37 - 2014-06-09 11:37 - 01072128 _____ (Farbar) C:\Users\georg\Downloads\FRST.exe
2014-06-09 11:22 - 2014-06-10 17:14 - 00000000 ____D () C:\Users\georg\Desktop\FRST-OlderVersion
2014-06-09 11:21 - 2014-06-09 11:21 - 00000136 _____ () C:\Users\georg\Desktop\Fixlist3.txt
2014-06-09 11:10 - 2012-06-03 00:19 - 01933848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-06-09 11:10 - 2012-06-03 00:19 - 00577048 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-06-09 11:10 - 2012-06-03 00:19 - 00053784 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-06-09 11:10 - 2012-06-03 00:19 - 00045080 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-06-09 11:10 - 2012-06-03 00:19 - 00035864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-06-09 11:10 - 2012-06-03 00:12 - 02422272 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-06-09 11:10 - 2012-06-03 00:12 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-06-09 11:10 - 2012-06-02 15:19 - 00171904 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-06-09 11:10 - 2012-06-02 15:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-06-09 10:15 - 2014-06-09 10:15 - 00000000 ____D () C:\Users\georg\Documents\Subsembly
2014-06-09 08:52 - 2014-06-09 08:52 - 00000000 ____D () C:\Users\testbrowser\AppData\Roaming\Intel Corporation
2014-06-08 19:49 - 2014-06-08 19:49 - 00000244 _____ () C:\Users\georg\Desktop\defogger_enable.log
2014-06-08 18:57 - 2014-06-08 18:57 - 00001158 _____ () C:\Users\georg\Desktop\checkup.txt
2014-06-08 18:49 - 2014-06-08 18:49 - 00854367 _____ () C:\Users\georg\Desktop\SecurityCheck.exe
2014-06-08 15:21 - 2014-06-08 15:22 - 02347384 _____ (ESET) C:\Users\georg\Desktop\esetsmartinstaller_deu.exe
2014-06-06 19:24 - 2014-06-06 19:24 - 00019844 _____ () C:\Users\georg\Desktop\Addition-2.txt
2014-06-06 19:23 - 2014-06-06 19:24 - 00026956 _____ () C:\Users\georg\Desktop\FRST-2.txt
2014-06-06 19:23 - 2014-06-06 19:23 - 00000000 ____D () C:\Users\georg\Desktop\FRST-1
2014-06-06 19:20 - 2014-06-06 19:20 - 00000464 _____ () C:\Users\georg\Desktop\mbam.txt
2014-06-06 18:58 - 2014-06-06 18:58 - 00014857 _____ () C:\Users\georg\Desktop\JRT.txt
2014-06-06 18:56 - 2014-06-06 18:56 - 00000000 ____D () C:\Windows\ERUNT
2014-06-06 18:49 - 2014-06-06 18:52 - 00000000 ____D () C:\AdwCleaner
2014-06-06 18:36 - 2014-06-06 18:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\georg\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-06 18:35 - 2014-06-06 18:35 - 01333465 _____ () C:\Users\georg\Desktop\adwcleaner_3.212.exe
2014-06-06 18:35 - 2014-06-06 18:35 - 01016261 _____ (Thisisu) C:\Users\georg\Desktop\JRT.exe
2014-06-06 18:18 - 2014-06-06 18:18 - 00010402 _____ () C:\Users\georg\Desktop\ghcombofixgh.txt
2014-06-06 18:12 - 2014-06-10 17:14 - 00000000 ____D () C:\Users\georg\AppData\Local\temp
2014-06-06 18:12 - 2014-06-10 14:05 - 00000000 ____D () C:\Users\renate\AppData\Local\temp
2014-06-06 18:12 - 2014-06-09 08:52 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00010402 _____ () C:\ComboFix.txt
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\Testbrowser1\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\jens\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\ghadmin\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\eva\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\anna\AppData\Local\temp
2014-06-06 18:00 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-06 18:00 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-06 18:00 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-06 18:00 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-06 18:00 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-06 18:00 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-06 18:00 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-06 18:00 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-06 17:59 - 2014-06-06 18:12 - 00000000 ____D () C:\Qoobox
2014-06-06 17:59 - 2014-06-06 18:11 - 00000000 ____D () C:\Windows\erdnt
2014-06-06 17:53 - 2014-06-06 17:53 - 05205146 ____R (Swearware) C:\Users\georg\Desktop\ComboFix.exe
2014-06-06 15:23 - 2014-06-06 15:23 - 00380416 _____ () C:\Users\georg\Downloads\Gmer-19357.exe
2014-06-06 12:02 - 2014-06-06 12:02 - 00027464 _____ () C:\Users\georg\Desktop\Addition-1.txt
2014-06-06 12:01 - 2014-06-10 17:14 - 00000000 ____D () C:\FRST
2014-06-06 12:01 - 2014-06-06 12:02 - 00023347 _____ () C:\Users\georg\Desktop\FRST-1.txt
2014-06-06 12:00 - 2014-06-10 17:14 - 01177600 _____ (Farbar) C:\Users\georg\Desktop\FRST.exe
2014-06-06 11:59 - 2014-06-06 11:59 - 00000472 _____ () C:\Users\georg\Desktop\ghdefogger_disable.log
2014-06-06 11:58 - 2014-06-06 11:58 - 00050477 _____ () C:\Users\georg\Desktop\Defogger.exe
2014-06-05 20:56 - 2014-06-05 20:56 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\Macromedia
2014-06-05 20:54 - 2014-06-05 20:54 - 00000000 ____D () C:\Users\testbrowser\Downloads\antvideo
2014-05-30 10:26 - 2014-05-31 20:01 - 00000000 ____D () C:\Users\georg\Documents\samsung s3 backup

==================== One Month Modified Files and Folders =======

2014-06-10 17:14 - 2014-06-10 17:14 - 00014486 _____ () C:\Users\georg\Desktop\FRST.txt
2014-06-10 17:14 - 2014-06-09 11:22 - 00000000 ____D () C:\Users\georg\Desktop\FRST-OlderVersion
2014-06-10 17:14 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\georg\AppData\Local\temp
2014-06-10 17:14 - 2014-06-06 12:01 - 00000000 ____D () C:\FRST
2014-06-10 17:14 - 2014-06-06 12:00 - 01177600 _____ (Farbar) C:\Users\georg\Desktop\FRST.exe
2014-06-10 17:12 - 2011-01-16 22:06 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-10 17:12 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-10 17:12 - 2009-07-14 06:39 - 00185191 _____ () C:\Windows\setupact.log
2014-06-10 14:49 - 2011-01-14 18:19 - 01880470 _____ () C:\Windows\WindowsUpdate.log
2014-06-10 14:39 - 2011-10-09 09:29 - 00000000 ____D () C:\Users\renate\AppData\Roaming\Skype
2014-06-10 14:05 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\renate\AppData\Local\temp
2014-06-10 14:00 - 2011-01-16 22:06 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-10 12:09 - 2009-07-14 06:34 - 00009888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-10 12:09 - 2009-07-14 06:34 - 00009888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-10 12:01 - 2014-05-03 18:02 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-10 12:01 - 2012-10-20 14:11 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-10 01:29 - 2009-07-14 04:03 - 53215232 _____ () C:\Windows\system32\config\software.old
2014-06-10 01:29 - 2009-07-14 04:03 - 26476544 _____ () C:\Windows\system32\config\system.old
2014-06-10 01:28 - 2009-07-14 04:03 - 00524288 _____ () C:\Windows\system32\config\SAM.old
2014-06-10 01:28 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\Security.old
2014-06-09 17:36 - 2010-07-06 22:23 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-09 17:28 - 2012-01-13 12:59 - 00000008 __RSH () C:\Users\renate\ntuser.pol
2014-06-09 17:28 - 2011-01-15 15:12 - 00000000 ____D () C:\Users\renate
2014-06-09 17:20 - 2014-06-09 17:20 - 00000000 ____D () C:\Users\georg\AppData\Local\{48590B53-2D10-47CD-B290-97ACB5071E0F}
2014-06-09 17:19 - 2012-07-03 19:06 - 00000000 ____D () C:\Users\georg\Tracing
2014-06-09 17:07 - 2014-06-09 17:07 - 00000000 ____D () C:\Users\georg\AppData\Local\Apps\2.0
2014-06-09 16:56 - 2013-10-27 17:25 - 00000000 ____D () C:\Users\georg\AppData\Roaming\vlc
2014-06-09 16:18 - 2014-06-09 16:16 - 137314600 _____ () C:\Users\georg\Downloads\avira_free_antivirus_de_642.exe
2014-06-09 16:17 - 2014-06-09 16:15 - 88882192 _____ (AVAST Software) C:\Users\georg\Downloads\avast_free18_antivirus_setup.exe
2014-06-09 16:14 - 2014-06-09 16:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\georg\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-09 13:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-06-09 11:52 - 2014-06-09 11:59 - 00021975 _____ () C:\Users\georg\Desktop\FRST-4.txt
2014-06-09 11:37 - 2014-06-09 11:37 - 01072128 _____ (Farbar) C:\Users\georg\Downloads\FRST.exe
2014-06-09 11:21 - 2014-06-09 11:21 - 00000136 _____ () C:\Users\georg\Desktop\Fixlist3.txt
2014-06-09 11:15 - 2014-01-04 14:25 - 00483328 _____ () C:\Users\georg\Documents\Lauftreff.sub
2014-06-09 11:11 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-06-09 10:15 - 2014-06-09 10:15 - 00000000 ____D () C:\Users\georg\Documents\Subsembly
2014-06-09 09:25 - 2010-07-07 20:31 - 00239036 _____ () C:\Windows\PFRO.log
2014-06-09 08:52 - 2014-06-09 08:52 - 00000000 ____D () C:\Users\testbrowser\AppData\Roaming\Intel Corporation
2014-06-09 08:52 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\temp
2014-06-09 08:51 - 2012-01-13 13:02 - 00000340 __RSH () C:\Users\testbrowser\ntuser.pol
2014-06-09 08:51 - 2012-01-13 13:02 - 00000000 ____D () C:\Users\testbrowser
2014-06-08 21:30 - 2011-10-09 09:16 - 00000000 ____D () C:\Users\georg\AppData\Roaming\Skype
2014-06-08 19:49 - 2014-06-08 19:49 - 00000244 _____ () C:\Users\georg\Desktop\defogger_enable.log
2014-06-08 19:49 - 2011-01-14 21:18 - 00000000 ____D () C:\Users\georg
2014-06-08 18:57 - 2014-06-08 18:57 - 00001158 _____ () C:\Users\georg\Desktop\checkup.txt
2014-06-08 18:49 - 2014-06-08 18:49 - 00854367 _____ () C:\Users\georg\Desktop\SecurityCheck.exe
2014-06-08 15:22 - 2014-06-08 15:21 - 02347384 _____ (ESET) C:\Users\georg\Desktop\esetsmartinstaller_deu.exe
2014-06-08 15:14 - 2012-01-13 12:59 - 00000008 __RSH () C:\Users\georg\ntuser.pol
2014-06-08 15:13 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-06 21:13 - 2011-01-15 18:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-06 19:35 - 2011-01-15 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-06 19:24 - 2014-06-06 19:24 - 00019844 _____ () C:\Users\georg\Desktop\Addition-2.txt
2014-06-06 19:24 - 2014-06-06 19:23 - 00026956 _____ () C:\Users\georg\Desktop\FRST-2.txt
2014-06-06 19:23 - 2014-06-06 19:23 - 00000000 ____D () C:\Users\georg\Desktop\FRST-1
2014-06-06 19:20 - 2014-06-06 19:20 - 00000464 _____ () C:\Users\georg\Desktop\mbam.txt
2014-06-06 19:00 - 2012-01-12 21:24 - 00000000 ____D () C:\Users\georg\AppData\Roaming\Malwarebytes
2014-06-06 19:00 - 2012-01-12 21:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-06 18:58 - 2014-06-06 18:58 - 00014857 _____ () C:\Users\georg\Desktop\JRT.txt
2014-06-06 18:56 - 2014-06-06 18:56 - 00000000 ____D () C:\Windows\ERUNT
2014-06-06 18:52 - 2014-06-06 18:49 - 00000000 ____D () C:\AdwCleaner
2014-06-06 18:36 - 2014-06-06 18:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\georg\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-06 18:35 - 2014-06-06 18:35 - 01333465 _____ () C:\Users\georg\Desktop\adwcleaner_3.212.exe
2014-06-06 18:35 - 2014-06-06 18:35 - 01016261 _____ (Thisisu) C:\Users\georg\Desktop\JRT.exe
2014-06-06 18:18 - 2014-06-06 18:18 - 00010402 _____ () C:\Users\georg\Desktop\ghcombofixgh.txt
2014-06-06 18:12 - 2014-06-06 18:12 - 00010402 _____ () C:\ComboFix.txt
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\Testbrowser1\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\jens\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\ghadmin\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\eva\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 18:12 - 00000000 ____D () C:\Users\anna\AppData\Local\temp
2014-06-06 18:12 - 2014-06-06 17:59 - 00000000 ____D () C:\Qoobox
2014-06-06 18:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-06 18:11 - 2014-06-06 17:59 - 00000000 ____D () C:\Windows\erdnt
2014-06-06 18:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-06-06 17:53 - 2014-06-06 17:53 - 05205146 ____R (Swearware) C:\Users\georg\Desktop\ComboFix.exe
2014-06-06 15:23 - 2014-06-06 15:23 - 00380416 _____ () C:\Users\georg\Downloads\Gmer-19357.exe
2014-06-06 12:02 - 2014-06-06 12:02 - 00027464 _____ () C:\Users\georg\Desktop\Addition-1.txt
2014-06-06 12:02 - 2014-06-06 12:01 - 00023347 _____ () C:\Users\georg\Desktop\FRST-1.txt
2014-06-06 11:59 - 2014-06-06 11:59 - 00000472 _____ () C:\Users\georg\Desktop\ghdefogger_disable.log
2014-06-06 11:58 - 2014-06-06 11:58 - 00050477 _____ () C:\Users\georg\Desktop\Defogger.exe
2014-06-05 20:56 - 2014-06-05 20:56 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\Macromedia
2014-06-05 20:54 - 2014-06-05 20:54 - 00000000 ____D () C:\Users\testbrowser\Downloads\antvideo
2014-06-05 20:54 - 2012-01-13 13:04 - 00000000 ____D () C:\Users\testbrowser\AppData\Roaming\Mozilla
2014-06-05 20:54 - 2012-01-13 13:04 - 00000000 ____D () C:\Users\testbrowser\AppData\Local\Mozilla
2014-06-05 20:37 - 2011-05-17 17:25 - 00000000 ____D () C:\Program Files\Akademische Arbeitsgemeinschaft
2014-06-05 17:03 - 2014-01-04 12:40 - 01767424 _____ () C:\Users\georg\Documents\Home-Bank.sub
2014-05-31 20:01 - 2014-05-30 10:26 - 00000000 ____D () C:\Users\georg\Documents\samsung s3 backup

Some content of TEMP:
====================
C:\Users\georg\AppData\Local\temp\avgnt.exe
C:\Users\georg\AppData\Local\temp\Quarantine.exe
C:\Users\testbrowser\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-06-08 16:05

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:09-06-2014 03
Ran by georg at 2014-06-10 17:15:11
Running from C:\Users\georg\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Acronis*True*Image*Home 2012 (HKLM\...\{77DDEEB4-CBF4-4B4C-8366-07E8CC03692B}Visible) (Version: 15.0.6154 - Acronis)
Acronis*True*Image*Home 2012 (Version: 15.0.6154 - Acronis) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.2.152.26 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.03) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft Magic-i Visual Effects 2 (HKLM\...\{334713BA-B8E7-4A60-988C-4110753A191E}) (Version: 2.0.11.80 - ArcSoft)
ArcSoft WebCam Companion 3 (HKLM\...\{6D8EACA3-664E-4F83-8A84-BE3AE952DAB6}) (Version: 3.0.7.264 - ArcSoft)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Banking 4W (HKLM\...\TopBanking) (Version:  - Subsembly GmbH)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2602 - CyberLink Corp.)
CyberLink LabelPrint (Version: 2.5.2602 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3802 - CyberLink Corp.)
CyberLink Power2Go (Version: 6.1.3802 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2815 - CyberLink Corp.)
CyberLink PowerDirector (Version: 8.0.2815 - CyberLink Corp.) Hidden
CyberLink PowerDVD 9 (HKLM\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.2519.50 - CyberLink Corp.)
CyberLink PowerDVD 9 (Version: 9.0.2519.50 - CyberLink Corp.) Hidden
CyberLink PowerDVD Copy (HKLM\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
CyberLink PowerDVD Copy (Version: 1.5.1306 - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.2.2326 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.2.2326 - CyberLink Corp.) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DC120 (HKLM\...\DC120) (Version:  - )
Deluxe Snake version 3.8.1 (HKLM\...\Deluxe Snake_is1) (Version: 3.8.1 - Daniel Schlyder)
Geldtipps Homebanking 2011 1und1 (HKLM\...\{BE618A02-45E7-4456-8277-D05BE76B9E1A}) (Version: 3.27 - Akademische Arbeitsgemeinschaft)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
HP Button Manager (HKLM\...\{7390FC95-D842-448A-A3A2-C8DC89AEB83A}) (Version: 1.6.0.0 - Hewlett-Packard)
HP Officejet 4620 series - Grundlegende Software für das Gerät (HKLM\...\{717130C7-FEA7-4D63-AEE3-00EF2F41ACDD}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 4620 series Hilfe (HKLM\...\{72EDA2AC-2908-4BB3-97E5-4F9DDEBF9731}) (Version: 6.0.0 - Hewlett Packard)
HP WebCam Benutzerhandbuch (HKLM\...\{D31612BB-C6D7-4142-96AE-16DB062354CF}) (Version:  - Hewlett-Packard)
I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel(R) Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 14.3 - Intel)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.28 - Irfan Skiljan)
iTunes (HKLM\...\{2F21564D-DE05-4C6D-B21E-08B9D313FAB3}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
kreawi Prüfungstrainer (HKLM\...\kreawi Prüfungstrainer) (Version:  - )
Logitech Harmony Remote Software 7 (HKLM\...\{5C6F884D-680C-448B-B4C9-22296EE1B206}) (Version: 7.7.0.0 - Logitech)
Logitech Harmony Remote Software 7 (Version: 7.7.0.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 1.60.1.1000 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.60.1.1000 - Malwarebytes Corporation)
Medion Home Cinema (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.1517 - CyberLink Corp.)
Medion Home Cinema (Version: 8.0.1517 - CyberLink Corp.) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft LifeCam (HKLM\...\{BD71B413-9FEE-49BB-A6D1-2C0BFB99BDFE}) (Version: 3.60.253.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MindManager 2002 (HKLM\...\MindManager 2002) (Version: 4.6.171 - Mindjet LLC)
MiniTool Partition Wizard Home Edition 7.1 (HKLM\...\{34A153FE-6926-4C14-B48A-B71E68C672A8}_is1) (Version:  - MiniTool Solution Ltd.)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5721 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.61.39 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{DEA314C4-0929-4250-BC92-98E4C105F28D}) (Version: 9.10.0129 - NVIDIA Corporation)
PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
PDF Architect (HKLM\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.1 - pdfforge)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6083 - Realtek Semiconductor Corp.)
Remote Control USB Driver (HKLM\...\{8471021C-F529-43DE-84DF-3612E10F58C4}) (Version: 2.3.2.317 - )
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )
Samsung Mobile Modem Device Software (HKLM\...\Samsung Mobile Modem Device) (Version:  - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )
Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
Samsung New PC Studio USB Driver Installer (HKLM\...\InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio USB Driver Installer (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version:  - )
SamsungConnectivityCableDriver (HKLM\...\{7E84FAC8-C518-40F9-9807-7455301D6D25}) (Version: 6.83.6.2.1 - Samsung)
Skype™ 6.3 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.107 - Skype Technologies S.A.)
SourceGear DiffMerge 3.3.2.1139 (x86) (HKLM\...\{88C1A719-C868-4FD1-8F95-8E5AEA5BF206}) (Version: 3.3.2.1139 - SourceGear, LLC)
SPG-Fibu (HKLM\...\SPG-Fibu) (Version:  - )
TreeSize Professional 5.3.3 (HKLM\...\TreeSize Professional_is1) (Version: 5.3.3 - JAM Software)
VLC media player 2.1.0 (HKLM\...\VLC media player) (Version: 2.1.0 - VideoLAN)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)

==================== Restore Points  =========================

05-06-2014 18:23:08 Removed AAVUpdateManager.
05-06-2014 18:36:31 Removed AAVUpdateManager.
09-06-2014 09:09:58 Windows Update
09-06-2014 15:13:11 Windows Update
09-06-2014 15:14:29 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2014-06-06 18:10 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {68FA8388-9837-4DA4-A802-613212D76604} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-16] (Google Inc.)
Task: {F3D6A448-EB36-40EA-80D9-4F4D4719BA09} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-16] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2010-07-08 22:55 - 2009-04-17 18:01 - 00247152 ____N () C:\Program Files\CyberLink\Shared files\RichVideo.exe
2012-06-28 17:58 - 2011-12-16 14:02 - 00435552 _____ () C:\Program Files\Acronis\TrueImageHome\Common\ulxmlrpcpp.dll
2012-06-28 18:34 - 2011-12-16 14:37 - 00018784 _____ () C:\Program Files\Acronis\TrueImageHome\ti_managers_proxy_stub.dll
2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2012-06-28 21:46 - 2011-12-16 17:51 - 13923280 _____ () C:\Program Files\Acronis\TrueImageHome\Common\ti_managers.dll
2014-05-03 18:02 - 2014-06-09 18:03 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\georg\Documents\ltgrill2010.jpg.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\georg\Documents\ltgrill2010.jpg.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsScanner => ""="Service"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: iPod Service => 3

==================== Faulty Device Manager Devices =============

Name: avipbb
Description: avipbb
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: avipbb
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: avkmgr
Description: avkmgr
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: avkmgr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: ssmdrv
Description: ssmdrv
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: ssmdrv
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/10/2014 00:46:55 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/10/2014 00:46:41 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/09/2014 05:31:29 PM) (Source: EventSystem) (EventID: 4622) (User: )
Description: 80070005{E33F90D5-CE87-46AD-98B8-202930AE544A}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (06/09/2014 01:35:28 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/09/2014 01:35:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/08/2014 04:06:07 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/08/2014 03:24:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: avgnt.exe, Version: 14.0.4.620, Zeitstempel: 0x536111d1
Name des fehlerhaften Moduls: mfc120u.dll, Version: 12.0.21005.1, Zeitstempel: 0x524fabbd
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00239c73
ID des fehlerhaften Prozesses: 0xdc8
Startzeit der fehlerhaften Anwendung: 0xavgnt.exe0
Pfad der fehlerhaften Anwendung: avgnt.exe1
Pfad des fehlerhaften Moduls: avgnt.exe2
Berichtskennung: avgnt.exe3


System errors:
=============
Error: (06/10/2014 05:14:43 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%2

Error: (06/10/2014 05:14:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMProtector" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/10/2014 05:12:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
avipbb
avkmgr
ssmdrv

Error: (06/10/2014 05:12:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/10/2014 05:12:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Avira Planer" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/10/2014 05:12:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avgntflt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/10/2014 00:04:02 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%2

Error: (06/10/2014 00:04:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMProtector" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/10/2014 00:02:00 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
avipbb
avkmgr
ssmdrv

Error: (06/10/2014 00:01:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (06/10/2014 00:46:55 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/10/2014 00:46:41 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Officejet 4620 series\DriverStore\Pipeline\amd64\hpinkins6412.exe

Error: (06/09/2014 05:31:29 PM) (Source: EventSystem) (EventID: 4622) (User: )
Description: 80070005{E33F90D5-CE87-46AD-98B8-202930AE544A}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (06/09/2014 01:35:28 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/09/2014 01:35:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Officejet 4620 series\DriverStore\Pipeline\amd64\hpinkins6412.exe

Error: (06/08/2014 04:06:07 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Officejet 4620 series\DriverStore\Pipeline\amd64\hpinkins6412.exe

Error: (06/08/2014 03:24:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: avgnt.exe14.0.4.620536111d1mfc120u.dll12.0.21005.1524fabbdc000000500239c73dc801cf831b92812d01C:\Program Files\Avira\AntiVir Desktop\avgnt.exeC:\Program Files\Avira\AntiVir Desktop\mfc120u.dll2bd7093c-ef10-11e3-9fb9-00242102d82d


CodeIntegrity Errors:
===================================
  Date: 2014-06-05 20:16:36.432
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Malwarebytes' Anti-Malware\mbampt.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 38%
Total physical RAM: 3326.18 MB
Available physical RAM: 2055.38 MB
Total Pagefile: 6650.63 MB
Available Pagefile: 5339.37 MB
Total Virtual: 2047.88 MB
Available Virtual: 1903.86 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:900.41 GB) (Free:697.49 GB) NTFS
Drive d: (Recover) (Fixed) (Total:30 GB) (Free:9.98 GB) NTFS
Drive f: (zweite-300-platte) (Fixed) (Total:279.48 GB) (Free:44.92 GB) NTFS
Drive k: (GEORG-V2) (Removable) (Total:1.86 GB) (Free:1.48 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 168AF31D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=900 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

========================================================
Disk: 1 (Size: 279 GB) (Disk ID: 837B837B)
Partition 1: (Active) - (Size=279 GB) - (Type=07 NTFS)

========================================================
Disk: 5 (MBR Code: Windows XP) (Size: 2 GB) (Disk ID: 30A1FECE)
Partition 1: (Active) - (Size=2 GB) - (Type=0B)

==================== End Of Log ============================

--- --- ---

Zitat:

Was meinst du mit Abschlussbereinigung feststellen?

Damit meinte ich deine Vorschläge von tag #12
z.B. Java updaten, Software löschen etc.
Diese hatte ich noch nicht gemacht, solange noch Probleme da waren.

M-K-D-B · 11.06.2014, 10:41

Ja, kannst du machen.

Noch Probleme?

ghegon · 11.06.2014, 11:17

Hallo,

wie gesagt. Audio bekomme ich nicht mehr zum Laufen.
Kein Ton aus den Lautsprechern mehr.

Vielen Dank für die Geduld mir zu helfen.

M-K-D-B · 11.06.2014, 11:20

Mach mal folgendes:

Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop:
SystemLook (32 bit) | SystemLook (64 bit)

Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
Code:
ATTFilter
```
:filefind
audiodg.exe
         
```
Klicke nun auf den Button Look, um den Scan zu starten.
Der Suchlauf kann einige Zeit dauern.
Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
Die Ergebnisse werden auch auf dem Desktop als SystemLook.txt gespeichert.

ghegon · 11.06.2014, 14:37

Code:

ATTFilter

SystemLook 30.07.11 by jpshortstuff
Log created at 15:33 on 11/06/2014 by georg
Administrator - Elevation successful

========== filefind ==========

Searching for "audiodg.exe"
No files found.

-= EOF =-

M-K-D-B · 12.06.2014, 09:08

Servus,

Ganz Wichtig:
Windows 7 Service Pack 1 über Systemsteuerung > System und Sicherheit > Windows Update > Nach Updates suchen downloaden und installieren.

Danach sollte Sound wieder gehen.

Gib mir Bescheid.

09.06.2014, 10:25	#16
M-K-D-B /// TB-Ausbilder	Windows7 : Mehrere Trojaner nach Malwarebytes scan Wieso postest du mir nochmal diese Logdatei? Meine letzte Antwort gelesen?

09.06.2014, 10:30	#18
M-K-D-B /// TB-Ausbilder	Windows7 : Mehrere Trojaner nach Malwarebytes scan kein Problem. __________________

10.06.2014, 08:17	#24
M-K-D-B /// TB-Ausbilder	Windows7 : Mehrere Trojaner nach Malwarebytes scan Was meinst du mit Abschlussbereinigung feststellen? Mach mal bitte FRST logfile nochmal: Starte die FRST.exe erneut. Setze einen Haken vor Addition und drücke auf Scan. FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt). Poste mir beide Logdateien mit deiner nächsten Antwort.

11.06.2014, 10:41	#26
M-K-D-B /// TB-Ausbilder	Windows7 : Mehrere Trojaner nach Malwarebytes scan Ja, kannst du machen. Noch Probleme?

12.06.2014, 09:08	#30
M-K-D-B /// TB-Ausbilder	Windows7 : Mehrere Trojaner nach Malwarebytes scan Servus, Ganz Wichtig: Windows 7 Service Pack 1 über Systemsteuerung > System und Sicherheit > Windows Update > Nach Updates suchen downloaden und installieren. Danach sollte Sound wieder gehen. Gib mir Bescheid.

Windows7 : Mehrere Trojaner nach Malwarebytes scan

Log-Analyse und Auswertung: Windows7 : Mehrere Trojaner nach Malwarebytes scan