Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 19.09.2014, 23:10   #1
Dunkelheit
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Hallo,

nachdem ich festgestellt hatte, daß ich seit einigen Wochen (!) eine echt üble Internet-Verbindung habe (abends zwischen 20:00 Uhr und ca. 00:00 Uhr) mit einer Latenz von teilweise 300-400 ms UND mir aufgefallen ist, daß Antivir irgendwie kein Update zulässt

(der Butten: "Update starten" ist schlicht nicht klickbar) habe ich einmal Malwarebytes Antimalware drüberlaufen lassen - mit folgendem Ergebnis:

Zitat:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 19.09.2014
Scan Time: 21:59:23
Logfile: mwbantimalwareScan.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.09.19.06
Rootkit Database: v2014.09.18.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: benutzer2

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 345395
Time Elapsed: 12 min, 11 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.Softonic.A, HKU\S-1-5-21-2842033744-104979599-978530037-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, Delete-on-Reboot, [d7ab0de24734ad89f412bb6df3102dd3],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 5
PUP.Optional.InstallCore, C:\Program Files (x86)\FreeYouTubeToMP3TURBOConverter\tsasetup.exe, Quarantined, [136fce2127542e082764397b28d92cd4],
Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe, Quarantined, [0d7548a7512a2d095c8c070933d2649c],
PUP.Optional.ToolBarInstaller, C:\Users\benutzer2\Downloads\MoviesSetup(1).exe, Quarantined, [354da34cf08b54e26fbe732c768b867a],
PUP.Optional.ToolBarInstaller, C:\Users\benutzer2\Downloads\MoviesSetup.exe, Quarantined, [83ff737c2f4cd26469c40f9041c07f81],
PUP.Optional.Softonic, C:\Users\benutzer2\Downloads\SoftonicDownloader_fuer_finanzierungsrechner.exe, Quarantined, [4042c52abfbcfe386d72a4136998857b],

Physical Sectors: 0
(No malicious items detected)


(end)
Ich muss dazu sagen, daß meine Kinder auch Zugang zum Rechner haben, normalerweise aber nichts anstellen, also installieren und dergleichen, sondern einschlägige Spieleseiten ansteuern.

Da mein Avira Antivir immer noch keine Updates zulässt, ist mir denkbar unwohl bei der Sache.

Aufgefallen ist mir die Sache, weil meine Latenz die letzten Wochen sonst unerreichte Höhen erklommen hat (300-400 ms teilweise) und die DL-Rate teilweise mit der UL-Rate gleichzog - mit 600-700 kbit/s wirklich mau war für eine 6k-Leitung, die sonst einiges mehr brachte - vor allem nicht mit Totaleinbrüchen um 20:00 Uhr - 00:00 Uhr herum :-/

Im Anhang befinden sich die Resultate von FRST und Addition, sowie gmerlog.

Hoffentlich muss ich nicht wieder das ganze Dingens aufsetzen.

Vielen Dank vorab für eure werte Mühe,

Gruß
Dunkelheit

Alt 20.09.2014, 00:27   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Hi und

Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 20.09.2014, 08:38   #3
Dunkelheit
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



OK,

also hier die FRST - Logdatei:



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by benutzer2 (administrator) on BENUTZER2-PC on 19-09-2014 22:05:31
Running from C:\Users\benutzer2\Downloads
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7191768 2013-06-27] (Realtek Semiconductor)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2842033744-104979599-978530037-1000\...\Run: [Pando Media Booster] => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-11-22] ()
HKU\S-1-5-21-2842033744-104979599-978530037-1000\...\MountPoints2: D - D:\autorun.exe
HKU\S-1-5-21-2842033744-104979599-978530037-1000\...\MountPoints2: {0882e723-e4de-11e3-81ac-806e6f6e6963} - D:\autorun.exe
HKU\S-1-5-21-2842033744-104979599-978530037-1000\...\MountPoints2: {24ee5073-b801-11dc-ae06-806e6f6e6963} - D:\SETUP.EXE
HKU\S-1-5-21-2842033744-104979599-978530037-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Pando Media Booster] => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-11-22] ()
HKU\S-1-5-21-2842033744-104979599-978530037-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: D - D:\autorun.exe
HKU\S-1-5-21-2842033744-104979599-978530037-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {0882e723-e4de-11e3-81ac-806e6f6e6963} - D:\autorun.exe
HKU\S-1-5-21-2842033744-104979599-978530037-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {24ee5073-b801-11dc-ae06-806e6f6e6963} - D:\SETUP.EXE
BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default
FF DefaultSearchEngine: Ixquick HTTPS
FF SelectedSearchEngine: Ixquick HTTPS
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\searchplugins\avira-safesearch.xml
FF SearchPlugin: C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\searchplugins\ixquick-https.xml
FF SearchPlugin: C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\searchplugins\startpage-ssl.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\abs@avira.com [2014-08-29]
FF Extension: Xmarks - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\foxmarks@kei.com [2014-07-30]
FF Extension: Avira SafeSearch - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\safesearch@avira.com [2014-08-05]
FF Extension: LastPass - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\support@lastpass.com [2014-04-10]
FF Extension: Cookie Monster - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi [2013-11-22]
FF Extension: NoScript - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-11-21]
FF Extension: Adblock Plus - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-21]
FF HKLM-x32\...\Firefox\Extensions: [downloader@freeyoutubetomp3converter.org] - C:\Program Files (x86)\FreeYouTubeToMP3TURBOConverter\Firefox
FF Extension: FreeYouTubeToMP3TURBOConverter plugin for Mozilla Firefox - C:\Program Files (x86)\FreeYouTubeToMP3TURBOConverter\Firefox [2014-03-27]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-08-06] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-08-22] (Hi-Rez Studios) [File not signed]
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-09-12] (SurfRight B.V.)
R2 postgresql-x64-9.0; C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N "postgresql-x64-9.0" -D "C:/Program Files/PostgreSQL/9.0/data" -w [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 acedrv10; C:\Windows\system32\drivers\acedrv10.sys [277904 2014-05-26] (Protect Software GmbH)
S2 acehlp10; C:\Windows\system32\drivers\acehlp10.sys [228000 2014-05-26] (Protect Software GmbH)
R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-15] (Avira Operations GmbH & Co. KG)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-19] (Malwarebytes Corporation)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-19 22:05 - 2014-09-19 22:05 - 00014395 _____ () C:\Users\benutzer2\Downloads\FRST.txt
2014-09-19 22:05 - 2014-09-19 22:05 - 00000000 ____D () C:\FRST
2014-09-19 22:04 - 2014-09-19 22:05 - 02105856 _____ (Farbar) C:\Users\benutzer2\Downloads\FRST64.exe
2014-09-19 22:04 - 2014-09-19 22:04 - 00000480 _____ () C:\Users\benutzer2\Downloads\defogger_disable.log
2014-09-19 22:04 - 2014-09-19 22:04 - 00000000 _____ () C:\Users\benutzer2\defogger_reenable
2014-09-19 22:03 - 2014-09-19 22:03 - 00050477 _____ () C:\Users\benutzer2\Downloads\Defogger.exe
2014-09-19 21:48 - 2014-09-19 21:48 - 00008359 _____ () C:\Users\benutzer2\Downloads\hijackthis.log
2014-09-19 21:48 - 2014-09-19 21:48 - 00008359 _____ () C:\Users\benutzer2\Desktop\hijackthis.log
2014-09-19 21:47 - 2014-09-19 21:47 - 00388608 _____ (Trend Micro Inc.) C:\Users\benutzer2\Downloads\HijackThis.exe
2014-09-18 22:39 - 2014-09-18 22:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-17 10:56 - 2014-09-17 10:56 - 00000028 _____ () C:\Users\benutzer2\Desktop\Neues Textdokument (2).txt
2014-09-14 03:05 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-14 03:05 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-14 03:05 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-14 03:05 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-14 03:05 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-14 03:05 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-14 03:05 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-14 03:05 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-14 03:05 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-14 03:05 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-14 03:05 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-14 03:05 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-14 03:05 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-14 03:05 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-14 03:05 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-14 03:05 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-14 03:05 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-14 03:05 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-14 03:05 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-14 03:05 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-14 03:05 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-14 03:05 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-14 03:05 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-14 03:05 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-14 03:05 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-14 03:05 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-14 03:05 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-14 03:05 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-14 03:05 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-14 03:05 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-14 03:05 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-14 03:05 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-14 03:05 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-14 03:05 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-14 03:05 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-14 03:05 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-14 03:05 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-14 03:05 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-14 03:05 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-14 03:05 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-14 03:05 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-14 03:05 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-14 03:05 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-14 03:05 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-14 03:05 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-14 03:05 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-14 03:05 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-14 03:05 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-14 03:05 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-14 03:05 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-14 03:05 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-14 03:05 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-14 03:05 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-14 03:05 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-14 03:05 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-14 03:05 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-14 03:01 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-14 03:01 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-12 11:18 - 2014-09-12 11:18 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-09-12 11:18 - 2014-09-12 11:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-09-12 11:07 - 2014-09-12 11:18 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-09-12 09:47 - 2014-09-12 09:48 - 17703856 _____ (Adobe Systems Inc.) C:\Users\benutzer2\Downloads\AdobeAIRInstaller(1).exe
2014-09-12 09:39 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-12 09:39 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-12 09:38 - 2014-09-12 09:38 - 34888568 _____ (Riot Games) C:\Users\benutzer2\Downloads\LeagueofLegends_EUW_Installer_06_12_13(3).exe
2014-09-12 09:38 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-12 09:38 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-12 09:35 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-12 09:35 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-12 09:35 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-12 09:35 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-12 09:35 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-12 09:34 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-12 09:34 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-12 09:31 - 2014-09-12 09:31 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-11 12:52 - 2014-05-03 14:25 - 00040960 ____H (-) C:\Windows\SysWOW64\svchosptd.exe
2014-09-11 12:49 - 2014-09-12 09:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinTimer 3
2014-09-11 12:49 - 2014-09-12 09:22 - 00000000 ____D () C:\Program Files\WinTimer
2014-09-06 02:05 - 2014-09-06 02:14 - 00000385 _____ () C:\Users\benutzer2\Desktop\turmholzdeckestatik.txt
2014-09-04 15:48 - 2014-09-04 15:48 - 00000000 _____ () C:\Users\benutzer2\Desktop\1003402560.txt
2014-09-01 20:33 - 2014-09-01 20:33 - 00007334 _____ () C:\Users\benutzer2\Desktop\route.odt
2014-09-01 20:25 - 2014-09-01 20:25 - 00002564 _____ () C:\Users\benutzer2\Desktop\kredit haus garten turm.xml
2014-09-01 20:00 - 2014-09-01 20:00 - 00000884 _____ () C:\Users\benutzer2\Desktop\finanzierung - haus garten turm.xml
2014-09-01 19:56 - 2014-09-12 09:23 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unknown
2014-09-01 19:56 - 2014-09-12 09:23 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\BaufiFX 1.4
2014-09-01 19:56 - 2014-09-01 19:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\de.thomasbolz.baufi.BaufiMain
2014-09-01 19:54 - 2014-09-01 19:56 - 64137872 _____ (Unknown ) C:\Users\benutzer2\Desktop\BaufiFX.exe
2014-09-01 19:53 - 2014-09-01 19:53 - 00367472 _____ () C:\Users\benutzer2\Downloads\SoftonicDownloader_fuer_finanzierungsrechner.exe
2014-09-01 19:42 - 2014-09-08 13:51 - 00001030 _____ () C:\Users\benutzer2\Desktop\Neues Textdokument.txt
2014-08-28 09:00 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 09:00 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 09:00 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-24 01:10 - 2014-08-24 01:10 - 02394944 _____ (Xacti, LLC ) C:\Users\benutzer2\Downloads\MoviesSetup.exe
2014-08-24 01:10 - 2014-08-24 01:10 - 02394944 _____ (Xacti, LLC ) C:\Users\benutzer2\Downloads\MoviesSetup(1).exe
2014-08-21 13:07 - 2014-08-21 13:07 - 00001990 _____ () C:\Users\benutzer2\Desktop\putingedicht.txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-19 22:05 - 2014-09-19 22:05 - 00014395 _____ () C:\Users\benutzer2\Downloads\FRST.txt
2014-09-19 22:05 - 2014-09-19 22:05 - 00000000 ____D () C:\FRST
2014-09-19 22:05 - 2014-09-19 22:04 - 02105856 _____ (Farbar) C:\Users\benutzer2\Downloads\FRST64.exe
2014-09-19 22:05 - 2013-11-22 00:37 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\PMB Files
2014-09-19 22:04 - 2014-09-19 22:04 - 00000480 _____ () C:\Users\benutzer2\Downloads\defogger_disable.log
2014-09-19 22:04 - 2014-09-19 22:04 - 00000000 _____ () C:\Users\benutzer2\defogger_reenable
2014-09-19 22:04 - 2013-11-21 19:53 - 00000000 ____D () C:\Users\benutzer2
2014-09-19 22:03 - 2014-09-19 22:03 - 00050477 _____ () C:\Users\benutzer2\Downloads\Defogger.exe
2014-09-19 22:02 - 2009-07-14 06:45 - 00027168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-19 22:02 - 2009-07-14 06:45 - 00027168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-19 21:59 - 2008-01-01 02:36 - 01140084 _____ () C:\Windows\WindowsUpdate.log
2014-09-19 21:57 - 2014-07-01 16:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-19 21:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-19 21:52 - 2009-07-14 06:51 - 00111247 _____ () C:\Windows\setupact.log
2014-09-19 21:48 - 2014-09-19 21:48 - 00008359 _____ () C:\Users\benutzer2\Downloads\hijackthis.log
2014-09-19 21:48 - 2014-09-19 21:48 - 00008359 _____ () C:\Users\benutzer2\Desktop\hijackthis.log
2014-09-19 21:48 - 2013-11-21 19:53 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\VirtualStore
2014-09-19 21:47 - 2014-09-19 21:47 - 00388608 _____ (Trend Micro Inc.) C:\Users\benutzer2\Downloads\HijackThis.exe
2014-09-19 21:27 - 2013-11-21 22:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-19 20:53 - 2013-11-22 00:37 - 00000000 ____D () C:\ProgramData\PMB Files
2014-09-19 19:19 - 2014-01-10 20:22 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\.minecraft
2014-09-19 19:18 - 2014-07-07 13:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-19 16:49 - 2013-11-21 23:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-19 16:49 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-18 22:39 - 2014-09-18 22:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-18 20:23 - 2014-01-19 17:22 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\Battle.net
2014-09-18 20:00 - 2013-11-21 22:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\vlc
2014-09-18 19:59 - 2014-03-17 07:18 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-17 10:56 - 2014-09-17 10:56 - 00000028 _____ () C:\Users\benutzer2\Desktop\Neues Textdokument (2).txt
2014-09-14 10:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-14 03:04 - 2014-02-28 13:21 - 01592628 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-14 03:04 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-09-14 03:04 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-09-14 03:04 - 2009-07-14 07:13 - 01592628 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-14 03:03 - 2013-12-05 06:30 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-14 03:02 - 2013-12-05 06:30 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-14 03:00 - 2014-04-30 03:43 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-13 11:27 - 2013-11-21 22:59 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-13 11:27 - 2013-11-21 22:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-13 11:27 - 2013-11-21 22:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-12 11:20 - 2013-11-22 00:47 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Riot Games
2014-09-12 11:18 - 2014-09-12 11:18 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-09-12 11:18 - 2014-09-12 11:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-09-12 11:18 - 2014-09-12 11:07 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-09-12 09:48 - 2014-09-12 09:47 - 17703856 _____ (Adobe Systems Inc.) C:\Users\benutzer2\Downloads\AdobeAIRInstaller(1).exe
2014-09-12 09:48 - 2014-07-07 13:51 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\Adobe
2014-09-12 09:48 - 2014-07-07 13:47 - 00000000 ____D () C:\ProgramData\Adobe
2014-09-12 09:48 - 2014-07-07 13:47 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-09-12 09:48 - 2013-11-21 23:02 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Adobe
2014-09-12 09:38 - 2014-09-12 09:38 - 34888568 _____ (Riot Games) C:\Users\benutzer2\Downloads\LeagueofLegends_EUW_Installer_06_12_13(3).exe
2014-09-12 09:32 - 2014-08-05 09:27 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-12 09:31 - 2014-09-12 09:31 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-12 09:31 - 2013-11-22 00:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-12 09:24 - 2014-08-09 12:59 - 00000000 ____D () C:\Users\postgres
2014-09-12 09:23 - 2014-09-01 19:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unknown
2014-09-12 09:23 - 2014-09-01 19:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\BaufiFX 1.4
2014-09-12 09:23 - 2014-06-03 18:45 - 00000000 ____D () C:\Users\benutzer2\Desktop\stick
2014-09-12 09:23 - 2014-01-19 17:22 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Battle.net
2014-09-12 09:23 - 2013-11-21 22:58 - 00000000 ____D () C:\Windows\system32\Macromed
2014-09-12 09:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas
2014-09-12 09:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-09-12 09:22 - 2014-09-11 12:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinTimer 3
2014-09-12 09:22 - 2014-09-11 12:49 - 00000000 ____D () C:\Program Files\WinTimer
2014-09-12 09:22 - 2014-04-29 23:13 - 00000000 ____D () C:\Program Files\HitmanPro
2014-09-12 09:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-09-12 09:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-09-12 09:18 - 2013-11-21 22:22 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-08 13:51 - 2014-09-01 19:42 - 00001030 _____ () C:\Users\benutzer2\Desktop\Neues Textdokument.txt
2014-09-06 02:14 - 2014-09-06 02:05 - 00000385 _____ () C:\Users\benutzer2\Desktop\turmholzdeckestatik.txt
2014-09-05 04:10 - 2014-09-12 09:34 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-12 09:34 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-04 15:48 - 2014-09-04 15:48 - 00000000 _____ () C:\Users\benutzer2\Desktop\1003402560.txt
2014-09-01 20:33 - 2014-09-01 20:33 - 00007334 _____ () C:\Users\benutzer2\Desktop\route.odt
2014-09-01 20:25 - 2014-09-01 20:25 - 00002564 _____ () C:\Users\benutzer2\Desktop\kredit haus garten turm.xml
2014-09-01 20:00 - 2014-09-01 20:00 - 00000884 _____ () C:\Users\benutzer2\Desktop\finanzierung - haus garten turm.xml
2014-09-01 19:56 - 2014-09-01 19:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\de.thomasbolz.baufi.BaufiMain
2014-09-01 19:56 - 2014-09-01 19:54 - 64137872 _____ (Unknown ) C:\Users\benutzer2\Desktop\BaufiFX.exe
2014-09-01 19:53 - 2014-09-01 19:53 - 00367472 _____ () C:\Users\benutzer2\Downloads\SoftonicDownloader_fuer_finanzierungsrechner.exe
2014-08-29 13:22 - 2014-07-17 18:20 - 00000000 ____D () C:\Users\benutzer2\Documents\888poker
2014-08-28 12:00 - 2009-07-14 06:45 - 00298904 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 09:52 - 2014-03-08 18:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\Microsoft Games
2014-08-25 06:53 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 01:10 - 2014-08-24 01:10 - 02394944 _____ (Xacti, LLC ) C:\Users\benutzer2\Downloads\MoviesSetup.exe
2014-08-24 01:10 - 2014-08-24 01:10 - 02394944 _____ (Xacti, LLC ) C:\Users\benutzer2\Downloads\MoviesSetup(1).exe
2014-08-23 04:07 - 2014-08-28 09:00 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 09:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 09:00 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 19:02 - 2014-06-05 21:22 - 00000000 ____D () C:\Users\benutzer2\Desktop\mp3s
2014-08-22 17:59 - 2014-04-10 19:27 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Skype
2014-08-21 13:07 - 2014-08-21 13:07 - 00001990 _____ () C:\Users\benutzer2\Desktop\putingedicht.txt

Some content of TEMP:
====================
C:\Users\benutzer2\AppData\Local\Temp\AskSLib.dll
C:\Users\benutzer2\AppData\Local\Temp\avgnt.exe
C:\Users\benutzer2\AppData\Local\Temp\devcon64.exe
C:\Users\benutzer2\AppData\Local\Temp\HiPatchSelfUpdateWindow.exe
C:\Users\benutzer2\AppData\Local\Temp\HiRezLauncherControls.dll
C:\Users\benutzer2\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\benutzer2\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\benutzer2\AppData\Local\Temp\Quarantine.exe
C:\Users\benutzer2\AppData\Local\Temp\SandboxieInstall.exe
C:\Users\benutzer2\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\benutzer2\AppData\Local\Temp\vcredist_x64.exe
C:\Users\benutzer2\AppData\Local\Temp\vlc-2.1.4-win64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-17 17:52

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---


------------------------------------------------------------------------------------

Addition:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by benutzer2 at 2014-09-19 22:06:09
Running from C:\Users\benutzer2\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

888poker (HKLM-x32\...\888poker) (Version:  - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.249 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 15.0.0.249 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{AF88A32E-BC54-2AA3-2FC8-D63D86DF4A7A}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2012.0806.1213.19931 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.70727.2220 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2012.0806.1213.19931 - Ihr Firmenname) Hidden
AutoHotkey 1.0.48.05 (HKLM-x32\...\AutoHotkey) (Version: 1.0.48.05 - Chris Mallett)
Avira (HKLM-x32\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4489 - APN, LLC)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BaufiFX 1.4 (HKCU\...\{BaufiMain}}_is1) (Version: 1.4 - Unknown)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0806.1213.19931 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0806.1213.19931 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0806.1213.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0806.1213.19931 - Advanced Micro Devices, Inc.) Hidden
Don't Starve (HKLM-x32\...\DontStarve) (Version:  - Klei Entertainment)
Don't Starve (HKLM-x32\...\Steam App 219740) (Version:  - Klei Entertainment)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
File Type Assistant (HKLM-x32\...\Trusted Software Assistant_is1) (Version: 2014.5.6.0 - ) <==== ATTENTION
Free YouTube to MP3 TURBO Converter 2013 (HKLM-x32\...\FreeYoutubeToMP3TURBOConverter_is1) (Version:  - Bitberry Software)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.225 - SurfRight B.V.)
ICM Trainer (HKLM-x32\...\{47EA4DDF-FD99-46B3-846C-9F3F315268AD}) (Version: 1.0.0 - PokerStrategy)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.650 - Oracle)
Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mein Paradies für Hunde (HKCU\...\Mein Paradies für Hunde) (Version: V1.000000 - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.2 (x86 de)) (Version: 32.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OMC ModPack Version 0.9.1.0 (HKLM-x32\...\{6C38BB40-8A08-4238-89AA-4EED5FC11549}_is1) (Version: 0.9.1.0 - Odem Mortis)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.9 - Pando Networks Inc.)
Path of Exile (HKLM-x32\...\{90A4562F-D4A1-4B65-906D-41F236CF6902}) (Version: 1.1.5.34983 - Grinding Gear Games)
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
PokerStrategy.com Equilab (HKLM-x32\...\{86D09F48-CDAB-4B4C-8806-F6C16F17935A}) (Version: 1.2.8.0 - PokerStrategy.com)
PokerTracker 4 (remove only) (HKLM-x32\...\PokerTracker4) (Version:  - )
PostgreSQL 9.0  (HKLM\...\PostgreSQL 9.0) (Version: 9.0 - PostgreSQL Global Development Group)
ProtectDisc Helper Driver 10 (HKLM-x32\...\ProtectDisc Driver 10) (Version: 10.0.0.3 - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.72.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6959 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2247.4 - Hi-Rez Studios)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 2 RC2 (HKLM-x32\...\Teamspeak 2 RC2_is1) (Version: 2.0.32.60 - Dominating Bytes Design)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
William Hill Poker (HKCU\...\William Hill Poker) (Version:  - )
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

==================== Restore Points  =========================

12-09-2014 07:38:07 Windows Update
12-09-2014 09:07:00 Installed League of Legends
12-09-2014 09:17:55 Installed League of Legends
12-09-2014 09:19:53 DirectX wurde installiert
14-09-2014 01:00:25 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1223897E-BF4F-41F7-B875-0BDFA4104D54} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-13] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-08-06 13:24 - 2012-08-06 13:24 - 00212480 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2012-03-05 17:03 - 2012-03-05 17:03 - 00677376 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2012-02-16 15:53 - 2012-02-16 15:53 - 03642880 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2014-08-09 12:47 - 2012-09-21 09:55 - 00217600 _____ () C:\Program Files\PostgreSQL\9.0\bin\LIBPQ.dll
2014-08-09 12:47 - 2012-08-14 14:02 - 02258432 _____ () C:\Program Files\PostgreSQL\9.0\bin\libxml2.dll
2013-11-22 00:37 - 2013-11-22 00:37 - 04287536 _____ () C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
2012-08-06 13:24 - 2012-08-06 13:24 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2012-08-06 13:07 - 2012-08-06 13:07 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-08-05 09:27 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\benutzer2\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-09-18 22:39 - 2014-09-18 22:39 - 03734640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-04-10 19:36 - 2014-04-10 19:36 - 01020928 _____ () C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/19/2014 09:54:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 09:51:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0, Zeitstempel: 0x501fefb5
Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0, Zeitstempel: 0x4f55e10b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000033c1
ID des fehlerhaften Prozesses: 0x770
Startzeit der fehlerhaften Anwendung: 0xFuel.Service.exe0
Pfad der fehlerhaften Anwendung: Fuel.Service.exe1
Pfad des fehlerhaften Moduls: Fuel.Service.exe2
Berichtskennung: Fuel.Service.exe3

Error: (09/19/2014 07:17:54 PM) (Source: MsiInstaller) (EventID: 1024) (User: benutzer2-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127

Error: (09/19/2014 07:12:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 04:55:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0, Zeitstempel: 0x501fefb5
Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0, Zeitstempel: 0x4f55e10b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000033c1
ID des fehlerhaften Prozesses: 0x77c
Startzeit der fehlerhaften Anwendung: 0xFuel.Service.exe0
Pfad der fehlerhaften Anwendung: Fuel.Service.exe1
Pfad des fehlerhaften Moduls: Fuel.Service.exe2
Berichtskennung: Fuel.Service.exe3

Error: (09/19/2014 04:50:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 01:57:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0, Zeitstempel: 0x501fefb5
Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0, Zeitstempel: 0x4f55e10b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000033c1
ID des fehlerhaften Prozesses: 0x764
Startzeit der fehlerhaften Anwendung: 0xFuel.Service.exe0
Pfad der fehlerhaften Anwendung: Fuel.Service.exe1
Pfad des fehlerhaften Moduls: Fuel.Service.exe2
Berichtskennung: Fuel.Service.exe3

Error: (09/16/2014 03:42:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/16/2014 03:37:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0, Zeitstempel: 0x501fefb5
Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0, Zeitstempel: 0x4f55e10b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000033c1
ID des fehlerhaften Prozesses: 0x77c
Startzeit der fehlerhaften Anwendung: 0xFuel.Service.exe0
Pfad der fehlerhaften Anwendung: Fuel.Service.exe1
Pfad des fehlerhaften Moduls: Fuel.Service.exe2
Berichtskennung: Fuel.Service.exe3

Error: (09/16/2014 01:32:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: wwanapi.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5be0a8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000333eb
ID des fehlerhaften Prozesses: 0x990
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3


System errors:
=============
Error: (09/19/2014 09:54:07 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (09/19/2014 09:54:07 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde mit folgendem dienstspezifischem Fehler beendet: %%4.

Error: (09/19/2014 09:51:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (09/19/2014 07:11:15 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (09/19/2014 07:11:15 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde mit folgendem dienstspezifischem Fehler beendet: %%4.

Error: (09/19/2014 04:55:48 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (09/19/2014 04:49:45 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (09/19/2014 04:49:45 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde mit folgendem dienstspezifischem Fehler beendet: %%4.

Error: (09/19/2014 01:57:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (09/19/2014 06:43:32 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.


Microsoft Office Sessions:
=========================
Error: (09/19/2014 09:54:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 09:51:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fuel.Service.exe1.0.0.0501fefb5Device.dll4.1.0.04f55e10bc000000500000000000033c177001cfd42c9d586965C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll65589906-4036-11e4-be08-448a5b21a980

Error: (09/19/2014 07:17:54 PM) (Source: MsiInstaller) (EventID: 1024) (User: benutzer2-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)

Error: (09/19/2014 07:12:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 04:55:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fuel.Service.exe1.0.0.0501fefb5Device.dll4.1.0.04f55e10bc000000500000000000033c177c01cfd418de17f0ffC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll09b6ddb3-400d-11e4-8d95-448a5b21a980

Error: (09/19/2014 04:50:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 01:57:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fuel.Service.exe1.0.0.0501fefb5Device.dll4.1.0.04f55e10bc000000500000000000033c176401cfd1b3c1d7e46fC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll25dcb1ca-3ff4-11e4-be02-448a5b21a980

Error: (09/16/2014 03:42:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/16/2014 03:37:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fuel.Service.exe1.0.0.0501fefb5Device.dll4.1.0.04f55e10bc000000500000000000033c177c01cfd1a15ba66218C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeC:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dlla704b5a2-3da6-11e4-82b0-448a5b21a980

Error: (09/16/2014 01:32:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4wwanapi.dll6.1.7600.163854a5be0a8c000000500000000000333eb99001cfd1a163284ab8C:\Windows\Explorer.EXEC:\Windows\system32\wwanapi.dll14b7e0d4-3d95-11e4-82b0-448a5b21a980


==================== Memory info =========================== 

Processor: AMD FX(tm)-6300 Six-Core Processor 
Percentage of memory in use: 27%
Total physical RAM: 8140.05 MB
Available physical RAM: 5893.85 MB
Total Pagefile: 16278.29 MB
Available Pagefile: 12036.17 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:113.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 25580574)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
-------------------------------------------------------------------------------------

gmerlog:

GMER Logfile:
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-19 22:41:10
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200AZDX-00SC2B0 rev.01.01A01 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\BENUTZ~1\AppData\Local\Temp\fwddquob.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2544] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter  0000000075218791 5 bytes [33, C0, C2, 04, 00]

---- EOF - GMER 2.1 ----
         
--- --- ---

--------------------------------------------------------------------------------------

Und hier noch ein HIJACKTHIS - Log:

HiJackthis Logfile:
Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:48:33, on 19.09.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17280)

FIREFOX: 32.0.2 (x86 de)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
C:\Users\benutzer2\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AMD SteadyVideo BHO - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {41564952-412D-5637-00A7-7A786E7484D7} - (no file)
O4 - HKLM\..\Run: [RUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O9 - Extra button: Download Video - {B30C9F17-BF16-481e-BAEA-44A86128E1B4} - C:\Program Files (x86)\FreeYouTubeToMP3TURBOConverter\ytmRunner.html
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Echtzeit-Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Browser-Schutz (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
O23 - Service: HitmanPro Scheduler (HitmanProScheduler) - SurfRight B.V. - C:\Program Files\HitmanPro\hmpsched.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: postgresql-x64-9.0 - PostgreSQL Server 9.0 (postgresql-x64-9.0) - PostgreSQL Global Development Group - C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Sandboxie Service (SbieSvc) - Sandboxie Holdings, LLC - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8358 bytes
         
--- --- ---


-----------------------------------------------------------------------------------------

Defogger:

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:45 on 19/09/2014 (benutzer2)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         
-------------------------------------------------------------------------------------
__________________

Alt 20.09.2014, 16:06   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Dann bitte jetzt Combofix ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
Logs bitte immer in CODE-Tags posten

Alt 20.09.2014, 20:33   #5
Dunkelheit
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



hi,

ComboFix-Log

Code:
ATTFilter
ComboFix 14-09-18.01 - benutzer2 20.09.2014  20:12:32.1.6 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.8140.6078 [GMT 2:00]
ausgeführt von:: c:\users\benutzer2\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\BENUTZ~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\benutzer2\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-08-20 bis 2014-09-20  ))))))))))))))))))))))))))))))
.
.
2014-09-20 06:33 . 2014-09-09 02:05	11578928	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{0627C206-A9D8-4F93-B72F-51DF7FB16402}\mpengine.dll
2014-09-19 20:41 . 2014-09-19 20:41	--------	d-----w-	c:\users\benutzer2\AppData\Local\ElevatedDiagnostics
2014-09-19 20:41 . 2014-09-19 20:41	--------	d-----w-	c:\users\benutzer2\AppData\Local\Diagnostics
2014-09-19 20:05 . 2014-09-19 20:06	--------	d-----w-	C:\FRST
2014-09-14 01:01 . 2014-06-27 02:08	2777088	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2014-09-14 01:01 . 2014-06-27 01:45	2285056	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-12 09:07 . 2014-09-12 09:18	--------	d-sh--w-	c:\windows\SysWow64\AI_RecycleBin
2014-09-12 07:48 . 2014-09-12 07:48	--------	d-----w-	c:\program files (x86)\Common Files\Adobe AIR
2014-09-12 07:39 . 2014-08-01 11:53	1031168	----a-w-	c:\windows\system32\TSWorkspace.dll
2014-09-12 07:39 . 2014-08-01 11:35	793600	----a-w-	c:\windows\SysWow64\TSWorkspace.dll
2014-09-12 07:38 . 2014-06-24 03:29	2565120	----a-w-	c:\windows\system32\d3d10warp.dll
2014-09-12 07:38 . 2014-06-24 02:59	1987584	----a-w-	c:\windows\SysWow64\d3d10warp.dll
2014-09-12 07:35 . 2014-07-07 02:06	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-09-12 07:35 . 2014-07-07 02:06	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-09-12 07:35 . 2014-07-07 01:40	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-09-12 07:35 . 2014-07-07 01:40	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-09-12 07:35 . 2014-07-07 01:39	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-09-12 07:34 . 2014-09-05 02:10	578048	----a-w-	c:\windows\system32\aepdu.dll
2014-09-12 07:34 . 2014-09-05 02:05	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-09-11 10:49 . 2014-09-12 07:22	--------	d-----w-	c:\program files\WinTimer
2014-09-01 17:56 . 2014-09-01 17:56	--------	d-----w-	c:\users\benutzer2\AppData\Roaming\de.thomasbolz.baufi.BaufiMain
2014-09-01 17:56 . 2014-09-12 07:23	--------	d-----w-	c:\users\benutzer2\AppData\Local\BaufiFX 1.4
2014-08-28 07:00 . 2014-08-23 02:07	404480	----a-w-	c:\windows\system32\gdi32.dll
2014-08-28 07:00 . 2014-08-23 01:45	311808	----a-w-	c:\windows\SysWow64\gdi32.dll
2014-08-28 07:00 . 2014-08-23 00:59	3163648	----a-w-	c:\windows\system32\win32k.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-20 17:16 . 2014-07-14 15:20	163504	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2014-09-19 20:45 . 2014-07-01 14:12	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-14 01:02 . 2013-12-05 04:30	101694776	----a-w-	c:\windows\system32\MRT.exe
2014-09-13 09:27 . 2013-11-21 20:59	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-13 09:27 . 2013-11-21 20:59	701104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-08-25 04:53 . 2010-11-21 03:27	270496	------w-	c:\windows\system32\MpSigStub.exe
2014-07-25 00:35 . 2014-07-25 00:35	875688	----a-w-	c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47	869544	----a-w-	c:\windows\system32\msvcr120_clr0400.dll
2014-07-16 03:23 . 2014-08-14 22:46	2048	----a-w-	c:\windows\system32\tzres.dll
2014-07-16 02:46 . 2014-08-14 22:46	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-07-15 11:32 . 2013-11-21 22:03	42040	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-07-14 02:02 . 2014-08-14 22:44	1216000	----a-w-	c:\windows\system32\rpcrt4.dll
2014-07-14 01:40 . 2014-08-14 22:44	664064	----a-w-	c:\windows\SysWow64\rpcrt4.dll
2014-07-11 01:02 . 2014-07-31 08:32	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-09 02:03 . 2014-08-14 22:46	7168	----a-w-	c:\windows\system32\KBDYAK.DLL
2014-07-09 02:03 . 2014-08-14 22:46	7168	----a-w-	c:\windows\system32\KBDTAT.DLL
2014-07-09 02:03 . 2014-08-14 22:46	7168	----a-w-	c:\windows\system32\KBDRU1.DLL
2014-07-09 02:03 . 2014-08-14 22:46	6656	----a-w-	c:\windows\system32\KBDRU.DLL
2014-07-09 02:03 . 2014-08-14 22:46	7168	----a-w-	c:\windows\system32\KBDBASH.DLL
2014-07-09 01:31 . 2014-08-14 22:46	7168	----a-w-	c:\windows\SysWow64\KBDYAK.DLL
2014-07-09 01:31 . 2014-08-14 22:46	6656	----a-w-	c:\windows\SysWow64\KBDBASH.DLL
2014-07-01 11:46 . 2013-11-21 20:22	117712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-06-30 22:24 . 2014-08-15 08:57	8856	----a-w-	c:\windows\system32\icardres.dll
2014-06-30 22:14 . 2014-08-15 08:57	8856	----a-w-	c:\windows\SysWow64\icardres.dll
2014-06-25 02:05 . 2014-08-14 22:46	14175744	----a-w-	c:\windows\system32\shell32.dll
2013-11-21 20:34 . 2013-11-21 20:34	12767232	----a-w-	c:\program files (x86)\Common Files\lpuninstall.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2013-11-21 4287536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe" [2011-09-20 115048]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-05 751184]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-08-27 164656]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0bootdelete
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
R2 acehlp10;acehlp10;c:\windows\system32\drivers\acehlp10.sys;c:\windows\SYSNATIVE\drivers\acehlp10.sys [x]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]
R3 NTIOLib_1_0_C;NTIOLib_1_0_C;d:\ntiolib_x64.sys;d:\NTIOLib_X64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 acedrv10;acedrv10;c:\windows\system32\drivers\acedrv10.sys;c:\windows\SYSNATIVE\drivers\acedrv10.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\HitmanPro\hmpsched.exe;c:\program files\HitmanPro\hmpsched.exe [x]
S2 postgresql-x64-9.0;postgresql-x64-9.0 - PostgreSQL Server 9.0;C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N postgresql-x64-9.0 -D C:/Program Files/PostgreSQL/9.0/data -w;C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N postgresql-x64-9.0 -D C:/Program Files/PostgreSQL/9.0/data -w [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 rusb3hub;Renesas Electronics USB 3.0 Hub Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3hub.sys [x]
S3 rusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3xhc.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-21 09:27]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2013-06-27 7191768]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
AddRemove-Trusted Software Assistant_is1 - c:\program files (x86)\File Type Assistant\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\postgresql-x64-9.0]
"ImagePath"="C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N \"postgresql-x64-9.0\" -D \"C:/Program Files/PostgreSQL/9.0/data\" -w"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\postgresql-x64-9.0]
"ImagePath"="C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N \"postgresql-x64-9.0\" -D \"C:/Program Files/PostgreSQL/9.0/data\" -w"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-09-20  20:30:18 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-09-20 18:30
.
Vor Suchlauf: 13 Verzeichnis(se), 127.543.619.584 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 128.571.678.720 Bytes frei
.
- - End Of File - - 406E8D82F00D1DAFCA700CA34B702E05
A36C5E4F47E84449FF07ED3517B43A31
         
Übrigens:

Laut Vodafone Speedcheck (Hilfe&FAQ) weisen meine Netzwerk-Aktivitäten ggf. auch auf eine Verseuchung hin -> Netzwerkauslastung überdurchschnittlich, obwohl ich nichts weltbewegendes laufen habe.


Geändert von Dunkelheit (20.09.2014 um 20:42 Uhr)

Alt 21.09.2014, 00:35   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Adware/Junkware/Toolbars entfernen

1. Schritt: Malwarebytes

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

2. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



3. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




4. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________
--> Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe

Alt 21.09.2014, 16:35   #7
Dunkelheit
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Vielen Dank nochmal für Deine Hilfe,

also, hier die Inhalte:

MBAM:

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 21.09.2014
Suchlauf-Zeit: 15:50:36
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.21.03
Rootkit Datenbank: v2014.09.19.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: benutzer2

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 431944
Verstrichene Zeit: 10 Min, 15 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
         
adwcleaner:

Code:
ATTFilter
# AdwCleaner v3.310 - Bericht erstellt am 21/09/2014 um 16:10:12
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : benutzer2 - BENUTZER2-PC
# Gestartet von : C:\Users\benutzer2\Desktop\AdwCleaner_3.310.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Bitberry Software
Schlüssel Gelöscht : HKCU\Software\Bitberry
Schlüssel Gelöscht : HKCU\Software\FileTypeAssistant
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trusted Software Assistant_is1

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17280


-\\ Mozilla Firefox v32.0.2 (x86 de)

[ Datei : C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "Ixquick hxxpS");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Ixquick hxxpS");

*************************

AdwCleaner[R0].txt - [1366 octets] - [21/11/2013 23:39:51]
AdwCleaner[R1].txt - [936 octets] - [21/11/2013 23:47:15]
AdwCleaner[R2].txt - [2315 octets] - [01/07/2014 16:03:54]
AdwCleaner[R3].txt - [1182 octets] - [01/07/2014 16:32:42]
AdwCleaner[R4].txt - [1550 octets] - [03/07/2014 00:50:28]
AdwCleaner[R5].txt - [1528 octets] - [09/08/2014 23:13:17]
AdwCleaner[R6].txt - [2265 octets] - [21/09/2014 16:07:10]
AdwCleaner[S0].txt - [1429 octets] - [21/11/2013 23:41:26]
AdwCleaner[S1].txt - [996 octets] - [21/11/2013 23:47:50]
AdwCleaner[S2].txt - [2376 octets] - [01/07/2014 16:06:02]
AdwCleaner[S3].txt - [1244 octets] - [01/07/2014 16:33:14]
AdwCleaner[S4].txt - [1565 octets] - [03/07/2014 00:51:10]
AdwCleaner[S5].txt - [1589 octets] - [09/08/2014 23:18:50]
AdwCleaner[S6].txt - [1964 octets] - [21/09/2014 16:10:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [2024 octets] ##########
         
Und nochmal adwCleaner, da ich vor dem Removen einen Eintrag angeklickt hatte, den ich nicht mehr entselektieren konnte:

Code:
ATTFilter
# AdwCleaner v3.310 - Bericht erstellt am 21/09/2014 um 16:14:05
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : benutzer2 - BENUTZER2-PC
# Gestartet von : C:\Users\benutzer2\Desktop\AdwCleaner_3.310.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17280


-\\ Mozilla Firefox v32.0.2 (x86 de)

[ Datei : C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [1366 octets] - [21/11/2013 23:39:51]
AdwCleaner[R1].txt - [936 octets] - [21/11/2013 23:47:15]
AdwCleaner[R2].txt - [2315 octets] - [01/07/2014 16:03:54]
AdwCleaner[R3].txt - [1182 octets] - [01/07/2014 16:32:42]
AdwCleaner[R4].txt - [1550 octets] - [03/07/2014 00:50:28]
AdwCleaner[R5].txt - [1528 octets] - [09/08/2014 23:13:17]
AdwCleaner[R6].txt - [2265 octets] - [21/09/2014 16:07:10]
AdwCleaner[R7].txt - [1694 octets] - [21/09/2014 16:13:04]
AdwCleaner[S0].txt - [1429 octets] - [21/11/2013 23:41:26]
AdwCleaner[S1].txt - [996 octets] - [21/11/2013 23:47:50]
AdwCleaner[S2].txt - [2376 octets] - [01/07/2014 16:06:02]
AdwCleaner[S3].txt - [1244 octets] - [01/07/2014 16:33:14]
AdwCleaner[S4].txt - [1565 octets] - [03/07/2014 00:51:10]
AdwCleaner[S5].txt - [1589 octets] - [09/08/2014 23:18:50]
AdwCleaner[S6].txt - [2104 octets] - [21/09/2014 16:10:12]
AdwCleaner[S7].txt - [1615 octets] - [21/09/2014 16:14:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [1675 octets] ##########
         
JRT:

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.9 (09.20.2014:1)
OS: Windows 7 Ultimate x64
Ran by benutzer2 on 21.09.2014 at 16:17:29,45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Successfully deleted the following from C:\Users\benutzer2\AppData\Roaming\mozilla\firefox\profiles\rr23ydws.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");
user_pref("extensions.bootstrappedAddons", "{\"{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\":{\"version\":\"2.6.4\",\"type\":\"extension\",\"descriptor\":\"C:\\\\Users\\\\benutzer2
user_pref("extensions.safesearch.MP_DISTINCT_ID", "\"147a511e30c12-069593015d82468-42504136-0-147a511e30d21d\"");
user_pref("extensions.safesearch.SAUTH_expires_at", "1411412298");
user_pref("extensions.safesearch.SAUTH_rndsnr", "\"0e3b9fb4593a037a6678ef92622393408bb5e610\"");
user_pref("extensions.safesearch.SAUTH_userid", "4220894680");
user_pref("extensions.safesearch.SAUTH_utoken", "\"3f64ab0af98bc09007aa218753a00c4f98e5bb51\"");
user_pref("extensions.safesearch.install", "1407223718673");
Emptied folder: C:\Users\benutzer2\AppData\Roaming\mozilla\firefox\profiles\rr23ydws.default\minidumps [20 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.09.2014 at 16:25:13,61
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
FRST:


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by benutzer2 (administrator) on BENUTZER2-PC on 21-09-2014 16:26:08
Running from C:\Users\benutzer2\Downloads
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7191768 2013-06-27] (Realtek Semiconductor)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2842033744-104979599-978530037-1000\...\Run: [Pando Media Booster] => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-11-22] ()
BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\searchplugins\avira-safesearch.xml
FF SearchPlugin: C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\searchplugins\ixquick-https.xml
FF SearchPlugin: C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\searchplugins\startpage-ssl.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\abs@avira.com [2014-08-29]
FF Extension: Xmarks - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\foxmarks@kei.com [2014-07-30]
FF Extension: Avira SafeSearch - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\safesearch@avira.com [2014-08-05]
FF Extension: LastPass - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\support@lastpass.com [2014-04-10]
FF Extension: Cookie Monster - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi [2013-11-22]
FF Extension: NoScript - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-11-21]
FF Extension: Adblock Plus - C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-21]
FF HKLM-x32\...\Firefox\Extensions: [downloader@freeyoutubetomp3converter.org] - C:\Program Files (x86)\FreeYouTubeToMP3TURBOConverter\Firefox
FF Extension: FreeYouTubeToMP3TURBOConverter plugin for Mozilla Firefox - C:\Program Files (x86)\FreeYouTubeToMP3TURBOConverter\Firefox [2014-03-27]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-08-06] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-08-22] (Hi-Rez Studios) [File not signed]
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-09-12] (SurfRight B.V.)
R2 postgresql-x64-9.0; C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N "postgresql-x64-9.0" -D "C:/Program Files/PostgreSQL/9.0/data" -w [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 acedrv10; C:\Windows\system32\drivers\acedrv10.sys [277904 2014-05-26] (Protect Software GmbH)
S2 acehlp10; C:\Windows\system32\drivers\acehlp10.sys [228000 2014-05-26] (Protect Software GmbH)
R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-15] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-21] (Malwarebytes Corporation)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-21 16:25 - 2014-09-21 16:25 - 00001702 _____ () C:\Users\benutzer2\Desktop\JRT.txt
2014-09-21 16:16 - 2014-09-21 16:16 - 00001755 _____ () C:\Users\benutzer2\Desktop\AdwCleaner[S7].txt
2014-09-21 16:12 - 2014-09-21 16:12 - 00002104 _____ () C:\Users\benutzer2\Desktop\AdwCleaner[S6].txt
2014-09-21 16:06 - 2014-09-21 16:06 - 01373475 _____ () C:\Users\benutzer2\Desktop\AdwCleaner_3.310.exe
2014-09-21 16:06 - 2014-09-21 16:06 - 01027006 _____ (Thisisu) C:\Users\benutzer2\Desktop\JRT.exe
2014-09-21 16:02 - 2014-09-21 16:02 - 00001163 _____ () C:\Users\benutzer2\Desktop\mbam.txt
2014-09-21 13:55 - 2014-09-21 13:55 - 00000000 ____D () C:\Users\jana sofia\AppData\Roaming\Avira
2014-09-21 13:50 - 2014-09-21 13:50 - 00000000 __SHD () C:\Users\jana sofia\AppData\Local\EmieUserList
2014-09-21 13:50 - 2014-09-21 13:50 - 00000000 __SHD () C:\Users\jana sofia\AppData\Local\EmieSiteList
2014-09-21 13:49 - 2014-09-21 13:49 - 00066008 _____ () C:\Users\filip marko\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-21 13:49 - 2014-09-21 13:49 - 00001421 _____ () C:\Users\filip marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-21 13:49 - 2014-09-21 13:49 - 00000020 ___SH () C:\Users\filip marko\ntuser.ini
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Vorlagen
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Startmenü
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Netzwerkumgebung
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Lokale Einstellungen
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Eigene Dateien
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Druckumgebung
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Documents\Eigene Musik
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Documents\Eigene Bilder
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\AppData\Local\Verlauf
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\AppData\Local\Anwendungsdaten
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Anwendungsdaten
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 ____D () C:\Users\filip marko\AppData\Roaming\Adobe
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 ____D () C:\Users\filip marko\AppData\Local\VirtualStore
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 ____D () C:\Users\filip marko
2014-09-21 13:49 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\filip marko\AppData\Roaming\Macromedia
2014-09-21 13:49 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\filip marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-21 13:49 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\filip marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-09-21 07:40 - 2014-09-21 07:40 - 00066008 _____ () C:\Users\jana sofia\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-21 07:40 - 2014-09-21 07:40 - 00001421 _____ () C:\Users\jana sofia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-21 07:40 - 2014-09-21 07:40 - 00000020 ___SH () C:\Users\jana sofia\ntuser.ini
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Vorlagen
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Startmenü
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Netzwerkumgebung
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Lokale Einstellungen
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Eigene Dateien
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Druckumgebung
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Documents\Eigene Musik
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Documents\Eigene Bilder
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\AppData\Local\Verlauf
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\AppData\Local\Anwendungsdaten
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Anwendungsdaten
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 ____D () C:\Users\jana sofia\AppData\Roaming\Adobe
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 ____D () C:\Users\jana sofia\AppData\Local\VirtualStore
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 ____D () C:\Users\jana sofia
2014-09-21 07:40 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\jana sofia\AppData\Roaming\Macromedia
2014-09-21 07:40 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\jana sofia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-21 07:40 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\jana sofia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-09-20 20:30 - 2014-09-20 20:30 - 00019913 _____ () C:\ComboFix.txt
2014-09-20 20:10 - 2014-09-20 20:30 - 00000000 ____D () C:\Qoobox
2014-09-20 20:10 - 2014-09-20 20:29 - 00000000 ____D () C:\Windows\erdnt
2014-09-20 20:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-20 20:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-20 20:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-20 20:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-20 20:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-20 20:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-20 20:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-20 20:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-20 20:06 - 2014-09-20 20:07 - 05578824 ____R (Swearware) C:\Users\benutzer2\Desktop\ComboFix.exe
2014-09-19 22:47 - 2014-09-19 22:47 - 00001889 _____ () C:\malwarebytesantimalwarescan.txt
2014-09-19 22:47 - 2014-09-19 22:47 - 00001880 _____ () C:\Users\benutzer2\Desktop\mwbantimalwareScan.txt
2014-09-19 22:41 - 2014-09-19 22:41 - 00000550 _____ () C:\Users\benutzer2\Desktop\gmerlog.log
2014-09-19 22:09 - 2014-09-19 22:10 - 00380416 _____ () C:\Users\benutzer2\Downloads\Gmer-19357.exe
2014-09-19 22:07 - 2014-09-19 22:07 - 00037805 _____ () C:\Users\benutzer2\Desktop\FRST.txt
2014-09-19 22:06 - 2014-09-19 22:06 - 00026475 _____ () C:\Users\benutzer2\Downloads\Addition.txt
2014-09-19 22:06 - 2014-09-19 22:06 - 00026475 _____ () C:\Users\benutzer2\Desktop\Addition.txt
2014-09-19 22:06 - 2014-09-19 22:06 - 00000000 ____D () C:\Users\benutzer2\Desktop\games
2014-09-19 22:05 - 2014-09-21 16:26 - 00013318 _____ () C:\Users\benutzer2\Downloads\FRST.txt
2014-09-19 22:05 - 2014-09-21 16:26 - 00000000 ____D () C:\FRST
2014-09-19 22:04 - 2014-09-21 07:45 - 00000482 _____ () C:\Users\benutzer2\Desktop\defogger_disable.log
2014-09-19 22:04 - 2014-09-19 22:05 - 02105856 _____ (Farbar) C:\Users\benutzer2\Downloads\FRST64.exe
2014-09-19 22:04 - 2014-09-19 22:04 - 00000000 _____ () C:\Users\benutzer2\defogger_reenable
2014-09-19 22:03 - 2014-09-19 22:03 - 00050477 _____ () C:\Users\benutzer2\Downloads\Defogger.exe
2014-09-19 21:48 - 2014-09-19 21:48 - 00008359 _____ () C:\Users\benutzer2\Downloads\hijackthis.log
2014-09-19 21:48 - 2014-09-19 21:48 - 00008359 _____ () C:\Users\benutzer2\Desktop\hijackthis.log
2014-09-19 21:47 - 2014-09-19 21:47 - 00388608 _____ (Trend Micro Inc.) C:\Users\benutzer2\Downloads\HijackThis.exe
2014-09-18 22:39 - 2014-09-18 22:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-17 10:56 - 2014-09-17 10:56 - 00000028 _____ () C:\Users\benutzer2\Desktop\Neues Textdokument (2).txt
2014-09-14 03:05 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-14 03:05 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-14 03:05 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-14 03:05 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-14 03:05 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-14 03:05 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-14 03:05 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-14 03:05 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-14 03:05 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-14 03:05 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-14 03:05 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-14 03:05 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-14 03:05 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-14 03:05 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-14 03:05 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-14 03:05 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-14 03:05 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-14 03:05 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-14 03:05 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-14 03:05 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-14 03:05 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-14 03:05 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-14 03:05 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-14 03:05 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-14 03:05 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-14 03:05 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-14 03:05 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-14 03:05 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-14 03:05 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-14 03:05 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-14 03:05 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-14 03:05 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-14 03:05 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-14 03:05 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-14 03:05 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-14 03:05 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-14 03:05 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-14 03:05 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-14 03:05 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-14 03:05 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-14 03:05 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-14 03:05 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-14 03:05 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-14 03:05 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-14 03:05 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-14 03:05 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-14 03:05 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-14 03:05 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-14 03:05 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-14 03:05 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-14 03:05 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-14 03:05 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-14 03:05 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-14 03:05 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-14 03:05 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-14 03:05 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-14 03:01 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-14 03:01 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-12 11:18 - 2014-09-12 11:18 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-09-12 11:18 - 2014-09-12 11:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-09-12 09:47 - 2014-09-12 09:48 - 17703856 _____ (Adobe Systems Inc.) C:\Users\benutzer2\Downloads\AdobeAIRInstaller(1).exe
2014-09-12 09:39 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-12 09:39 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-12 09:38 - 2014-09-12 09:38 - 34888568 _____ (Riot Games) C:\Users\benutzer2\Downloads\LeagueofLegends_EUW_Installer_06_12_13(3).exe
2014-09-12 09:38 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-12 09:38 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-12 09:35 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-12 09:35 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-12 09:35 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-12 09:35 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-12 09:35 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-12 09:34 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-12 09:34 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-12 09:31 - 2014-09-12 09:31 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-11 12:49 - 2014-09-12 09:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinTimer 3
2014-09-11 12:49 - 2014-09-12 09:22 - 00000000 ____D () C:\Program Files\WinTimer
2014-09-06 02:05 - 2014-09-06 02:14 - 00000385 _____ () C:\Users\benutzer2\Desktop\turmholzdeckestatik.txt
2014-09-04 15:48 - 2014-09-04 15:48 - 00000000 _____ () C:\Users\benutzer2\Desktop\1003402560.txt
2014-09-01 20:33 - 2014-09-01 20:33 - 00007334 _____ () C:\Users\benutzer2\Desktop\route.odt
2014-09-01 20:25 - 2014-09-01 20:25 - 00002564 _____ () C:\Users\benutzer2\Desktop\kredit haus garten turm.xml
2014-09-01 20:00 - 2014-09-01 20:00 - 00000884 _____ () C:\Users\benutzer2\Desktop\finanzierung - haus garten turm.xml
2014-09-01 19:56 - 2014-09-12 09:23 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unknown
2014-09-01 19:56 - 2014-09-12 09:23 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\BaufiFX 1.4
2014-09-01 19:56 - 2014-09-01 19:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\de.thomasbolz.baufi.BaufiMain
2014-09-01 19:54 - 2014-09-01 19:56 - 64137872 _____ (Unknown ) C:\Users\benutzer2\Desktop\BaufiFX.exe
2014-09-01 19:42 - 2014-09-08 13:51 - 00001030 _____ () C:\Users\benutzer2\Desktop\Neues Textdokument.txt
2014-08-28 09:00 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 09:00 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 09:00 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-21 16:27 - 2013-11-21 22:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-21 16:26 - 2014-09-19 22:05 - 00013318 _____ () C:\Users\benutzer2\Downloads\FRST.txt
2014-09-21 16:26 - 2014-09-19 22:05 - 00000000 ____D () C:\FRST
2014-09-21 16:26 - 2013-11-22 00:37 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\PMB Files
2014-09-21 16:25 - 2014-09-21 16:25 - 00001702 _____ () C:\Users\benutzer2\Desktop\JRT.txt
2014-09-21 16:23 - 2009-07-14 06:45 - 00027152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-21 16:23 - 2009-07-14 06:45 - 00027152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-21 16:16 - 2014-09-21 16:16 - 00001755 _____ () C:\Users\benutzer2\Desktop\AdwCleaner[S7].txt
2014-09-21 16:14 - 2013-11-21 23:25 - 00000000 ____D () C:\AdwCleaner
2014-09-21 16:14 - 2010-11-21 05:47 - 00303716 _____ () C:\Windows\PFRO.log
2014-09-21 16:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-21 16:14 - 2009-07-14 06:51 - 00111527 _____ () C:\Windows\setupact.log
2014-09-21 16:12 - 2014-09-21 16:12 - 00002104 _____ () C:\Users\benutzer2\Desktop\AdwCleaner[S6].txt
2014-09-21 16:10 - 2008-01-01 02:36 - 01238163 _____ () C:\Windows\WindowsUpdate.log
2014-09-21 16:06 - 2014-09-21 16:06 - 01373475 _____ () C:\Users\benutzer2\Desktop\AdwCleaner_3.310.exe
2014-09-21 16:06 - 2014-09-21 16:06 - 01027006 _____ (Thisisu) C:\Users\benutzer2\Desktop\JRT.exe
2014-09-21 16:02 - 2014-09-21 16:02 - 00001163 _____ () C:\Users\benutzer2\Desktop\mbam.txt
2014-09-21 15:50 - 2014-07-01 16:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-21 15:47 - 2013-11-22 00:37 - 00000000 ____D () C:\ProgramData\PMB Files
2014-09-21 13:55 - 2014-09-21 13:55 - 00000000 ____D () C:\Users\jana sofia\AppData\Roaming\Avira
2014-09-21 13:50 - 2014-09-21 13:50 - 00000000 __SHD () C:\Users\jana sofia\AppData\Local\EmieUserList
2014-09-21 13:50 - 2014-09-21 13:50 - 00000000 __SHD () C:\Users\jana sofia\AppData\Local\EmieSiteList
2014-09-21 13:49 - 2014-09-21 13:49 - 00066008 _____ () C:\Users\filip marko\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-21 13:49 - 2014-09-21 13:49 - 00001421 _____ () C:\Users\filip marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-21 13:49 - 2014-09-21 13:49 - 00000020 ___SH () C:\Users\filip marko\ntuser.ini
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Vorlagen
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Startmenü
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Netzwerkumgebung
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Lokale Einstellungen
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Eigene Dateien
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Druckumgebung
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Documents\Eigene Musik
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Documents\Eigene Bilder
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\AppData\Local\Verlauf
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\AppData\Local\Anwendungsdaten
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 _SHDL () C:\Users\filip marko\Anwendungsdaten
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 ____D () C:\Users\filip marko\AppData\Roaming\Adobe
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 ____D () C:\Users\filip marko\AppData\Local\VirtualStore
2014-09-21 13:49 - 2014-09-21 13:49 - 00000000 ____D () C:\Users\filip marko
2014-09-21 10:49 - 2013-11-21 22:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\vlc
2014-09-21 07:45 - 2014-09-19 22:04 - 00000482 _____ () C:\Users\benutzer2\Desktop\defogger_disable.log
2014-09-21 07:40 - 2014-09-21 07:40 - 00066008 _____ () C:\Users\jana sofia\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-21 07:40 - 2014-09-21 07:40 - 00001421 _____ () C:\Users\jana sofia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-21 07:40 - 2014-09-21 07:40 - 00000020 ___SH () C:\Users\jana sofia\ntuser.ini
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Vorlagen
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Startmenü
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Netzwerkumgebung
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Lokale Einstellungen
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Eigene Dateien
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Druckumgebung
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Documents\Eigene Musik
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Documents\Eigene Bilder
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\AppData\Local\Verlauf
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\AppData\Local\Anwendungsdaten
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 _SHDL () C:\Users\jana sofia\Anwendungsdaten
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 ____D () C:\Users\jana sofia\AppData\Roaming\Adobe
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 ____D () C:\Users\jana sofia\AppData\Local\VirtualStore
2014-09-21 07:40 - 2014-09-21 07:40 - 00000000 ____D () C:\Users\jana sofia
2014-09-20 20:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-20 20:30 - 2014-09-20 20:30 - 00019913 _____ () C:\ComboFix.txt
2014-09-20 20:30 - 2014-09-20 20:10 - 00000000 ____D () C:\Qoobox
2014-09-20 20:30 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-20 20:29 - 2014-09-20 20:10 - 00000000 ____D () C:\Windows\erdnt
2014-09-20 20:27 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-20 20:07 - 2014-09-20 20:06 - 05578824 ____R (Swearware) C:\Users\benutzer2\Desktop\ComboFix.exe
2014-09-19 22:47 - 2014-09-19 22:47 - 00001889 _____ () C:\malwarebytesantimalwarescan.txt
2014-09-19 22:47 - 2014-09-19 22:47 - 00001880 _____ () C:\Users\benutzer2\Desktop\mwbantimalwareScan.txt
2014-09-19 22:41 - 2014-09-19 22:41 - 00000550 _____ () C:\Users\benutzer2\Desktop\gmerlog.log
2014-09-19 22:12 - 2014-03-27 16:40 - 00000000 ____D () C:\Program Files (x86)\FreeYouTubeToMP3TURBOConverter
2014-09-19 22:10 - 2014-09-19 22:09 - 00380416 _____ () C:\Users\benutzer2\Downloads\Gmer-19357.exe
2014-09-19 22:07 - 2014-09-19 22:07 - 00037805 _____ () C:\Users\benutzer2\Desktop\FRST.txt
2014-09-19 22:06 - 2014-09-19 22:06 - 00026475 _____ () C:\Users\benutzer2\Downloads\Addition.txt
2014-09-19 22:06 - 2014-09-19 22:06 - 00026475 _____ () C:\Users\benutzer2\Desktop\Addition.txt
2014-09-19 22:06 - 2014-09-19 22:06 - 00000000 ____D () C:\Users\benutzer2\Desktop\games
2014-09-19 22:06 - 2014-08-09 13:57 - 00000000 ____D () C:\Users\benutzer2\Desktop\Poker (1)
2014-09-19 22:05 - 2014-09-19 22:04 - 02105856 _____ (Farbar) C:\Users\benutzer2\Downloads\FRST64.exe
2014-09-19 22:04 - 2014-09-19 22:04 - 00000000 _____ () C:\Users\benutzer2\defogger_reenable
2014-09-19 22:04 - 2013-11-21 19:53 - 00000000 ____D () C:\Users\benutzer2
2014-09-19 22:03 - 2014-09-19 22:03 - 00050477 _____ () C:\Users\benutzer2\Downloads\Defogger.exe
2014-09-19 21:48 - 2014-09-19 21:48 - 00008359 _____ () C:\Users\benutzer2\Downloads\hijackthis.log
2014-09-19 21:48 - 2014-09-19 21:48 - 00008359 _____ () C:\Users\benutzer2\Desktop\hijackthis.log
2014-09-19 21:48 - 2013-11-21 19:53 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\VirtualStore
2014-09-19 21:47 - 2014-09-19 21:47 - 00388608 _____ (Trend Micro Inc.) C:\Users\benutzer2\Downloads\HijackThis.exe
2014-09-19 19:19 - 2014-01-10 20:22 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\.minecraft
2014-09-19 19:18 - 2014-07-07 13:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-19 16:49 - 2013-11-21 23:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-19 16:49 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-18 22:39 - 2014-09-18 22:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-18 20:23 - 2014-01-19 17:22 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\Battle.net
2014-09-18 19:59 - 2014-03-17 07:18 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-17 10:56 - 2014-09-17 10:56 - 00000028 _____ () C:\Users\benutzer2\Desktop\Neues Textdokument (2).txt
2014-09-14 10:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-14 03:04 - 2014-02-28 13:21 - 01592628 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-14 03:04 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-09-14 03:04 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-09-14 03:04 - 2009-07-14 07:13 - 01592628 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-14 03:03 - 2013-12-05 06:30 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-14 03:02 - 2013-12-05 06:30 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-14 03:00 - 2014-04-30 03:43 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-13 11:27 - 2013-11-21 22:59 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-13 11:27 - 2013-11-21 22:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-13 11:27 - 2013-11-21 22:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-12 11:20 - 2013-11-22 00:47 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Riot Games
2014-09-12 11:18 - 2014-09-12 11:18 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-09-12 11:18 - 2014-09-12 11:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-09-12 09:48 - 2014-09-21 13:49 - 00000000 ____D () C:\Users\filip marko\AppData\Roaming\Macromedia
2014-09-12 09:48 - 2014-09-21 07:40 - 00000000 ____D () C:\Users\jana sofia\AppData\Roaming\Macromedia
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-09-12 09:48 - 2014-09-12 09:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-09-12 09:48 - 2014-09-12 09:47 - 17703856 _____ (Adobe Systems Inc.) C:\Users\benutzer2\Downloads\AdobeAIRInstaller(1).exe
2014-09-12 09:48 - 2014-07-07 13:51 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\Adobe
2014-09-12 09:48 - 2014-07-07 13:47 - 00000000 ____D () C:\ProgramData\Adobe
2014-09-12 09:48 - 2014-07-07 13:47 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-09-12 09:48 - 2013-11-21 23:02 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Adobe
2014-09-12 09:38 - 2014-09-12 09:38 - 34888568 _____ (Riot Games) C:\Users\benutzer2\Downloads\LeagueofLegends_EUW_Installer_06_12_13(3).exe
2014-09-12 09:32 - 2014-08-05 09:27 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-12 09:31 - 2014-09-12 09:31 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-12 09:31 - 2013-11-22 00:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-12 09:24 - 2014-08-09 12:59 - 00000000 ____D () C:\Users\postgres
2014-09-12 09:23 - 2014-09-01 19:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unknown
2014-09-12 09:23 - 2014-09-01 19:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\BaufiFX 1.4
2014-09-12 09:23 - 2014-06-03 18:45 - 00000000 ____D () C:\Users\benutzer2\Desktop\stick
2014-09-12 09:23 - 2014-01-19 17:22 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Battle.net
2014-09-12 09:23 - 2013-11-21 22:58 - 00000000 ____D () C:\Windows\system32\Macromed
2014-09-12 09:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas
2014-09-12 09:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-09-12 09:22 - 2014-09-11 12:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinTimer 3
2014-09-12 09:22 - 2014-09-11 12:49 - 00000000 ____D () C:\Program Files\WinTimer
2014-09-12 09:22 - 2014-04-29 23:13 - 00000000 ____D () C:\Program Files\HitmanPro
2014-09-12 09:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-09-12 09:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-09-12 09:18 - 2013-11-21 22:22 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-08 13:51 - 2014-09-01 19:42 - 00001030 _____ () C:\Users\benutzer2\Desktop\Neues Textdokument.txt
2014-09-06 02:14 - 2014-09-06 02:05 - 00000385 _____ () C:\Users\benutzer2\Desktop\turmholzdeckestatik.txt
2014-09-05 04:10 - 2014-09-12 09:34 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-12 09:34 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-04 15:48 - 2014-09-04 15:48 - 00000000 _____ () C:\Users\benutzer2\Desktop\1003402560.txt
2014-09-01 20:33 - 2014-09-01 20:33 - 00007334 _____ () C:\Users\benutzer2\Desktop\route.odt
2014-09-01 20:25 - 2014-09-01 20:25 - 00002564 _____ () C:\Users\benutzer2\Desktop\kredit haus garten turm.xml
2014-09-01 20:00 - 2014-09-01 20:00 - 00000884 _____ () C:\Users\benutzer2\Desktop\finanzierung - haus garten turm.xml
2014-09-01 19:56 - 2014-09-01 19:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\de.thomasbolz.baufi.BaufiMain
2014-09-01 19:56 - 2014-09-01 19:54 - 64137872 _____ (Unknown ) C:\Users\benutzer2\Desktop\BaufiFX.exe
2014-08-29 13:22 - 2014-07-17 18:20 - 00000000 ____D () C:\Users\benutzer2\Documents\888poker
2014-08-28 12:00 - 2009-07-14 06:45 - 00298904 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 09:52 - 2014-03-08 18:56 - 00000000 ____D () C:\Users\benutzer2\AppData\Local\Microsoft Games
2014-08-25 06:53 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-23 04:07 - 2014-08-28 09:00 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 09:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 09:00 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 19:02 - 2014-06-05 21:22 - 00000000 ____D () C:\Users\benutzer2\Desktop\mp3s
2014-08-22 17:59 - 2014-04-10 19:27 - 00000000 ____D () C:\Users\benutzer2\AppData\Roaming\Skype

Some content of TEMP:
====================
C:\Users\benutzer2\AppData\Local\Temp\avgnt.exe
C:\Users\benutzer2\AppData\Local\Temp\Quarantine.exe
C:\Users\filip marko\AppData\Local\Temp\avgnt.exe
C:\Users\jana sofia\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-17 17:52

==================== End Of Log ============================
         
--- --- ---

--- --- ---

Alt 21.09.2014, 18:12   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

__________________
Logs bitte immer in CODE-Tags posten

Alt 21.09.2014, 21:47   #9
Dunkelheit
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Whooops, hier der Addition-Scan:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by benutzer2 at 2014-09-21 21:46:18
Running from C:\Users\benutzer2\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

888poker (HKLM-x32\...\888poker) (Version:  - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.249 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 15.0.0.249 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{AF88A32E-BC54-2AA3-2FC8-D63D86DF4A7A}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2012.0806.1213.19931 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.70727.2220 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2012.0806.1213.19931 - Ihr Firmenname) Hidden
AutoHotkey 1.0.48.05 (HKLM-x32\...\AutoHotkey) (Version: 1.0.48.05 - Chris Mallett)
Avira (HKLM-x32\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4489 - APN, LLC)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BaufiFX 1.4 (HKCU\...\{BaufiMain}}_is1) (Version: 1.4 - Unknown)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0806.1213.19931 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0806.1213.19931 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0806.1213.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0806.1212.19931 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0806.1213.19931 - Advanced Micro Devices, Inc.) Hidden
Don't Starve (HKLM-x32\...\DontStarve) (Version:  - Klei Entertainment)
Don't Starve (HKLM-x32\...\Steam App 219740) (Version:  - Klei Entertainment)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Free YouTube to MP3 TURBO Converter 2013 (HKLM-x32\...\FreeYoutubeToMP3TURBOConverter_is1) (Version:  - Bitberry Software)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.225 - SurfRight B.V.)
ICM Trainer (HKLM-x32\...\{47EA4DDF-FD99-46B3-846C-9F3F315268AD}) (Version: 1.0.0 - PokerStrategy)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.650 - Oracle)
Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mein Paradies für Hunde (HKCU\...\Mein Paradies für Hunde) (Version: V1.000000 - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.2 (x86 de)) (Version: 32.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OMC ModPack Version 0.9.1.0 (HKLM-x32\...\{6C38BB40-8A08-4238-89AA-4EED5FC11549}_is1) (Version: 0.9.1.0 - Odem Mortis)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.9 - Pando Networks Inc.)
Path of Exile (HKLM-x32\...\{90A4562F-D4A1-4B65-906D-41F236CF6902}) (Version: 1.1.5.34983 - Grinding Gear Games)
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
PokerStrategy.com Equilab (HKLM-x32\...\{86D09F48-CDAB-4B4C-8806-F6C16F17935A}) (Version: 1.2.8.0 - PokerStrategy.com)
PokerTracker 4 (remove only) (HKLM-x32\...\PokerTracker4) (Version:  - )
PostgreSQL 9.0  (HKLM\...\PostgreSQL 9.0) (Version: 9.0 - PostgreSQL Global Development Group)
ProtectDisc Helper Driver 10 (HKLM-x32\...\ProtectDisc Driver 10) (Version: 10.0.0.3 - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.72.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6959 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2247.4 - Hi-Rez Studios)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 2 RC2 (HKLM-x32\...\Teamspeak 2 RC2_is1) (Version: 2.0.32.60 - Dominating Bytes Design)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
William Hill Poker (HKCU\...\William Hill Poker) (Version:  - )
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2842033744-104979599-978530037-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)

==================== Restore Points  =========================

14-09-2014 01:00:25 Windows Update
20-09-2014 06:32:58 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1223897E-BF4F-41F7-B875-0BDFA4104D54} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-13] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-08-06 13:24 - 2012-08-06 13:24 - 00212480 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2012-03-05 17:03 - 2012-03-05 17:03 - 00677376 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2012-02-16 15:53 - 2012-02-16 15:53 - 03642880 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2014-08-09 12:47 - 2012-09-21 09:55 - 00217600 _____ () C:\Program Files\PostgreSQL\9.0\bin\LIBPQ.dll
2014-08-09 12:47 - 2012-08-14 14:02 - 02258432 _____ () C:\Program Files\PostgreSQL\9.0\bin\libxml2.dll
2012-08-06 13:24 - 2012-08-06 13:24 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2012-08-06 13:07 - 2012-08-06 13:07 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-09-21 16:11 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\benutzer2\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-09-18 22:39 - 2014-09-18 22:39 - 03734640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-04-10 19:36 - 2014-04-10 19:36 - 01020928 _____ () C:\Users\benutzer2\AppData\Roaming\Mozilla\Firefox\Profiles\rr23ydws.default\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll
2014-09-13 11:27 - 2014-09-13 11:27 - 16825520 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-09-20 20:18:43.752
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-20 20:18:43.721
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: AMD FX(tm)-6300 Six-Core Processor 
Percentage of memory in use: 24%
Total physical RAM: 8140.05 MB
Available physical RAM: 6153.42 MB
Total Pagefile: 16278.29 MB
Available Pagefile: 12211.86 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:118.81 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 25580574)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Alt 22.09.2014, 00:47   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________
Logs bitte immer in CODE-Tags posten

Alt 22.09.2014, 18:27   #11
Dunkelheit
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Hallo,

hier mbam:

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 22.09.2014
Suchlauf-Zeit: 15:22:10
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.22.02
Rootkit Datenbank: v2014.09.19.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: benutzer2

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 431848
Verstrichene Zeit: 10 Min, 50 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
         
und - heilige Makrele, fast 3 Stunden - ESET Online Scanner Logfile:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ecd3833157058b4ea6d1d8eacdedbc40
# engine=20244
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-22 04:21:52
# local_time=2014-09-22 06:21:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 4179562 276826202 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 50840 163032762 0 0
# scanned=250208
# found=24
# cleaned=0
# scan_time=9771
sh=F2804D091BEC900E3984853DD856EA199F4C5AB2 ft=1 fh=b6352ca64d82ae0c vn="Win32/FileTypeAssistant.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\File Type Assistant\ftacfg.exe.vir"
sh=4F6A504DAE2929C4B753AD772D96BBFAC3F8CA53 ft=1 fh=6a48d7e397d98671 vn="Variante von Win32/FileTypeAssistant.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\File Type Assistant\TSASetup.exe.vir"
sh=FD1BBC58B1E5527626449865725E489DD63146CE ft=1 fh=810032c115ad72d7 vn="Variante von Win32/FileTypeAssistant.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\File Type Assistant\tsassist.exe.vir"
sh=4F6A504DAE2929C4B753AD772D96BBFAC3F8CA53 ft=1 fh=6a48d7e397d98671 vn="Variante von Win32/FileTypeAssistant.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\File Type Assistant\temp\~tmp.exe.vir"
sh=2714DB0A06F74A4282CDDC307EA1599670422E09 ft=1 fh=dbe7f66a91f8fadc vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\BENUTZ~1\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=BA39F8C9886EF4AABD72262B192DB8A177C7E206 ft=1 fh=078180abaf06d010 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\apnic.dll"
sh=FFA8B6510D624A55F3EB7FFD6D5221A44944681C ft=1 fh=3386eb0d6ed0e5e1 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\apnstub.exe"
sh=1A3F14C0A66F9AF050D1F34FBACBAADC31751A07 ft=1 fh=2704a03a0f47b728 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\apntoolbarinstaller.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=2718053800D44DAE154F30CDCC3B967EF389749F ft=1 fh=3790c7326800cd62 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\PokerTracker 4\Data\Bin\PartyCommunicator.pt4"
sh=7DE27864824C6930ED853E22C1189DC2F14FED7D ft=1 fh=6a78958f5a04567a vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\PokerTracker 4\Data\Bin\StarsCommunicator.pt4"
sh=FAC7341A571C709AE52946FF8F6120142664290F ft=1 fh=9dd3926ecd994b9d vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\PokerTracker 4\Data\Bin\TiltCommunicator.pt4"
sh=7DE27864824C6930ED853E22C1189DC2F14FED7D ft=1 fh=6a78958f5a04567a vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\benutzer2\AppData\Local\PokerTracker 4\Temp\StarsCommunicator.pt4"
sh=88CF847E288860B0A148B25FEE3D559E57C2D130 ft=1 fh=d6ccd7b65d3141fd vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\benutzer2\Desktop\inst\OpenOffice - CHIP-Installer.exe"
sh=A981E3D6F03D3BD57D1472F33A4093A01533F8A8 ft=1 fh=7aaf7b3d0491af48 vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\benutzer2\Desktop\inst\wzmp_8.exe"
sh=8D2A9E163F07334EA15254C9E48361EDEE3A6A9C ft=1 fh=ab707b389babb24a vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Users\benutzer2\Desktop\Poker (1)\PT-Install-v4.11.11.exe"
sh=16286F452F5787D76F156D7393F782E6E11F6FBD ft=1 fh=e63982776593dcc8 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Users\benutzer2\Desktop\stick\xyz\FoxitReader603.0524_enu_Setup.exe"
sh=3FF425DD6DA9829D39E0151C657231F59A8D2598 ft=1 fh=ac2b2be4d775b8d7 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Users\benutzer2\Downloads\avira_free_antivirus_de.exe"
sh=09DA613D643659A1CC850C1F3E5C8EE15681B387 ft=1 fh=e15ce3645d20f05d vn="Variante von Win32/FileTypeAssistant.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\benutzer2\Downloads\YouTubeToMP3Converter2013Update1Setup.exe"
sh=567F7670AC05037B3D666088C2B25036098F2AA7 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[1].7z"
sh=5A66C171963EC6CD5840A912571F2E0FEB40D43E ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[2].7z"
sh=567F7670AC05037B3D666088C2B25036098F2AA7 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[1].7z"
sh=5A66C171963EC6CD5840A912571F2E0FEB40D43E ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[2].7z"
         
Wehe da geht nichts -->

Alt 22.09.2014, 18:38   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Zitat:
C:\Program Files (x86)\PokerTracker 4
Ist das gewollt?
__________________
Logs bitte immer in CODE-Tags posten

Alt 22.09.2014, 18:38   #13
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Zitat:
C:\Program Files (x86)\PokerTracker 4
Ist das gewollt?
__________________
Logs bitte immer in CODE-Tags posten

Alt 22.09.2014, 18:42   #14
Dunkelheit
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Ja, das ist eine Pokerdatenbank, die Daten über die Spieler sammelt (legal).

Alt 22.09.2014, 19:03   #15
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Standard

Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe



Downloadordner mal aufräumen...
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
Hosts:
EmptyTemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.

__________________
Logs bitte immer in CODE-Tags posten

Antwort

Themen zu Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe
antimalware, antivir update, avira antivir, c:\windows, downloader, fehlercode 0x5, fehlercode 0xc0000005, fehlercode windows, festgestellt, malwarebytes, malwarebytes antimalware, msil/advancedsystemprotector.f, ping zu hoch, pup.optional.installcore, pup.optional.softonic, pup.optional.toolbarinstaller, trojan.agent, win32/bundled.toolbar.ask, win32/bundled.toolbar.ask.d, win32/bundled.toolbar.ask.f, win32/bundled.toolbar.ask.g, win32/downloadsponsor.a, win32/filetypeassistant.a, win32/packed.themida, win64/systweak.a



Ähnliche Themen: Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe


  1. Win8.1 64bit / SysWow64: Adware oder Virus?
    Log-Analyse und Auswertung - 30.10.2015 (6)
  2. Windows 7 Trojan.Agent, C:\Windows\SysWOW64\rlls.dll
    Log-Analyse und Auswertung - 26.08.2015 (7)
  3. Malwarebytes Fund: Trojan.Agent C:\Windows\SysWOW64\SVKP.sys
    Log-Analyse und Auswertung - 22.08.2015 (15)
  4. Win 7 64bit: Trojan.Agent.CLDGen => Avira will nicht mehr
    Log-Analyse und Auswertung - 03.04.2015 (11)
  5. Trojan.ADH.2 unter Windows7-64Bit Log-Analyse fehlgeschlagen wegen NortonAntiVirus
    Log-Analyse und Auswertung - 10.08.2014 (3)
  6. Windows7/64bit: extrem langsam
    Log-Analyse und Auswertung - 15.07.2014 (11)
  7. Win 7 64bit; Trojan.Agent.ED; Ungültiges Bild - xxx.dll
    Plagegeister aller Art und deren Bekämpfung - 28.01.2014 (7)
  8. Win32/openCandy + Win32.Trojan.Agent.C5K071 auf PC Win7/64bit
    Log-Analyse und Auswertung - 17.01.2014 (3)
  9. Windows8 Troj Agent-ARRQ in C:\Windows\SysWOW64\FlashplayerUpdateService.exe
    Log-Analyse und Auswertung - 12.09.2013 (13)
  10. GVU Trojaner auf Windows7 64bit
    Log-Analyse und Auswertung - 17.06.2013 (48)
  11. trojan.NTPacker in c:\windows\syswow64\propsys.dll
    Log-Analyse und Auswertung - 01.04.2013 (9)
  12. svchospt.exe (Trojan.Agent) in C:\Windows.old\Windows\SysWOW64\svchospt.exe
    Plagegeister aller Art und deren Bekämpfung - 08.03.2013 (3)
  13. Fehler in C:\Windows\SysWOW64\rundll32.exe. Folgender Eintrag fehlt: FQ10, Spyware.Zeus, Trojan.Ransom.Gen
    Log-Analyse und Auswertung - 07.02.2013 (17)
  14. Fehlermeldung bei Start "temp/install_0_msi.exe", Malewarebyte: Trojan.Agent --> svchosptd.exe & Trojan.Ransom.Gen --> ctfmon.lnk
    Plagegeister aller Art und deren Bekämpfung - 18.10.2012 (10)
  15. Trojan.Agent / c:\WINDOWS\system32\svchosptd.exe
    Log-Analyse und Auswertung - 06.05.2011 (8)
  16. Trojaner eingefangen |TR/Crypt.CFI.Gen' [trojan]| bzw. 'C:\Windows\SysWOW64\winfiles.exe'
    Log-Analyse und Auswertung - 19.11.2010 (7)
  17. JAVA/Dldr.Agent.L auf meinem PC (Windows 7/64bit)
    Plagegeister aller Art und deren Bekämpfung - 23.05.2010 (1)

Zum Thema Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe - Hallo, nachdem ich festgestellt hatte, daß ich seit einigen Wochen (!) eine echt üble Internet-Verbindung habe (abends zwischen 20:00 Uhr und ca. 00:00 Uhr) mit einer Latenz von teilweise 300-400 - Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe...
Archiv
Du betrachtest: Windows7-64bit, u.a. Trojan.Agent, C:\Windows\SysWOW64\svchosptd.exe auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.