Eventuell BKA, GVU Trojaner etc. -> 100€ Zahlen per Paysafe - Erste Schritte unternommen Hilfe für logs?

black977 · 21.09.2014, 13:22

Hallo,

hatte einen Anruf von meinem Bruder bekommen das auf dem PC meiner Mutter auf einmal ein Fenster offen war mit dem Satz "Zahlen sie die Frist von 100€ per Paypall" dabei waren Bilder vom BKA und Interpol.

Ich hab spontan gesgat den Rechner abzustürzen.

Danach per Telefon angewiesen zu schauen ob der abgesicherte Modus geht ohne LAN!.

Die wichtigsten Daten sofort auf eine DVD gesichert

Nachher haben SIe wohl den PC normal gestartet ohne Internet und Avast suchen lassen.

Hatte nichts gefunden.

Hatten danach nochmal im abgesichertem Modus nach Toolbars und fremden Prgrammen gesucht.

Auch nix.

Jetzt kam mir die Idee das es vlt ein Popup war. Mein Bruder meinte der Text war im Vordergrund und der Hintergrund grau (wie bei einem Popup) Firefox war nämlich auch im Betrieb.

Um Sicher zu gehen wollte ich aber noch eine 2te Meinung.

Daher hab ich schonmal die FRST Logs falls das was bringt.

EDIT: Sry merke gerade ich muss ein paar Namen aus der Log ***** da dort Personen und Adressen in Ordnern genannt sind

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-09-2014 01
Ran by ****** (administrator) on ******-PC on 21-09-2014 14:02:22
Running from E:\
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(F-Secure Corporation) C:\Program Files (x86)\Unitymedia\fshoster32.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Users\******\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(F-Secure Corporation) C:\Program Files (x86)\Unitymedia\fshoster32.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-07-27] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [F-Secure Hoster (47796)] => C:\Program Files (x86)\Unitymedia\fshoster32.exe [183864 2012-11-26] (F-Secure Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-09-04] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3120075727-420463088-1869709634-1000\...\Run: [SkyDrive] => C:\Users\******\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [251040 2014-09-07] (Microsoft Corporation)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA8F1F33E37ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.13.0.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\wiugkr5a.default
FF Homepage: hxxp://www.bbc.co.uk/iplayer|hxxp://www.telegraph.co.uk/|hxxp://www.finanzen.net/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\wiugkr5a.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-03]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-09-04]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\******\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\******\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-13]
CHR Extension: (Google Drive) - C:\Users\******\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-13]
CHR Extension: (YouTube) - C:\Users\******\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-13]
CHR Extension: (Google-Suche) - C:\Users\******\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-13]
CHR Extension: (Google Wallet) - C:\Users\******\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-13]
CHR Extension: (Google Mail) - C:\Users\******\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-13]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswwebrepchrome-sp.crx []
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-09-04]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-04] (AVAST Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 fshoster; C:\Program Files (x86)\Unitymedia\fshoster32.exe [183864 2012-11-26] (F-Secure Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)
U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
S3 OpenVPNService; C:\Program Files (x86)\MyExpatNet\bin\openvpnserv.exe [15872 2009-05-18] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-09-04] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-09-04] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-09-04] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-09-04] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-09-04] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-09-04] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-09-04] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-09-04] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-21 13:23 - 2014-09-21 14:02 - 00000000 ____D () C:\FRST
2014-09-21 09:11 - 2014-09-21 13:22 - 00001189 _____ () C:\Windows\setupact.log
2014-09-21 09:11 - 2014-09-21 09:11 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-19 13:25 - 2014-09-19 13:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-19 09:42 - 2014-09-19 09:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-18 11:17 - 2014-09-18 11:17 - 00001693 _____ () C:\Users\Public\Desktop\LohnSteuer-Experte 2014.lnk
2014-09-18 11:17 - 2014-09-18 11:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LohnSteuer-Experte 2014
2014-09-18 11:15 - 2014-09-18 11:15 - 28303136 _____ (haude electronica verlag ) C:\Users\******\Downloads\lohnsteuerexperte2014.exe
2014-09-16 19:20 - 2014-09-19 13:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-16 19:20 - 2014-09-16 19:20 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-16 19:20 - 2014-09-16 19:20 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-16 17:19 - 2014-09-16 17:19 - 01101648 _____ () C:\Users\******\Downloads\Firefox - CHIP-Installer.exe
2014-09-16 17:17 - 2014-09-16 17:17 - 00339364 _____ () C:\Users\******\Desktop\bookmarks-2014-09-16.json
2014-09-15 10:08 - 2014-09-15 10:08 - 00023397 _____ () C:\Users\******\Desktop\barchetta-Lexikon   Index F.htm
2014-09-15 10:08 - 2014-09-15 10:08 - 00000000 ____D () C:\Users\******\Desktop\barchetta-Lexikon   Index F-Dateien
2014-09-15 10:01 - 2014-09-15 10:01 - 00065886 _____ () C:\Users\******\Desktop\barchetta-Lexikon   Sicherungen und Relais.htm
2014-09-15 10:01 - 2014-09-15 10:01 - 00000000 ____D () C:\Users\******\Desktop\barchetta-Lexikon   Sicherungen und Relais-Dateien
2014-09-14 22:08 - 2014-09-14 22:39 - 00021312 _____ () C:\Users\******\Desktop\Angebots für die Beheben der Katzenurinschaden,etc..odt
2014-09-14 21:13 - 2014-09-14 21:38 - 00022090 _____ () C:\Users\******\Desktop\Wohnung ************** Liste der Sch+ñden.odt
2014-09-14 19:10 - 2014-09-14 19:12 - 00063000 _____ () C:\Users\******\Desktop\Wohnung*************** Dateien auf CD Rom 001.tif
2014-09-14 14:50 - 2014-09-14 14:52 - 00000000 ____D () C:\Users\******\Desktop\Information on ***********
2014-09-14 14:50 - 2014-09-14 14:50 - 00000000 ____D () C:\Users\******\Documents\Neuer Ordner (2)
2014-09-14 14:48 - 2014-09-14 14:48 - 00001688 _____ () C:\Users\******\Desktop\The entire damage to the flat 25A.lnk
2014-09-14 13:23 - 2014-09-14 13:23 - 00021635 _____ () C:\Users\******\Downloads\Outlook.com(3).zip
2014-09-14 13:20 - 2014-09-14 13:21 - 00000000 ____D () C:\Users\******\Downloads\Outlook.com(2)
2014-09-14 13:20 - 2014-09-14 13:20 - 00060636 _____ () C:\Users\******\Downloads\Outlook.com(2).zip
2014-09-14 12:30 - 2014-09-14 12:30 - 06886537 _____ () C:\Users\******\Downloads\FW Teil 16.eml
2014-09-14 12:19 - 2014-09-14 12:19 - 00000000 ____D () C:\Users\******\Downloads\Outlook.com(1)
2014-09-14 12:18 - 2014-09-14 12:18 - 00741222 _____ () C:\Users\******\Downloads\Outlook.com(1).zip
2014-09-14 10:16 - 2014-09-14 10:23 - 00000000 ____D () C:\Users\******\Desktop\Auflistung Rechnungsbeträge Schäden
2014-09-13 16:50 - 2014-09-13 16:56 - 00000000 ____D () C:\Users\******\Desktop\15-Schriftverkehr mit Beklagten und Versicherung der Beklagten
2014-09-13 10:23 - 2014-09-13 10:25 - 00000000 ____D () C:\Users\******\Downloads\Outlook.com
2014-09-13 10:23 - 2014-09-13 10:23 - 00032393 _____ () C:\Users\******\Downloads\Outlook.com.zip
2014-09-11 21:50 - 2014-09-11 21:50 - 00016386 _____ () C:\Users\******\Desktop\www.Tagesgeldkonto.com-Kuendigen.odt
2014-09-10 18:19 - 2014-09-14 20:38 - 00000000 ____D () C:\Users\******\Desktop\13-Brandlöcher im Badezimmer
2014-09-09 17:39 - 2014-09-14 13:19 - 00000000 ____D () C:\Users\******\Desktop\1-2-3Gegenbeweiß angeblich unterkommene wohnung
2014-09-09 12:06 - 2014-09-14 20:34 - 00000000 ____D () C:\Users\******\Desktop\5-Urinschaden im Schlafzimmer (Türschwelle neben Wohnungsflur)
2014-09-09 09:09 - 2014-09-09 09:09 - 00009267 _____ () C:\Users\******\Documents\Schaden nach Auszug von Mietern am 1.11.2013.odt
2014-09-09 09:07 - 2014-09-09 16:41 - 00021641 _____ () C:\Users\******\Documents\Liste Schaden festgestellt am Freitag 1.11.2013.odt
2014-09-08 18:48 - 2014-09-12 21:56 - 00015884 _____ () C:\Users\******\Documents\Hammer rechnung 9.12.2013.odt
2014-09-08 18:14 - 2014-09-11 14:18 - 00017582 _____ () C:\Users\******\Documents\Hasselbring 2.12.2013.odt
2014-09-08 13:22 - 2014-09-14 20:32 - 00000000 ____D () C:\Users\******\Desktop\12-Brandlöcher und Urinschaden Türschwelle von Wohnzimmer
2014-09-08 13:20 - 2014-09-14 20:26 - 00000000 ____D () C:\Users\******\Desktop\11-Schaden durch die Luftpistole im Zimmer zur Straße
2014-09-08 13:12 - 2014-09-14 20:25 - 00000000 ____D () C:\Users\******\Desktop\10-Urinschaden ***************** (unterer Teil Rigipswand und Fliesenboden
2014-09-08 13:05 - 2014-09-14 20:18 - 00000000 ____D () C:\Users\******\Desktop\9-Küche (Holzdielen und OSB Platten) durch Katzen-Urinschaden
2014-09-08 12:51 - 2014-09-14 20:35 - 00000000 ____D () C:\Users\******\Desktop\8-Urin Schaden (Holzdiele und OSB Platten) neben Waschmachine
2014-09-08 12:38 - 2014-09-14 20:35 - 00000000 ____D () C:\Users\******\Desktop\7-Urinschaden neben Warmwasseranlage in oberer Diele bis Wohnungstür (Holz Dielen und OSB Platten)
2014-09-08 12:13 - 2014-09-14 20:32 - 00000000 ____D () C:\Users\******\Desktop\6-Warmwasseranlage Urinschaden an der Holzkonstruktion Sowie darunter OSB und holzdiele
2014-09-08 11:55 - 2014-09-14 20:33 - 00000000 ____D () C:\Users\******\Desktop\4-Urinschaden in Wohnungsflur (Holzdielen,Schlafzimmer Türschwelle und Wohnungs Türschwelle)
2014-09-07 20:59 - 2014-09-07 20:59 - 04342687 _____ () C:\Users\******\Downloads\Bilder von  Vormieter ************************* Zustand der Wohnung kurz vor Übergabe ************(1).zip
2014-09-07 20:40 - 2014-09-21 11:15 - 00000000 ___RD () C:\Users\******\OneDrive
2014-09-07 20:40 - 2014-09-07 20:40 - 00002153 _____ () C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-09-07 20:40 - 2014-09-07 20:40 - 00002120 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-09-07 20:40 - 2014-09-07 20:40 - 00002120 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-09-07 20:40 - 2014-09-07 20:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2014-09-07 20:40 - 2014-09-07 20:39 - 06014120 _____ (Microsoft Corporation) C:\Users\******\Downloads\OneDriveSetup.exe
2014-09-07 20:39 - 2014-09-07 20:39 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-09-07 20:01 - 2014-09-07 20:01 - 04342687 _____ () C:\Users\******\Downloads\Bilder von  *******.zip
2014-09-06 15:55 - 2014-09-14 14:49 - 00000000 ____D () C:\Users\******\Documents\yyyyy
2014-09-06 14:06 - 2014-09-06 15:49 - 00000000 ____D () C:\Users\******\Documents\xxxx
2014-09-06 13:26 - 2014-09-06 13:26 - 02305238 _____ () C:\Users\******\Downloads\Bilder.zip
2014-09-06 09:55 - 2014-09-06 09:55 - 00013479 _____ () C:\Users\******\Desktop\Anmeldungsamt Osterreich 001 - Verknüpfung.lnk
2014-09-06 09:20 - 2014-09-06 09:34 - 00000000 ____D () C:\Users\******\Desktop\Breitenbrunn,Bahnhofstr40
2014-09-04 17:59 - 2014-09-04 17:59 - 00000000 ____D () C:\Users\******\AppData\Roaming\AVAST Software
2014-09-04 17:58 - 2014-09-21 09:13 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-09-04 17:58 - 2014-09-04 17:58 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-09-04 17:58 - 2014-09-04 17:58 - 00001926 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-09-04 17:58 - 2014-09-04 17:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-09-04 17:58 - 2014-09-04 17:57 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-09-04 17:58 - 2014-09-04 17:57 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-09-04 17:58 - 2014-09-04 17:57 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-09-04 17:58 - 2014-09-04 17:57 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-09-04 17:58 - 2014-09-04 17:57 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-09-04 17:58 - 2014-09-04 17:57 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-09-04 17:58 - 2014-09-04 17:57 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-09-04 17:58 - 2014-09-04 17:57 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-09-04 17:57 - 2014-09-04 17:57 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-09-04 17:57 - 2014-09-04 17:57 - 00000000 ____D () C:\Program Files\AVAST Software
2014-09-04 17:55 - 2014-09-04 17:56 - 91906368 _____ (AVAST Software) C:\Users\******\Downloads\avast_free_antivirus_setup_9.0.2021.exe
2014-09-04 17:29 - 2014-09-04 17:29 - 00001990 _____ () C:\Users\Public\Desktop\Unitymedia Programme.lnk
2014-09-04 17:29 - 2014-09-04 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unitymedia Programme
2014-09-04 17:28 - 2014-09-04 17:34 - 00000000 ____D () C:\Program Files (x86)\Unitymedia
2014-09-04 17:27 - 2014-09-04 17:28 - 00000000 ____D () C:\ProgramData\F-Secure
2014-09-04 17:26 - 2014-09-04 17:26 - 00863920 _____ (F-Secure Corporation) C:\Users\******\Downloads\Hilfe_Service_Downloads_Unitymedia-Sicherheitspaket.exe
2014-09-03 15:52 - 2014-09-03 15:52 - 00000000 ____D () C:\Users\******\Documents\Abrechnungsfälle
2014-09-03 15:50 - 2014-09-03 15:50 - 00002159 _____ () C:\Users\Public\Desktop\Nebenkosten Abrechnung.lnk
2014-09-03 15:50 - 2014-09-03 15:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rechtstipps
2014-09-01 15:08 - 2014-09-08 17:23 - 00000000 ____D () C:\Users\******\Documents\Bremervörde data
2014-09-01 15:07 - 2014-09-01 15:07 - 00001885 _____ () C:\Users\******\Desktop\Pelletoven - Verknüpfung.lnk
2014-09-01 15:06 - 2014-09-01 15:06 - 00001863 _____ () C:\Users\******\Documents\Pelletoven - Verknüpfung (2).lnk
2014-09-01 15:06 - 2014-09-01 15:06 - 00000000 ____D () C:\Users\******\Documents\Neuer Ordner
2014-09-01 15:02 - 2014-09-01 15:14 - 00000000 ____D () C:\Users\******\Documents\Pelletoven
2014-09-01 15:02 - 2014-09-01 15:02 - 00001863 _____ () C:\Users\******\Documents\Pelletoven - Verknüpfung.lnk
2014-08-28 20:20 - 2014-09-05 20:23 - 00000000 ____D () C:\Users\******\AppData\Roaming\ImgBurn
2014-08-28 20:17 - 2014-08-28 20:17 - 00001877 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
2014-08-28 20:17 - 2014-08-28 20:17 - 00001865 _____ () C:\Users\Public\Desktop\ImgBurn.lnk
2014-08-28 20:17 - 2014-08-28 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
2014-08-28 20:17 - 2014-08-28 20:17 - 00000000 ____D () C:\Program Files (x86)\ImgBurn
2014-08-28 20:16 - 2014-08-28 20:16 - 03469871 _____ (LIGHTNING UK!) C:\Users\******\Downloads\SetupImgBurn_2.5.8.0.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-21 14:02 - 2014-09-21 13:23 - 00000000 ____D () C:\FRST
2014-09-21 13:25 - 2010-11-21 08:50 - 00696132 _____ () C:\Windows\system32\perfh007.dat
2014-09-21 13:25 - 2010-11-21 08:50 - 00147428 _____ () C:\Windows\system32\perfc007.dat
2014-09-21 13:25 - 2009-07-14 07:13 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-21 13:22 - 2014-09-21 09:11 - 00001189 _____ () C:\Windows\setupact.log
2014-09-21 13:14 - 2009-07-14 06:45 - 00022352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-21 13:14 - 2009-07-14 06:45 - 00022352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-21 13:12 - 2013-07-12 17:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-21 13:00 - 2013-08-23 12:15 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-21 13:00 - 2013-07-21 19:45 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-09-21 13:00 - 2013-07-12 12:13 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2014-09-21 13:00 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-21 11:15 - 2014-09-07 20:40 - 00000000 ___RD () C:\Users\******\OneDrive
2014-09-21 11:09 - 2014-05-11 19:50 - 01552229 _____ () C:\Windows\WindowsUpdate.log
2014-09-21 09:13 - 2014-09-04 17:58 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-09-21 09:11 - 2014-09-21 09:11 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-19 13:31 - 2013-07-12 17:59 - 00000000 ____D () C:\Users\******\AppData\Roaming\Skype
2014-09-19 13:27 - 2014-09-16 19:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-19 13:25 - 2014-09-19 13:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-19 13:25 - 2014-03-02 19:50 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-19 13:25 - 2014-03-02 19:50 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-19 13:25 - 2013-07-12 17:59 - 00000000 ____D () C:\ProgramData\Skype
2014-09-19 12:12 - 2013-07-12 12:13 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2014-09-19 09:42 - 2014-09-19 09:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-18 11:17 - 2014-09-18 11:17 - 00001693 _____ () C:\Users\Public\Desktop\LohnSteuer-Experte 2014.lnk
2014-09-18 11:17 - 2014-09-18 11:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LohnSteuer-Experte 2014
2014-09-18 11:17 - 2013-07-12 17:56 - 00000000 ____D () C:\haude
2014-09-18 11:15 - 2014-09-18 11:15 - 28303136 _____ (haude electronica verlag ) C:\Users\******\Downloads\lohnsteuerexperte2014.exe
2014-09-16 19:20 - 2014-09-16 19:20 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-09-16 19:20 - 2014-09-16 19:20 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-09-16 17:19 - 2014-09-16 17:19 - 01101648 _____ () C:\Users\******\Downloads\Firefox - CHIP-Installer.exe
2014-09-16 17:17 - 2014-09-16 17:17 - 00339364 _____ () C:\Users\******\Desktop\bookmarks-2014-09-16.json
2014-09-15 10:08 - 2014-09-15 10:08 - 00023397 _____ () C:\Users\******\Desktop\barchetta-Lexikon   Index F.htm
2014-09-15 10:08 - 2014-09-15 10:08 - 00000000 ____D () C:\Users\******\Desktop\barchetta-Lexikon   Index F-Dateien
2014-09-15 10:01 - 2014-09-15 10:01 - 00065886 _____ () C:\Users\******\Desktop\barchetta-Lexikon   Sicherungen und Relais.htm
2014-09-15 10:01 - 2014-09-15 10:01 - 00000000 ____D () C:\Users\******\Desktop\barchetta-Lexikon   Sicherungen und Relais-Dateien
2014-09-14 22:39 - 2014-09-14 22:08 - 00021312 _____ () C:\Users\******\Desktop\Angebots für die Beheben der Katzenurinschaden,etc..odt
2014-09-14 21:38 - 2014-09-14 21:13 - 00022090 _____ () C:\Users\******\Desktop\Wohnung *************++r Sch+ñden.odt
2014-09-14 20:38 - 2014-09-10 18:19 - 00000000 ____D () C:\Users\******\Desktop\13-Brandlöcher im Badezimmer
2014-09-14 20:35 - 2014-09-08 12:51 - 00000000 ____D () C:\Users\******\Desktop\8-Urin Schaden (Holzdiele und OSB Platten) neben Waschmachine
2014-09-14 20:35 - 2014-09-08 12:38 - 00000000 ____D () C:\Users\******\Desktop\7-Urinschaden neben Warmwasseranlage in oberer Diele bis Wohnungstür (Holz Dielen und OSB Platten)
2014-09-14 20:34 - 2014-09-09 12:06 - 00000000 ____D () C:\Users\******\Desktop\5-Urinschaden im Schlafzimmer (Türschwelle neben Wohnungsflur)
2014-09-14 20:33 - 2014-09-08 11:55 - 00000000 ____D () C:\Users\******\Desktop\4-Urinschaden in Wohnungsflur (Holzdielen,Schlafzimmer Türschwelle und Wohnungs Türschwelle)
2014-09-14 20:32 - 2014-09-08 13:22 - 00000000 ____D () C:\Users\******\Desktop\12-Brandlöcher und Urinschaden Türschwelle von Wohnzimmer
2014-09-14 20:32 - 2014-09-08 12:13 - 00000000 ____D () C:\Users\******\Desktop\6-Warmwasseranlage Urinschaden an der Holzkonstruktion Sowie darunter OSB und holzdiele
2014-09-14 20:26 - 2014-09-08 13:20 - 00000000 ____D () C:\Users\******\Desktop\11-Schaden durch die Luftpistole im Zimmer zur Straße
2014-09-14 20:25 - 2014-09-08 13:12 - 00000000 ____D () C:\Users\******\Desktop\10-Urinschaden *************ich (unterer Teil Rigipswand und Fliesenboden
2014-09-14 20:18 - 2014-09-08 13:05 - 00000000 ____D () C:\Users\******\Desktop\9-Küche (Holzdielen und OSB Platten) durch Katzen-Urinschaden
2014-09-14 19:12 - 2014-09-14 19:10 - 00063000 _____ () C:\Users\******\Desktop\Wohnung******************en auf CD Rom 001.tif
2014-09-14 14:52 - 2014-09-14 14:50 - 00000000 ____D () C:\Users\******\Desktop\Information on ***********e
2014-09-14 14:52 - 2014-02-11 11:47 - 00000000 ____D () C:\Users\******\Desktop\******
2014-09-14 14:50 - 2014-09-14 14:50 - 00000000 ____D () C:\Users\******\Documents\Neuer Ordner (2)
2014-09-14 14:49 - 2014-09-06 15:55 - 00000000 ____D () C:\Users\******\Documents\yyyyy
2014-09-14 14:48 - 2014-09-14 14:48 - 00001688 _____ () C:\Users\******\Desktop\The entire damage to the flat 25A.lnk
2014-09-14 13:23 - 2014-09-14 13:23 - 00021635 _____ () C:\Users\******\Downloads\Outlook.com(3).zip
2014-09-14 13:21 - 2014-09-14 13:20 - 00000000 ____D () C:\Users\******\Downloads\Outlook.com(2)
2014-09-14 13:20 - 2014-09-14 13:20 - 00060636 _____ () C:\Users\******\Downloads\Outlook.com(2).zip
2014-09-14 13:19 - 2014-09-09 17:39 - 00000000 ____D () C:\Users\******\Desktop\1-2-3Gegenbeweiß angeblich unterkommene wohnung
2014-09-14 12:30 - 2014-09-14 12:30 - 06886537 _____ () C:\Users\******\Downloads\FW Teil 16.eml
2014-09-14 12:19 - 2014-09-14 12:19 - 00000000 ____D () C:\Users\******\Downloads\Outlook.com(1)
2014-09-14 12:18 - 2014-09-14 12:18 - 00741222 _____ () C:\Users\******\Downloads\Outlook.com(1).zip
2014-09-14 10:23 - 2014-09-14 10:16 - 00000000 ____D () C:\Users\******\Desktop\Auflistung Rechnungsbeträge Schäden
2014-09-13 16:56 - 2014-09-13 16:50 - 00000000 ____D () C:\Users\******\Desktop\15-Schriftverkehr mit Beklagten und Versicherung der Beklagten
2014-09-13 10:25 - 2014-09-13 10:23 - 00000000 ____D () C:\Users\******\Downloads\Outlook.com
2014-09-13 10:23 - 2014-09-13 10:23 - 00032393 _____ () C:\Users\******\Downloads\Outlook.com.zip
2014-09-12 21:56 - 2014-09-08 18:48 - 00015884 _____ () C:\Users\******\Documents\Hammer rechnung 9.12.2013.odt
2014-09-12 19:05 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-11 21:50 - 2014-09-11 21:50 - 00016386 _____ () C:\Users\******\Desktop\www.Tagesgeldkonto.com-Kuendigen.odt
2014-09-11 14:18 - 2014-09-08 18:14 - 00017582 _____ () C:\Users\******\Documents\Hasselbring 2.12.2013.odt
2014-09-10 15:12 - 2013-07-12 17:56 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 15:12 - 2013-07-12 17:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 15:12 - 2013-07-12 17:56 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-09 16:41 - 2014-09-09 09:07 - 00021641 _____ () C:\Users\******\Documents\Liste Schaden festgestellt am Freitag 1.11.2013.odt
2014-09-09 09:09 - 2014-09-09 09:09 - 00009267 _____ () C:\Users\******\Documents\Schaden nach Auszug von Mietern am 1.11.2013.odt
2014-09-08 18:17 - 2014-03-17 19:53 - 00016596 _____ () C:\Users\******\Documents\Lange & Peters Kostenvoranschlag.odt
2014-09-08 17:55 - 2014-03-17 20:51 - 00016743 _____ () C:\Users\******\Documents\Mindestkosten.odt
2014-09-08 17:23 - 2014-09-01 15:08 - 00000000 ____D () C:\Users\******\Documents\Bremervörde data
2014-09-08 17:20 - 2014-03-17 20:59 - 00017203 _____ () C:\Users\******\Documents\Angebot Ergebnis..odt
2014-09-07 20:59 - 2014-09-07 20:59 - 04342687 _____ () C:\Users\******\Downloads\Bilder ****************(1).zip
2014-09-07 20:40 - 2014-09-07 20:40 - 00002153 _____ () C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-09-07 20:40 - 2014-09-07 20:40 - 00002120 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-09-07 20:40 - 2014-09-07 20:40 - 00002120 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-09-07 20:40 - 2014-09-07 20:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2014-09-07 20:40 - 2013-07-12 11:20 - 00000000 ____D () C:\Users\******
2014-09-07 20:39 - 2014-09-07 20:40 - 06014120 _____ (Microsoft Corporation) C:\Users\******\Downloads\OneDriveSetup.exe
2014-09-07 20:39 - 2014-09-07 20:39 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-09-07 20:01 - 2014-09-07 20:01 - 04342687 _____ () C:\Users\******\Downloads\Bilder von  ****************.zip
2014-09-06 15:49 - 2014-09-06 14:06 - 00000000 ____D () C:\Users\******\Documents\xxxx
2014-09-06 13:26 - 2014-09-06 13:26 - 02305238 _____ () C:\Users\******\Downloads\Bilder.zip
2014-09-06 09:55 - 2014-09-06 09:55 - 00013479 _____ () C:\Users\******\Desktop\Anmeldungsamt Osterreich 001 - Verknüpfung.lnk
2014-09-06 09:34 - 2014-09-06 09:20 - 00000000 ____D () C:\Users\******\Desktop\****************Bilder Austria
2014-09-05 20:23 - 2014-08-28 20:20 - 00000000 ____D () C:\Users\******\AppData\Roaming\ImgBurn
2014-09-04 17:59 - 2014-09-04 17:59 - 00000000 ____D () C:\Users\******\AppData\Roaming\AVAST Software
2014-09-04 17:58 - 2014-09-04 17:58 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-09-04 17:58 - 2014-09-04 17:58 - 00001926 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-09-04 17:58 - 2014-09-04 17:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-09-04 17:57 - 2014-09-04 17:58 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-09-04 17:57 - 2014-09-04 17:58 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-09-04 17:57 - 2014-09-04 17:58 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-09-04 17:57 - 2014-09-04 17:58 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-09-04 17:57 - 2014-09-04 17:58 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-09-04 17:57 - 2014-09-04 17:58 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-09-04 17:57 - 2014-09-04 17:58 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-09-04 17:57 - 2014-09-04 17:58 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-09-04 17:57 - 2014-09-04 17:57 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-09-04 17:57 - 2014-09-04 17:57 - 00000000 ____D () C:\Program Files\AVAST Software
2014-09-04 17:57 - 2013-07-12 17:59 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-09-04 17:56 - 2014-09-04 17:55 - 91906368 _____ (AVAST Software) C:\Users\******\Downloads\avast_free_antivirus_setup_9.0.2021.exe
2014-09-04 17:34 - 2014-09-04 17:28 - 00000000 ____D () C:\Program Files (x86)\Unitymedia
2014-09-04 17:29 - 2014-09-04 17:29 - 00001990 _____ () C:\Users\Public\Desktop\Unitymedia Programme.lnk
2014-09-04 17:29 - 2014-09-04 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unitymedia Programme
2014-09-04 17:28 - 2014-09-04 17:27 - 00000000 ____D () C:\ProgramData\F-Secure
2014-09-04 17:26 - 2014-09-04 17:26 - 00863920 _____ (F-Secure Corporation) C:\Users\******\Downloads\Hilfe_Service_Downloads_Unitymedia-Sicherheitspaket.exe
2014-09-03 15:52 - 2014-09-03 15:52 - 00000000 ____D () C:\Users\******\Documents\Abrechnungsfälle
2014-09-03 15:52 - 2013-07-26 15:04 - 00000000 ____D () C:\Users\******\AppData\Local\AAV
2014-09-03 15:50 - 2014-09-03 15:50 - 00002159 _____ () C:\Users\Public\Desktop\Nebenkosten Abrechnung.lnk
2014-09-03 15:50 - 2014-09-03 15:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rechtstipps
2014-09-03 15:50 - 2013-07-26 14:54 - 00000000 ____D () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft
2014-09-03 15:48 - 2013-07-26 14:52 - 00000000 ____D () C:\ProgramData\AAV
2014-09-03 12:45 - 2013-09-18 18:46 - 00000000 ____D () C:\QuickImmobilie 2012
2014-09-03 12:44 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-09-01 15:14 - 2014-09-01 15:02 - 00000000 ____D () C:\Users\******\Documents\Pelletoven
2014-09-01 15:13 - 2014-02-11 11:58 - 00000000 ____D () C:\Users\******\Desktop\****** general
2014-09-01 15:07 - 2014-09-01 15:07 - 00001885 _____ () C:\Users\******\Desktop\Pelletoven - Verknüpfung.lnk
2014-09-01 15:06 - 2014-09-01 15:06 - 00001863 _____ () C:\Users\******\Documents\Pelletoven - Verknüpfung (2).lnk
2014-09-01 15:06 - 2014-09-01 15:06 - 00000000 ____D () C:\Users\******\Documents\Neuer Ordner
2014-09-01 15:02 - 2014-09-01 15:02 - 00001863 _____ () C:\Users\******\Documents\Pelletoven - Verknüpfung.lnk
2014-08-28 20:17 - 2014-08-28 20:17 - 00001877 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
2014-08-28 20:17 - 2014-08-28 20:17 - 00001865 _____ () C:\Users\Public\Desktop\ImgBurn.lnk
2014-08-28 20:17 - 2014-08-28 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
2014-08-28 20:17 - 2014-08-28 20:17 - 00000000 ____D () C:\Program Files (x86)\ImgBurn
2014-08-28 20:16 - 2014-08-28 20:16 - 03469871 _____ (LIGHTNING UK!) C:\Users\******\Downloads\SetupImgBurn_2.5.8.0.exe
2014-08-28 20:16 - 2014-01-03 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MagicISO
2014-08-28 20:16 - 2014-01-03 14:10 - 00000000 ____D () C:\Program Files (x86)\MagicISO

Some content of TEMP:
====================
C:\Users\******\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-16 10:03

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-09-2014 01
Ran by Nick at 2014-09-21 14:03:01
Running from E:\
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
BattlEye (A2Free) Uninstall (HKLM-x32\...\BattlEye A2 Free) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)
CrystalDiskInfo 6.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Haushaltsbuch 2014 v2.14 (HKLM-x32\...\Haushaltsbuch 2014) (Version: 2.14 - S.A.D.)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.36354 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2857 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.738.1 - Intel Corporation) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LohnSteuer-Experte 2013 (HKLM-x32\...\LohnSteuer-Experte 2013_is1) (Version: 19.1.0 - haude electronica verlag)
LohnSteuer-Experte 2014 (HKLM-x32\...\LohnSteuer-Experte 2014_is1) (Version: 20.3.0.0 - haude electronica verlag)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.2 (x86 de)) (Version: 32.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.1 - Mozilla)
MyExpatNet 0.9.1.14 (HKLM-x32\...\MyExpatNet) (Version: 0.9.1.14 - )
NebenkostenAbrechnung (HKLM-x32\...\{BE55D9F0-3F12-4C7E-8AA2-7432FE145D35}) (Version: 1.01 - Wolters Kluwer Deutschland GmbH)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )
NVIDIA 3D Vision Controller-Treiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 320.49 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 320.49 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 320.49 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2049 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.211.0 - Tracker Software Products Ltd)
QuickImmobilie 2012 (HKLM-x32\...\{427875CA-82DE-42B5-8B15-EA7DC60BB91A}) (Version: 12.0.0 - Haufe-Lexware Real Estate AG)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6690 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.09 - Wolters Kluwer Deutschland GmbH)
System Requirements Lab for Intel (HKLM-x32\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.11 - TeamSpeak Systems GmbH)
Unitymedia Programme (HKLM-x32\...\F-Secure ServiceEnabler 47796) (Version: 1.71.340.0 - F-Secure Corporation)
Unitymedia Programme (x32 Version: 1.71.340.0 - F-Secure Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

01-09-2014 14:48:16 Geplanter Prüfpunkt
03-09-2014 13:49:36 NebenkostenAbrechnung wurde installiert.
04-09-2014 15:20:56 avast! antivirus system restore point
04-09-2014 15:57:08 avast! antivirus system restore point
12-09-2014 07:21:08 Geplanter Prüfpunkt
19-09-2014 13:37:46 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {131688AD-F3D6-47D5-9960-09597D501165} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {25A49E09-201E-4CAD-A12A-1A206415B284} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-09-04] (AVAST Software)
Task: {291D24A0-EE97-45B1-9C88-B72555753B64} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16] (Intel Corporation)
Task: {3AA7BE19-899E-4852-B1E1-9684F99055EE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {670F72D1-8614-4BF7-BF7D-361D1197FB08} - System32\Tasks\{881314CD-F38D-4868-99BD-7C09C3BF431A} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain
Task: {8F6C8211-5F22-4DD9-A112-82C076D89106} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16] (Intel Corporation)
Task: {ACB34A21-D855-4593-8218-C954FA0CFAAC} - System32\Tasks\{C884B3F5-EE9C-42EA-BDA3-409277F63FE6} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&amp;page=tsPlugin
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

==================== Loaded Modules (whitelisted) =============

2013-08-23 12:15 - 2013-06-21 12:23 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2013-07-08 09:23 - 2012-09-17 16:23 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-09-04 17:57 - 2014-09-04 17:57 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-09-21 09:13 - 2014-09-21 09:13 - 02864640 _____ () C:\Program Files\AVAST Software\Avast\defs\14092001\algo.dll
2014-09-04 17:29 - 2014-09-04 17:29 - 00593464 _____ () C:\Windows\WinSxS\x86_f-secure.qt_4_6_2_2e112a926211c0a3_4.6.482.65_none_b59e1e0911fd55ab\QtMultimediaKit1.dll
2014-09-04 17:57 - 2014-09-04 17:57 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-07-12 12:13 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Nick\Downloads\FW Teil 16.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/21/2014 01:01:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/21/2014 00:55:51 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 512) (User: )
Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.


Details:
Could not query the status of the EventSystem service.

System Error:
Der Computer wird heruntergefahren.
.

Error: (09/21/2014 00:51:38 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (09/21/2014 11:53:18 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (09/21/2014 11:26:55 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/21/2014 09:12:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 01:28:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 09:17:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/18/2014 07:45:19 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2014 05:37:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (09/21/2014 01:07:56 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (09/21/2014 00:50:29 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (09/21/2014 00:08:36 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (09/21/2014 11:53:10 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (09/21/2014 11:43:46 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (09/21/2014 11:33:01 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084NVSvc{DCAB0989-1301-4319-BE5F-ADE89F88581C}

Error: (09/21/2014 11:30:50 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084MSIServer{000C101C-0000-0000-C000-000000000046}

Error: (09/21/2014 11:29:01 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (09/21/2014 11:29:01 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F}

Error: (09/21/2014 11:29:01 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}


Microsoft Office Sessions:
=========================
Error: (09/21/2014 01:01:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/21/2014 00:55:51 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 512) (User: )
Description: 
Details:
Could not query the status of the EventSystem service.

System Error:
Der Computer wird heruntergefahren.

Error: (09/21/2014 00:51:38 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestD:\computerbild_downloader_fuer_winzip.exe

Error: (09/21/2014 11:53:18 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Users\Nick\Documents\computerbild_downloader_fuer_winzip.exe

Error: (09/21/2014 11:26:55 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/21/2014 09:12:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 01:28:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/19/2014 09:17:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/18/2014 07:45:19 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2014 05:37:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: Intel(R) Celeron(R) CPU G550 @ 2.60GHz
Percentage of memory in use: 34%
Total physical RAM: 3774.2 MB
Available physical RAM: 2462.31 MB
Total Pagefile: 7546.59 MB
Available Pagefile: 6287.33 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.88 GB) (Free:148.81 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (INTENSO) (Removable) (Total:7.42 GB) (Free:7.42 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 6AF95C48)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7.4 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7.4 GB) - (Type=0B)

==================== End Of Log ============================

schrauber · 21.09.2014, 14:24

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

black977 · 21.09.2014, 20:06

okay hier die txt

Code:

ATTFilter

ComboFix 14-09-18.01 - Nick 21.09.2014  20:51:33.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3774.1984 [GMT 2:00]
ausgeführt von:: c:\users\Nick\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-08-21 bis 2014-09-21  ))))))))))))))))))))))))))))))
.
.
2014-09-21 18:57 . 2014-09-21 18:57	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-09-21 18:26 . 2014-09-21 18:26	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-21 18:26 . 2014-09-21 18:26	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2014-09-21 18:26 . 2014-09-21 18:26	--------	d-----w-	c:\programdata\Malwarebytes
2014-09-21 18:26 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-09-21 18:26 . 2014-05-12 05:26	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-09-21 18:26 . 2014-05-12 05:25	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-09-21 18:21 . 2014-09-21 18:21	--------	d-----w-	c:\users\Nick\AppData\Roaming\Abelssoft
2014-09-21 18:21 . 2014-09-21 18:21	--------	d-----w-	c:\programdata\XDMessagingv4
2014-09-21 18:21 . 2014-09-21 18:21	--------	d-----w-	c:\users\Nick\AppData\Local\Abelssoft
2014-09-21 18:21 . 2014-09-21 18:24	--------	d-----w-	c:\program files (x86)\CHIP Updater
2014-09-21 18:21 . 2011-05-13 10:16	493056	----a-w-	c:\windows\SysWow64\dhRichClient3.dll
2014-09-21 18:21 . 2011-03-25 18:42	338432	----a-w-	c:\windows\SysWow64\sqlite36_engine.dll
2014-09-21 11:23 . 2014-09-21 12:03	--------	d-----w-	C:\FRST
2014-09-19 11:25 . 2014-09-19 11:25	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-09-16 17:20 . 2014-09-19 11:27	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2014-09-07 18:40 . 2014-09-21 18:47	--------	d-----r-	c:\users\Nick\OneDrive
2014-09-07 18:40 . 2014-09-07 18:40	--------	d-----w-	c:\program files (x86)\Microsoft OneDrive
2014-09-07 18:39 . 2014-09-07 18:39	--------	d-----w-	c:\programdata\Microsoft OneDrive
2014-09-04 15:59 . 2014-09-04 15:59	--------	d-----w-	c:\users\Nick\AppData\Roaming\AVAST Software
2014-09-04 15:58 . 2014-09-04 15:57	92008	----a-w-	c:\windows\system32\drivers\aswStm.sys
2014-09-04 15:58 . 2014-09-04 15:57	224896	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-09-04 15:58 . 2014-09-04 15:57	1041168	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-09-04 15:58 . 2014-09-04 15:58	427360	----a-w-	c:\windows\system32\drivers\aswsp.sys
2014-09-04 15:58 . 2014-09-04 15:57	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-09-04 15:58 . 2014-09-04 15:57	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-09-04 15:58 . 2014-09-04 15:57	29208	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2014-09-04 15:58 . 2014-09-04 15:57	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-09-04 15:58 . 2014-09-04 15:57	307344	----a-w-	c:\windows\system32\aswBoot.exe
2014-09-04 15:57 . 2014-09-04 15:57	43152	----a-w-	c:\windows\avastSS.scr
2014-09-04 15:57 . 2014-09-04 15:57	--------	d-----w-	c:\program files\AVAST Software
2014-09-04 15:28 . 2014-09-04 15:34	--------	d-----w-	c:\program files (x86)\Unitymedia
2014-09-04 15:27 . 2014-09-04 15:28	--------	d-----w-	c:\programdata\F-Secure
2014-08-28 18:20 . 2014-09-05 18:23	--------	d-----w-	c:\users\Nick\AppData\Roaming\ImgBurn
2014-08-28 18:17 . 2014-08-28 18:17	--------	d-----w-	c:\program files (x86)\ImgBurn
2014-08-28 06:58 . 2014-09-21 18:33	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C9B59F0C-CA1F-43A9-9447-5837F8F4503C}\offreg.dll
2014-08-28 06:57 . 2014-08-21 09:24	11319192	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C9B59F0C-CA1F-43A9-9447-5837F8F4503C}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-10 13:12 . 2013-07-12 15:56	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-10 13:12 . 2013-07-12 15:56	701104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-08-04 09:12 . 2014-08-04 09:12	486	----a-w-	c:\windows\system32\cc_20140804_111220.reg
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-09-07 18:39	233128	----a-w-	c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-09-07 18:39	233128	----a-w-	c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-09-07 18:39	233128	----a-w-	c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyDrive"="c:\users\Nick\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" [2014-09-07 251040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Hoster (47796)"="c:\program files (x86)\Unitymedia\fshoster32.exe" [2012-11-26 183864]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-09-04 4085896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
2;2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 asahci64;asahci64;c:\windows\system32\DRIVERS\asahci64.sys;c:\windows\SYSNATIVE\DRIVERS\asahci64.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 AAV UpdateService;AAV UpdateService;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 fshoster;F-Secure Dll Hoster;c:\program files (x86)\Unitymedia\fshoster32.exe;c:\program files (x86)\Unitymedia\fshoster32.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-12 13:12]
.
2014-09-21 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16 09:54]
.
2014-09-19 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16 09:54]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-09-07 18:40	260776	----a-w-	c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-09-07 18:40	260776	----a-w-	c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-09-07 18:40	260776	----a-w-	c:\users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-09-04 15:57	634872	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-09-21 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-09-21 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-09-21 441152]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-07-13 12936848]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-07-27 1028896]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\wiugkr5a.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/iplayer|hxxp://www.telegraph.co.uk/|hxxp://www.finanzen.net/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-BattlEye A2 Free - e:\bohemia interactivebattleye\UnInstallBE.exe
AddRemove-TeamSpeak 3 Client - e:\lol\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\fshoster]
"ImagePath"="\"c:\program files (x86)\Unitymedia\fshoster32.exe\" -hosterid:0"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-09-21  20:58:31
ComboFix-quarantined-files.txt  2014-09-21 18:58
.
Vor Suchlauf: 15 Verzeichnis(se), 159.307.649.024 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 158.812.733.440 Bytes frei
.
- - End Of File - - B9A9324AB8B70A06EC06A197B10EE71A
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 22.09.2014, 09:42

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

black977 · 22.09.2014, 11:13

malwb

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 22.09.2014
Suchlauf-Zeit: 11:09:18
Logdatei: malewarebytes.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.22.01
Rootkit Datenbank: v2014.09.19.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Nick

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 322852
Verstrichene Zeit: 19 Min, 23 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 3
PUP.Optional.Softonic.A, C:\Users\Nick\Documents\SoftonicDownloader_fuer_speedfan.exe, In Quarantäne, [cddc3eb2cead49edf7f36cc448b910f0], 
PUP.Optional.Softonic.A, C:\Users\Nick\Downloads\SoftonicDownloader_fuer_speedfan.exe, In Quarantäne, [b1f83cb468130d29dc0e65cb02ff7f81], 
PUP.Optional.OpenCandy, C:\Users\Nick\Downloads\SetupImgBurn_2.5.8.0.exe, In Quarantäne, [6b3e539d27540d2962ed43eae81de917], 

Physische Sektoren: 0
(No malicious items detected)


(end)

Adwc

Code:

ATTFilter

# AdwCleaner v3.310 - Bericht erstellt am 22/09/2014 um 11:41:10
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Nick - NICK-PC
# Gestartet von : C:\Users\Nick\Downloads\AdwCleaner_3.310.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16750


-\\ Mozilla Firefox v32.0.2 (x86 de)

[ Datei : C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\wiugkr5a.default\prefs.js ]


-\\ Google Chrome v

[ Datei : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1223 octets] - [22/09/2014 11:39:10]
AdwCleaner[S0].txt - [1098 octets] - [22/09/2014 11:41:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1158 octets] ##########

JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.9 (09.20.2014:1)
OS: Windows 7 Professional x64
Ran by Nick on 22.09.2014 at 11:48:06,27
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Emptied folder: C:\Users\Nick\AppData\Roaming\mozilla\firefox\profiles\wiugkr5a.default\minidumps [97 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.09.2014 at 12:05:43,89
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST

Code:

ATTFilter

[B]Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-09-2014 01
Ran by Nick at 2014-09-22 12:07:17
Running from C:\Users\Nick\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
BattlEye (A2Free) Uninstall (HKLM-x32\...\BattlEye A2 Free) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)
CHIP Updater (HKLM-x32\...\CHIP Updater_is1) (Version: 2.33 - Abelssoft)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com)
CrystalDiskInfo 6.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Haushaltsbuch 2014 v2.14 (HKLM-x32\...\Haushaltsbuch 2014) (Version: 2.14 - S.A.D.)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.36354 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2857 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.738.1 - Intel Corporation) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LohnSteuer-Experte 2013 (HKLM-x32\...\LohnSteuer-Experte 2013_is1) (Version: 19.1.0 - haude electronica verlag)
LohnSteuer-Experte 2014 (HKLM-x32\...\LohnSteuer-Experte 2014_is1) (Version: 20.3.0.0 - haude electronica verlag)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.2 (x86 de)) (Version: 32.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.1 - Mozilla)
MyExpatNet 0.9.1.14 (HKLM-x32\...\MyExpatNet) (Version: 0.9.1.14 - )
NebenkostenAbrechnung (HKLM-x32\...\{BE55D9F0-3F12-4C7E-8AA2-7432FE145D35}) (Version: 1.01 - Wolters Kluwer Deutschland GmbH)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )
NVIDIA 3D Vision Controller-Treiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 320.49 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 320.49 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 320.49 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2049 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.211.0 - Tracker Software Products Ltd)
QuickImmobilie 2012 (HKLM-x32\...\{427875CA-82DE-42B5-8B15-EA7DC60BB91A}) (Version: 12.0.0 - Haufe-Lexware Real Estate AG)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6690 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.09 - Wolters Kluwer Deutschland GmbH)
System Requirements Lab for Intel (HKLM-x32\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
Unitymedia Programme (HKLM-x32\...\F-Secure ServiceEnabler 47796) (Version: 1.71.340.0 - F-Secure Corporation)
Unitymedia Programme (x32 Version: 1.71.340.0 - F-Secure Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

01-09-2014 14:48:16 Geplanter Prüfpunkt
03-09-2014 13:49:36 NebenkostenAbrechnung wurde installiert.
04-09-2014 15:20:56 avast! antivirus system restore point
04-09-2014 15:57:08 avast! antivirus system restore point
12-09-2014 07:21:08 Geplanter Prüfpunkt
19-09-2014 13:37:46 Geplanter Prüfpunkt
21-09-2014 18:49:35 ComboFix created restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {131688AD-F3D6-47D5-9960-09597D501165} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {25A49E09-201E-4CAD-A12A-1A206415B284} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-09-04] (AVAST Software)
Task: {291D24A0-EE97-45B1-9C88-B72555753B64} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16] (Intel Corporation)
Task: {3AA7BE19-899E-4852-B1E1-9684F99055EE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {670F72D1-8614-4BF7-BF7D-361D1197FB08} - System32\Tasks\{881314CD-F38D-4868-99BD-7C09C3BF431A} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain
Task: {8F6C8211-5F22-4DD9-A112-82C076D89106} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16] (Intel Corporation)
Task: {9A82F651-C18B-4DA7-B47C-2152806BBC50} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe [2014-09-19] (CHIP)
Task: {ACB34A21-D855-4593-8218-C954FA0CFAAC} - System32\Tasks\{C884B3F5-EE9C-42EA-BDA3-409277F63FE6} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&amp;page=tsPlugin
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

==================== Loaded Modules (whitelisted) =============

2013-08-23 12:15 - 2013-06-21 12:23 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2013-07-08 09:23 - 2012-09-17 16:23 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-09-04 17:57 - 2014-09-04 17:57 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-09-22 11:04 - 2014-09-22 11:04 - 02864640 _____ () C:\Program Files\AVAST Software\Avast\defs\14092200\algo.dll
2014-09-04 17:29 - 2014-09-04 17:29 - 00593464 _____ () C:\Windows\WinSxS\x86_f-secure.qt_4_6_2_2e112a926211c0a3_4.6.482.65_none_b59e1e0911fd55ab\QtMultimediaKit1.dll
2014-09-04 17:57 - 2014-09-04 17:57 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-07-12 12:13 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Nick\Downloads\FW Teil 16.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Celeron(R) CPU G550 @ 2.60GHz
Percentage of memory in use: 40%
Total physical RAM: 3774.2 MB
Available physical RAM: 2263.14 MB
Total Pagefile: 7546.59 MB
Available Pagefile: 5950.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.88 GB) (Free:147.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (INTENSO) (Removable) (Total:7.42 GB) (Free:7.42 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 6AF95C48)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7.4 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7.4 GB) - (Type=0B)

==================== End Of Log ===========================

schrauber · 22.09.2014, 16:38

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

black977 · 24.09.2014, 08:58

also bisher keine Probleme

schick dir dann spätestens morgen den eset, sc und nochmal FRST

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=d53a47815371c344a7e62daba4a1ad4b
# engine=20256
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-23 12:00:37
# local_time=2014-09-23 02:00:37 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 95 624187 1627447 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 78184 163103486 0 0
# scanned=73902
# found=1
# cleaned=0
# scan_time=3663
sh=46720407CF76A3A4EBDDAFDBBBFA943B1A8F1E9F ft=1 fh=06416bae119d1e72 vn="Variante von Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Nick\Documents\computerbild_downloader_fuer_winzip.exe"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.87  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
avast! Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 15.0.0.152  
 Mozilla Firefox (32.0.2) 
 Google Chrome 34.0.1847.116  
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast avastui.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-09-2014 01
Ran by Nick at 2014-09-23 14:17:03
Running from C:\Users\Nick\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
BattlEye (A2Free) Uninstall (HKLM-x32\...\BattlEye A2 Free) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)
CHIP Updater (HKLM-x32\...\CHIP Updater_is1) (Version: 2.33 - Abelssoft)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com)
CrystalDiskInfo 6.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Haushaltsbuch 2014 v2.14 (HKLM-x32\...\Haushaltsbuch 2014) (Version: 2.14 - S.A.D.)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.36354 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2857 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.738.1 - Intel Corporation) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LohnSteuer-Experte 2013 (HKLM-x32\...\LohnSteuer-Experte 2013_is1) (Version: 19.1.0 - haude electronica verlag)
LohnSteuer-Experte 2014 (HKLM-x32\...\LohnSteuer-Experte 2014_is1) (Version: 20.3.0.0 - haude electronica verlag)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.2 (x86 de)) (Version: 32.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.1 - Mozilla)
MyExpatNet 0.9.1.14 (HKLM-x32\...\MyExpatNet) (Version: 0.9.1.14 - )
NebenkostenAbrechnung (HKLM-x32\...\{BE55D9F0-3F12-4C7E-8AA2-7432FE145D35}) (Version: 1.01 - Wolters Kluwer Deutschland GmbH)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )
NVIDIA 3D Vision Controller-Treiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 320.49 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 320.49 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 320.49 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2049 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 320.49 (Version: 320.49 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.211.0 - Tracker Software Products Ltd)
QuickImmobilie 2012 (HKLM-x32\...\{427875CA-82DE-42B5-8B15-EA7DC60BB91A}) (Version: 12.0.0 - Haufe-Lexware Real Estate AG)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6690 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.09 - Wolters Kluwer Deutschland GmbH)
System Requirements Lab for Intel (HKLM-x32\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
Unitymedia Programme (HKLM-x32\...\F-Secure ServiceEnabler 47796) (Version: 1.71.340.0 - F-Secure Corporation)
Unitymedia Programme (x32 Version: 1.71.340.0 - F-Secure Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3120075727-420463088-1869709634-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Nick\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

01-09-2014 14:48:16 Geplanter Prüfpunkt
03-09-2014 13:49:36 NebenkostenAbrechnung wurde installiert.
04-09-2014 15:20:56 avast! antivirus system restore point
04-09-2014 15:57:08 avast! antivirus system restore point
12-09-2014 07:21:08 Geplanter Prüfpunkt
19-09-2014 13:37:46 Geplanter Prüfpunkt
21-09-2014 18:49:35 ComboFix created restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {131688AD-F3D6-47D5-9960-09597D501165} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {25A49E09-201E-4CAD-A12A-1A206415B284} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-09-04] (AVAST Software)
Task: {291D24A0-EE97-45B1-9C88-B72555753B64} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16] (Intel Corporation)
Task: {3AA7BE19-899E-4852-B1E1-9684F99055EE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {670F72D1-8614-4BF7-BF7D-361D1197FB08} - System32\Tasks\{881314CD-F38D-4868-99BD-7C09C3BF431A} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain
Task: {8F6C8211-5F22-4DD9-A112-82C076D89106} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16] (Intel Corporation)
Task: {9A82F651-C18B-4DA7-B47C-2152806BBC50} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe [2014-09-19] (CHIP)
Task: {ACB34A21-D855-4593-8218-C954FA0CFAAC} - System32\Tasks\{C884B3F5-EE9C-42EA-BDA3-409277F63FE6} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&amp;page=tsPlugin
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

==================== Loaded Modules (whitelisted) =============

2013-08-23 12:15 - 2013-06-21 12:23 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2013-07-08 09:23 - 2012-09-17 16:23 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-09-04 17:57 - 2014-09-04 17:57 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-09-22 19:08 - 2014-09-22 19:08 - 02865152 _____ () C:\Program Files\AVAST Software\Avast\defs\14092201\algo.dll
2014-09-23 12:53 - 2014-09-23 12:53 - 02865152 _____ () C:\Program Files\AVAST Software\Avast\defs\14092300\algo.dll
2014-09-04 17:29 - 2014-09-04 17:29 - 00593464 _____ () C:\Windows\WinSxS\x86_f-secure.qt_4_6_2_2e112a926211c0a3_4.6.482.65_none_b59e1e0911fd55ab\QtMultimediaKit1.dll
2014-09-04 17:57 - 2014-09-04 17:57 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-07-12 12:13 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-09-19 09:42 - 2014-09-19 09:42 - 03734640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Nick\Downloads\FW Teil 16.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/23/2014 02:01:30 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/23/2014 00:54:34 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/23/2014 00:54:20 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/23/2014 07:49:44 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/23/2014 07:49:44 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/23/2014 07:49:44 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/23/2014 07:49:44 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (09/23/2014 07:49:41 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/23/2014 07:49:41 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (09/23/2014 07:49:41 AM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (09/23/2014 07:49:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (09/23/2014 07:49:44 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.


Microsoft Office Sessions:
=========================
Error: (09/23/2014 02:01:30 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (09/23/2014 00:54:34 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Nick\Downloads\esetsmartinstaller_deu.exe

Error: (09/23/2014 00:54:20 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Nick\Downloads\esetsmartinstaller_deu.exe

Error: (09/23/2014 07:49:44 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/23/2014 07:49:44 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/23/2014 07:49:44 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/23/2014 07:49:44 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (09/23/2014 07:49:41 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (09/23/2014 07:49:41 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (09/23/2014 07:49:41 AM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt


==================== Memory info =========================== 

Processor: Intel(R) Celeron(R) CPU G550 @ 2.60GHz
Percentage of memory in use: 46%
Total physical RAM: 3774.2 MB
Available physical RAM: 2026.49 MB
Total Pagefile: 7546.59 MB
Available Pagefile: 5558.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.88 GB) (Free:146.71 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 6AF95C48)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Alles ok?

Kann also den PC normal nutzen wieder?

schrauber · 24.09.2014, 12:45

Frische FRST.txt fehlt noch, du hast ne Addition.txt gepostet

24.09.2014, 12:45	#8
schrauber /// the machine /// TB-Ausbilder	Eventuell BKA, GVU Trojaner etc. -> 100€ Zahlen per Paysafe - Erste Schritte unternommen Hilfe für logs? Frische FRST.txt fehlt noch, du hast ne Addition.txt gepostet __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Eventuell BKA, GVU Trojaner etc. -> 100€ Zahlen per Paysafe - Erste Schritte unternommen Hilfe für logs?

Plagegeister aller Art und deren Bekämpfung: Eventuell BKA, GVU Trojaner etc. -> 100€ Zahlen per Paysafe - Erste Schritte unternommen Hilfe für logs?