Foto Cd wird nicht erkannt/gelesen/Tr.Dropper.Gen

andrey86 · 07.12.2014, 21:36

Hallo leute,

mir wurde vor einem Jahr hier sehr gut geholfen, deshalb wende ich mich noch einmal an euch.
Mein Kumpel hat eine Foto CD, diese wird bei ihm nicht gelesen/nicht erkannt. Sobald die Cd eingelesen wird kommt eine Trojaner Meldung von Antivir **TR/Dropper.gen**. Die Cd wird bei mir aber ganz normal erkannt und es werden auch keine Viren/Trojaner Meldungen angezeigt.

Bitte um eure Hilfe

danke

Machiavelli · 08.12.2014, 06:59

Wahrscheinlich Fehlalarm.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

andrey86 · 08.12.2014, 09:55

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-08 09:48:42
Running from C:\Users\Andrücha\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.115.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
Avira (HKLM\...\{9480d4af-12b9-4e56-8034-4031ef6ab39d}) (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C1500}) (Version: 12.21.0.3975 - APN, LLC)
Avira System Speedup (HKLM\...\AviraSpeedup) (Version: 1.3.1.9970 - Avira System Speedup)
Canon Utilities Digital Photo Professional 3.10 (HKLM\...\DPP) (Version: 3.10.2.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM\...\EOS Utility) (Version: 2.10.2.0 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM\...\Picture Style Editor) (Version: 1.9.0.0 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.)
CleanUp! (HKLM\...\CleanUp!) (Version:  - )
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
ESU for Microsoft Vista (HKLM\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
ffdshow v1.2.4422 [2012-04-09] (HKLM\...\ffdshow_is1) (Version: 1.2.4422.0 - FreeCodecPack)
Free Mp3 Wma Converter V 2.2 (HKLM\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)
Guard.Mail.ru (HKLM\...\Guard.Mail.ru) (Version:  - Mail.ru) <==== ATTENTION
Hewlett-Packard Active Check for Health Check (Version: 1.1.15.2 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.63.2 - HP) Hidden
HP Customer Experience Enhancements (HKLM\...\{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.01.0005 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Help and Support (HKLM\...\{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}) (Version: 2.0.9.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.6204 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.6204 - HP)
HP Quick Launch Buttons 6.40 D1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.40 D1 - Hewlett-Packard)
HP QuickPlay 3.7 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - Hewlett-Packard)
HP QuickTouch 1.00 D2 (HKLM\...\{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}) (Version: 1.0.9 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{f32502b5-5b64-4882-bf61-77f23edcac4f}) (Version: 2.1.3359.2635 - Hewlett-Packard)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP User Guides 0103 (HKLM\...\{B8169E45-8E23-430B-91D1-EC64540C8ED0}) (Version: 1.01.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{340F521E-3576-4E1A-B75C-EB0ACF751379}) (Version: 3.00 J1 - Hewlett-Packard)
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Html5 geolocation provider (HKLM\...\{12644DC5-2271-442B-816F-8CFFD3DDDF32}) (Version: 3.5.4.872 - AlterGeo)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6017.13 - IDT)
Java(TM) 6 Update 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160060}) (Version: 1.6.0.60 - Sun Microsystems, Inc.)
JMicron JMB38X Flash Media Controller (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.16.01 - JMicron Technology Corp.)
LightScribe System Software  1.12.33.2 (HKLM\...\{582287DA-0806-4AC0-BF19-C15E3A466034}) (Version: 1.12.33.2 - LightScribe)
Mail.Ru Агент 5.10 (сборка 5308, для всех пользователей) (HKLM\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Агент 6.0 (сборка 5831, для текущего пользователя) (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Спутник 2.4.1.44 (HKLM\...\MailRuSputnik) (Version:  - Mail.Ru) <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: 1.0.0.43 - WildTangent)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
Opera 12.13 (HKLM\...\Opera 12.13.1734) (Version: 12.13.1734 - Opera Software ASA)
Power MP3 WMA Converter 2006, (ver 3.42) (HKLM\...\Power MP3 WMA Converter_is1) (Version: 3.42 - CooolSoft, Inc.)
ProtectSmart Hard Drive Protection (HKLM\...\{CB71A20E-B1B4-4562-81FA-33E1DBD0342F}) (Version: 3.10 A7 - Hewlett-Packard)
QuickPlay SlingPlayer 0.4.6 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.6 - SlingMedia)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.0 (HKLM\...\{EA17F4FC-FDBF-4CF8-A529-2D983132D053}) (Version: 6.0.126 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.2.4.0 - Synaptics)
TomTom HOME 2.8.2.2264 (HKLM\...\TomTom HOME) (Version: 2.8.2.2264 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for Html5 geolocation provider (HKLM\...\{45BECC2D-582C-472D-A754-E2AD10706397}) (Version: 3.5.2.858 - AlterGeo)
Update for Html5 geolocation provider (HKLM\...\{D492942E-9368-48D9-BB8B-68E8E4CE2D43}) (Version: 3.7.6.911 - AlterGeo)
Update for Office 2007 (KB934528) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{2B939677-2FFD-48F6-9075-7BF48CB87C80}) (Version:  - )
VKontakte (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\VKontakte) (Version:  - Andrew Rogozov)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

==================== Restore Points  =========================

15-10-2013 18:08:19 Windows Update
19-10-2013 15:03:39 Windows Update
22-10-2013 17:31:53 Windows Update
29-10-2013 18:55:33 Windows Update
31-10-2013 19:08:07 Installed Adobe Reader XI.
31-10-2013 19:12:48 Installed Adobe Reader XI.
01-11-2013 18:44:05 Windows Update
05-11-2013 20:28:15 Installed Adobe Reader XI.
16-11-2013 17:06:56 Windows Update
15-12-2013 20:52:29 Windows Update
26-01-2014 14:03:00 Windows Update
09-02-2014 18:20:47 PC Performer So, Feb 09, 14  19:20
14-02-2014 13:54:13 Windows Update
17-03-2014 19:06:00 Installed Adobe Reader XI.
23-03-2014 12:39:27 Windows Update
11-04-2014 12:37:07 Windows Update
14-05-2014 19:19:36 Windows Update
14-06-2014 22:46:50 Windows Update
10-07-2014 18:02:30 Windows Update
16-08-2014 16:00:04 Windows Update
31-08-2014 10:05:45 Removed Facebook Video Calling 3.1.0.521
10-09-2014 15:56:36 Windows Update
17-11-2014 19:16:22 Windows Update
19-11-2014 13:54:53 Windows Update
07-12-2014 20:25:39 Avira System Speedup(1.3.1.9970)
07-12-2014 20:28:50 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1F286ADE-039E-474D-8EF2-83C14C3CFA0F} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-04-15] (Hewlett-Packard)
Task: {324F6E3C-D83B-431F-BD8A-D240B2CAB216} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {65349617-D6AF-4DA0-B523-2EFCC6B3BB54} - System32\Tasks\AviraSpeedup => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [2014-12-07] (Avira)
Task: {C163C141-F757-4156-8BE3-AEF8AEE4217C} - System32\Tasks\{6F3DAAC4-5DFC-4603-933B-572D9826C258} => Chrome.exe hxxp://ui.skype.com/ui/0/5.10.0.116/ru/abandoninstall?page=tsProgressBar
Task: {E5724EA0-F9B1-44B9-8EE9-8C85044BF062} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {FAD4286E-AA44-4B22-93DC-0231985E42AE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForAndrьcha.job => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{5FD033D5-882A-4E63-8500-180E11B1449B}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2008-07-31 22:31 - 2008-06-25 21:36 - 00292216 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2008-07-31 22:31 - 2008-06-25 21:36 - 00259480 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00116080 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2008-07-31 23:35 - 2008-04-26 00:15 - 00361808 _____ () C:\Windows\SMINST\BLService.exe
2008-07-31 23:35 - 2007-11-15 00:46 - 00126976 _____ () C:\Windows\SMINST\STWmiM.dll
2008-07-31 22:30 - 2008-06-25 21:34 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll
2014-03-06 16:38 - 2014-11-19 18:29 - 03649648 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk => C:\Windows\pss\BTTray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Andrücha^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AlterGeoUpdater => C:\Program Files\AlterGeo\Html5 geolocation provider\html5locsvc.exe
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpWirelessAssistant => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
MSCONFIG\startupreg: iLivid => "C:\Users\Andrücha\AppData\Local\iLivid\iLivid.exe" -autorun
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: MAgent => C:\Program Files\Mail.Ru\Agent\magent.exe -LM
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: OnScreenDisplay => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QPService => "C:\Program Files\HP\QuickPlay\QPService.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => %ProgramFiles%\IDT\WDM\sttray.exe
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMERunner.exe"
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide

========================= Accounts: ==========================

Administrator (S-1-5-21-2119122295-1896836890-182237168-500 - Administrator - Disabled)
Andrücha (S-1-5-21-2119122295-1896836890-182237168-1000 - Administrator - Enabled) => C:\Users\Andrücha
Gast (S-1-5-21-2119122295-1896836890-182237168-501 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/08/2014 09:34:24 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/07/2014 09:44:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung QPSched.exe, Version 5.0.0.2922, Zeitstempel 0x48353a4d, fehlerhaftes Modul QPSched.exe, Version 5.0.0.2922, Zeitstempel 0x48353a4d, Ausnahmecode 0xc0000005, Fehleroffset 0x00007684,
Prozess-ID 0x99c, Anwendungsstartzeit QPSched.exe0.

Error: (12/07/2014 09:25:36 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {fbc0f7ef-1c54-4969-a574-0aaf5b9a658f}


System errors:
=============
Error: (12/08/2014 09:34:42 AM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (12/08/2014 09:34:42 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.

Error: (12/08/2014 09:34:24 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/08/2014 09:34:14 AM) (Source: Microsoft-Windows-ResourcePublication) (EventID: 1002) (User: NT-AUTORITÄT)
Description: Provider\Microsoft.Base.Publication/Publication/Computer

Error: (12/08/2014 09:34:01 AM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (12/08/2014 06:49:57 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner Fehler ist im Speicher-Manager aufgetreten.

Error: (12/07/2014 09:44:50 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: QuickPlay Task Scheduler (QTS)1

Error: (12/07/2014 09:29:47 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80246007Windows Vista Service Pack 2 (KB948465){0BC0E502-52B6-492E-8856-14B84973C615}106


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-12-08 09:48:36.034
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:35.977
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:35.918
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:35.858
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:35.649
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:35.590
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:35.532
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:35.474
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:23.679
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 09:48:23.621
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Percentage of memory in use: 44%
Total physical RAM: 3068.03 MB
Available physical RAM: 1694.13 MB
Total Pagefile: 6339.11 MB
Available Pagefile: 4841.21 MB
Total Virtual: 2047.88 MB
Available Virtual: 1897.05 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:289.06 GB) (Free:202.81 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:298.09 GB) (Free:283.14 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:9.03 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 133E133E)
Partition 1: (Active) - (Size=289.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 9DC051CF)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by Andrücha (administrator) on ANDRÜCHA-PC on 08-12-2014 09:47:50
Running from C:\Users\Andrücha\Downloads
Loaded Profile: Andrücha (Available profiles: Andrücha)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(IDT, Inc.) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Hewlett-Packard Corporation) C:\WINDOWS\System32\hpservice.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
() C:\WINDOWS\SMINST\BLService.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira) C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TomTom) C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\WINDOWS\System32\wuauclt.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\WINDOWS\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [144784 2008-03-25] (Sun Microsystems, Inc.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-12-07] (Avira)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7227
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 - Спутник@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = 
SearchScopes: HKLM -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = 
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: MailRuBHO Class -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
BHO: AlterGeoBHO Class -> {9BFBA68E-E21B-458E-AE12-FE85E903D2C0} -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Toolbar: HKLM - ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\vkontakteru-audiosearch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: Avira Browser Safety - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: HTML5 location provider - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{B100D0FF-0001-8CE4-2790-AACE49B8AE35} [2014-03-25]
FF Extension: VKontakte.ru MP3 Музыка Качалка - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\ffvkontaktemusic@chupakabr.ru.xpi [2014-09-09]
FF Extension: Vkontakte Download - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\support@videoadd.ru.xpi [2014-09-09]
FF Extension: ВКонтакте.ру Downloader - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\vk@sergeykolosov.mp.xpi [2011-10-08]
FF Extension: Adblock Plus - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-03-06]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-10-08]
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Mail.Ru) - C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi [2014-11-17]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [jggbjbmnfmipgcanidamjfpechdeekoi] - No Path
CHR HKLM\...\Chrome\Extension: [nhgcieglcpdegkhamigiokdphfhhnlhh] - C:\Program Files\AlterGeo\Html5 geolocation provider\altergeo.crx [Not Found]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [993584 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-04-15] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-02-26] (Hewlett-Packard Company) [File not signed]
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [292216 2008-06-25] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [116080 2008-06-25] ()
R2 Recovery Service for Windows; C:\Windows\SMINST\BLService.exe [361808 2008-04-26] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe [221273 2008-06-27] (IDT, Inc.)
R2 TomTomHOMEService; C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-04-22] (TomTom)
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)
S2 Guard.Mail.ru; "C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-12-07] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-08 09:47 - 2014-12-08 09:48 - 00014445 _____ () C:\Users\Andrücha\Downloads\FRST.txt
2014-12-08 09:47 - 2014-12-08 09:47 - 01111040 _____ (Farbar) C:\Users\Andrücha\Downloads\FRST.exe
2014-12-08 09:47 - 2014-12-08 09:47 - 00000000 ____D () C:\FRST
2014-12-08 09:34 - 2014-12-08 09:34 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\AviraSpeedup
2014-12-07 21:27 - 2014-12-07 21:27 - 00000998 _____ () C:\Users\Andrücha\Desktop\Avira System Speedup.lnk
2014-12-07 21:27 - 2014-12-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-12-07 21:24 - 2014-12-07 21:24 - 00001813 _____ () C:\Users\Andrücha\Desktop\JRT.txt
2014-12-07 21:20 - 2014-12-07 21:20 - 00000000 ____D () C:\Windows\ERUNT
2014-12-07 20:57 - 2014-12-07 21:15 - 00000000 ____D () C:\AdwCleaner
2014-12-07 20:57 - 2014-12-07 20:57 - 00000055 _____ () C:\AdwCleanerDebug.txt
2014-12-07 20:35 - 2014-12-07 20:36 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-07 20:35 - 2014-12-07 20:35 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-07 20:31 - 2014-12-07 20:31 - 02153472 _____ () C:\Users\Andrücha\Downloads\AdwCleaner_4.104.exe
2014-12-07 20:31 - 2014-12-07 20:31 - 01707646 _____ (Thisisu) C:\Users\Andrücha\Downloads\JRT.exe
2014-12-07 20:29 - 2014-12-07 20:30 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Andrücha\Downloads\mbam-setup-2.0.4.1028.exe
2014-11-19 18:36 - 2014-11-19 18:36 - 02449408 _____ () C:\Users\Andrücha\Downloads\install_flashplayer15_69Rsk.exe
2014-11-19 18:33 - 2014-12-08 06:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-19 18:33 - 2014-11-26 15:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-19 18:33 - 2014-11-19 18:33 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Macromedia
2014-11-19 18:09 - 2014-11-23 17:57 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-11-19 18:09 - 2014-11-19 18:09 - 00001894 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-11-19 18:08 - 2014-11-19 18:08 - 00000000 ____D () C:\Program Files\Adobe
2014-11-19 18:06 - 2014-11-19 18:06 - 01055952 _____ (Adobe) C:\Users\Andrücha\Downloads\install_reader10_de_mssa_aaa_aih.exe
2014-11-19 15:05 - 2014-11-19 15:05 - 01055936 _____ (Adobe) C:\Users\Andrücha\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-08 09:46 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-08 09:46 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-08 09:40 - 2006-11-02 11:33 - 01445310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-08 09:38 - 2011-10-06 13:17 - 01319955 _____ () C:\Windows\WindowsUpdate.log
2014-12-08 09:34 - 2013-04-18 20:20 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-12-08 09:34 - 2013-04-18 20:07 - 00000439 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-08 09:34 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.dat
2014-12-08 09:34 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.001
2014-12-08 09:34 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-08 06:54 - 2008-07-31 21:52 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-08 06:54 - 2006-11-02 14:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-07 21:26 - 2013-11-03 19:12 - 00000000 ____D () C:\Program Files\Avira
2014-12-07 21:17 - 2008-01-21 03:47 - 00273006 _____ () C:\Windows\PFRO.log
2014-12-03 19:18 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\tracing
2014-11-30 19:09 - 2012-06-01 11:59 - 00000986 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job
2014-11-30 13:09 - 2012-06-01 11:59 - 00000964 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job
2014-11-26 15:53 - 2011-10-08 14:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-20 19:33 - 2006-11-02 13:52 - 00149443 _____ () C:\Windows\setupact.log
2014-11-20 19:15 - 2008-07-31 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-20 19:14 - 2013-03-24 14:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-19 18:33 - 2012-08-20 14:35 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Adobe
2014-11-19 18:29 - 2014-03-06 16:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-19 18:12 - 2011-10-06 13:58 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Adobe
2014-11-19 18:09 - 2008-07-31 23:19 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-19 15:00 - 2013-08-01 23:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-19 14:55 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-19 14:51 - 2012-01-08 18:40 - 00000000 ____D () C:\ProgramData\Guard.Mail.Ru

Some content of TEMP:
====================
C:\Users\Andrücha\AppData\Local\Temp\A861.exe
C:\Users\Andrücha\AppData\Local\Temp\amigo_setup.exe
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe
C:\Users\Andrücha\AppData\Local\Temp\Delta.exe
C:\Users\Andrücha\AppData\Local\Temp\ffdshow.exe
C:\Users\Andrücha\AppData\Local\Temp\GuardMailRu.exe
C:\Users\Andrücha\AppData\Local\Temp\HPQSi.exe
C:\Users\Andrücha\AppData\Local\Temp\installhelper.dll
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (1).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2)_1.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih_1.exe
C:\Users\Andrücha\AppData\Local\Temp\Internet_s.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv_cf5873ae.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u37-windows-i586-iftw_e22a15f2.exe
C:\Users\Andrücha\AppData\Local\Temp\MailRuUpdater.exe
C:\Users\Andrücha\AppData\Local\Temp\propsys.dll
C:\Users\Andrücha\AppData\Local\Temp\Quarantine.exe
C:\Users\Andrücha\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Andrücha\AppData\Local\Temp\sqlite3.dll
C:\Users\Andrücha\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Andrücha\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Andrücha\AppData\Local\Temp\WSSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-08 09:44

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Heute zeigt er mir noch TR.shipup.FC und TR/shipUp.J.1.....und die gesamte Festplatte E: scheint vom Virus befallen, kann diese nicht mehr öffnen

Machiavelli · 08.12.2014, 16:49

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4
Bitte starte

FRST erneut, setze den Haken auch bei Addition.txt und drücke auf Scan.

Bitte poste mir die Inhalte der Logs von Adwarecleaner, MBAM, JRT und FRST hier in den Thread.

andrey86 · 08.12.2014, 21:09

habe alle scans nun durchgeführt....irgendwas stimmt aber nicht, die scans gehen viel zu schnell und es werden aufeinmal keine Viren/Würmer mehr erkannt.
Hier mal die Logs

Code:

ATTFilter

# AdwCleaner v4.104 - Bericht erstellt am 08/12/2014 um 20:22:11
# Aktualisiert 05/12/2014 von Xplode
# Database : 2014-12-08.1 [Live]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 1 (32 bits)
# Benutzername : Andrücha - ANDRÜCHA-PC
# Gestartet von : c:\Users\Andrücha\downloads\adwcleaner_4.104.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v7.0.6001.18639


-\\ Mozilla Firefox v33.1.1 (x86 de)


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [26861 octets] - [07/12/2014 20:57:55]
AdwCleaner[R1].txt - [945 octets] - [08/12/2014 19:25:31]
AdwCleaner[R2].txt - [1004 octets] - [08/12/2014 19:28:44]
AdwCleaner[R3].txt - [1125 octets] - [08/12/2014 20:20:36]
AdwCleaner[S0].txt - [19435 octets] - [07/12/2014 21:03:11]
AdwCleaner[S1].txt - [1065 octets] - [08/12/2014 19:39:47]
AdwCleaner[S2].txt - [1047 octets] - [08/12/2014 20:22:11]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1107 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Andrcha on 08.12.2014 at 21:00:14,82
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Failed to delete: [Folder] "C:\Program Files\Mozilla Firefox\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.12.2014 at 21:02:03,50
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 08.12.2014
Suchlauf-Zeit: 20:33:54
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.12.08.08
Rootkit Datenbank: v2014.12.08.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows Vista Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: AndrÃ¼cha

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 330929
Verstrichene Zeit: 21 Min, 52 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-08 21:04:15
Running from C:\Users\Andrücha\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.115.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
Avira (HKLM\...\{9480d4af-12b9-4e56-8034-4031ef6ab39d}) (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C1500}) (Version: 12.21.0.3975 - APN, LLC)
Avira System Speedup (HKLM\...\AviraSpeedup) (Version: 1.3.1.9970 - Avira System Speedup)
Canon Utilities Digital Photo Professional 3.10 (HKLM\...\DPP) (Version: 3.10.2.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM\...\EOS Utility) (Version: 2.10.2.0 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM\...\Picture Style Editor) (Version: 1.9.0.0 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.)
CleanUp! (HKLM\...\CleanUp!) (Version:  - )
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
ESU for Microsoft Vista (HKLM\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
ffdshow v1.2.4422 [2012-04-09] (HKLM\...\ffdshow_is1) (Version: 1.2.4422.0 - FreeCodecPack)
Free Mp3 Wma Converter V 2.2 (HKLM\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)
Guard.Mail.ru (HKLM\...\Guard.Mail.ru) (Version:  - Mail.ru) <==== ATTENTION
Hewlett-Packard Active Check for Health Check (Version: 1.1.15.2 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.63.2 - HP) Hidden
HP Customer Experience Enhancements (HKLM\...\{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.01.0005 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Help and Support (HKLM\...\{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}) (Version: 2.0.9.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.6204 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.6204 - HP)
HP Quick Launch Buttons 6.40 D1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.40 D1 - Hewlett-Packard)
HP QuickPlay 3.7 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - Hewlett-Packard)
HP QuickTouch 1.00 D2 (HKLM\...\{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}) (Version: 1.0.9 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{f32502b5-5b64-4882-bf61-77f23edcac4f}) (Version: 2.1.3359.2635 - Hewlett-Packard)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP User Guides 0103 (HKLM\...\{B8169E45-8E23-430B-91D1-EC64540C8ED0}) (Version: 1.01.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{340F521E-3576-4E1A-B75C-EB0ACF751379}) (Version: 3.00 J1 - Hewlett-Packard)
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Html5 geolocation provider (HKLM\...\{12644DC5-2271-442B-816F-8CFFD3DDDF32}) (Version: 3.5.4.872 - AlterGeo)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6017.13 - IDT)
Java(TM) 6 Update 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160060}) (Version: 1.6.0.60 - Sun Microsystems, Inc.)
JMicron JMB38X Flash Media Controller (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.16.01 - JMicron Technology Corp.)
LightScribe System Software  1.12.33.2 (HKLM\...\{582287DA-0806-4AC0-BF19-C15E3A466034}) (Version: 1.12.33.2 - LightScribe)
Mail.Ru Агент 5.10 (сборка 5308, для всех пользователей) (HKLM\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Агент 6.0 (сборка 5831, для текущего пользователя) (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Агент 6.0 (сборка 5831, для текущего пользователя) (HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Спутник 2.4.1.44 (HKLM\...\MailRuSputnik) (Version:  - Mail.Ru) <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: 1.0.0.43 - WildTangent)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
Opera 12.13 (HKLM\...\Opera 12.13.1734) (Version: 12.13.1734 - Opera Software ASA)
Power MP3 WMA Converter 2006, (ver 3.42) (HKLM\...\Power MP3 WMA Converter_is1) (Version: 3.42 - CooolSoft, Inc.)
ProtectSmart Hard Drive Protection (HKLM\...\{CB71A20E-B1B4-4562-81FA-33E1DBD0342F}) (Version: 3.10 A7 - Hewlett-Packard)
QuickPlay SlingPlayer 0.4.6 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.6 - SlingMedia)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.0 (HKLM\...\{EA17F4FC-FDBF-4CF8-A529-2D983132D053}) (Version: 6.0.126 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.2.4.0 - Synaptics)
TomTom HOME 2.8.2.2264 (HKLM\...\TomTom HOME) (Version: 2.8.2.2264 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for Html5 geolocation provider (HKLM\...\{45BECC2D-582C-472D-A754-E2AD10706397}) (Version: 3.5.2.858 - AlterGeo)
Update for Html5 geolocation provider (HKLM\...\{D492942E-9368-48D9-BB8B-68E8E4CE2D43}) (Version: 3.7.6.911 - AlterGeo)
Update for Office 2007 (KB934528) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{2B939677-2FFD-48F6-9075-7BF48CB87C80}) (Version:  - )
VKontakte (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\VKontakte) (Version:  - Andrew Rogozov)
VKontakte (HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\VKontakte) (Version:  - Andrew Rogozov)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

==================== Restore Points  =========================

15-10-2013 18:08:19 Windows Update
19-10-2013 15:03:39 Windows Update
22-10-2013 17:31:53 Windows Update
29-10-2013 18:55:33 Windows Update
31-10-2013 19:08:07 Installed Adobe Reader XI.
31-10-2013 19:12:48 Installed Adobe Reader XI.
01-11-2013 18:44:05 Windows Update
05-11-2013 20:28:15 Installed Adobe Reader XI.
16-11-2013 17:06:56 Windows Update
15-12-2013 20:52:29 Windows Update
26-01-2014 14:03:00 Windows Update
09-02-2014 18:20:47 PC Performer So, Feb 09, 14  19:20
14-02-2014 13:54:13 Windows Update
17-03-2014 19:06:00 Installed Adobe Reader XI.
23-03-2014 12:39:27 Windows Update
11-04-2014 12:37:07 Windows Update
14-05-2014 19:19:36 Windows Update
14-06-2014 22:46:50 Windows Update
10-07-2014 18:02:30 Windows Update
16-08-2014 16:00:04 Windows Update
31-08-2014 10:05:45 Removed Facebook Video Calling 3.1.0.521
10-09-2014 15:56:36 Windows Update
17-11-2014 19:16:22 Windows Update
19-11-2014 13:54:53 Windows Update
07-12-2014 20:25:39 Avira System Speedup(1.3.1.9970)
07-12-2014 20:28:50 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1F286ADE-039E-474D-8EF2-83C14C3CFA0F} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-04-15] (Hewlett-Packard)
Task: {324F6E3C-D83B-431F-BD8A-D240B2CAB216} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {65349617-D6AF-4DA0-B523-2EFCC6B3BB54} - System32\Tasks\AviraSpeedup => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [2014-12-07] (Avira)
Task: {94D5023C-E049-4641-A98D-8BE6AB7B7173} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {C163C141-F757-4156-8BE3-AEF8AEE4217C} - System32\Tasks\{6F3DAAC4-5DFC-4603-933B-572D9826C258} => Chrome.exe hxxp://ui.skype.com/ui/0/5.10.0.116/ru/abandoninstall?page=tsProgressBar
Task: {E5724EA0-F9B1-44B9-8EE9-8C85044BF062} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {FAD4286E-AA44-4B22-93DC-0231985E42AE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForAndrьcha.job => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{5FD033D5-882A-4E63-8500-180E11B1449B}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2008-07-31 22:31 - 2008-06-25 21:36 - 00292216 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2008-07-31 22:31 - 2008-06-25 21:36 - 00259480 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00116080 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2008-07-31 23:35 - 2008-04-26 00:15 - 00361808 _____ () C:\Windows\SMINST\BLService.exe
2008-07-31 23:35 - 2007-11-15 00:46 - 00126976 _____ () C:\Windows\SMINST\STWmiM.dll
2008-07-31 22:30 - 2008-06-25 21:34 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll
2014-03-06 16:38 - 2014-11-19 18:29 - 03649648 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk => C:\Windows\pss\BTTray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Andrücha^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AlterGeoUpdater => C:\Program Files\AlterGeo\Html5 geolocation provider\html5locsvc.exe
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpWirelessAssistant => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
MSCONFIG\startupreg: iLivid => "C:\Users\Andrücha\AppData\Local\iLivid\iLivid.exe" -autorun
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: MAgent => C:\Program Files\Mail.Ru\Agent\magent.exe -LM
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: OnScreenDisplay => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QPService => "C:\Program Files\HP\QuickPlay\QPService.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => %ProgramFiles%\IDT\WDM\sttray.exe
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMERunner.exe"
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide

========================= Accounts: ==========================

Administrator (S-1-5-21-2119122295-1896836890-182237168-500 - Administrator - Disabled)
Andrücha (S-1-5-21-2119122295-1896836890-182237168-1000 - Administrator - Enabled) => C:\Users\Andrücha
Gast (S-1-5-21-2119122295-1896836890-182237168-501 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-12-08 21:04:10.217
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:04:10.139
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:04:10.061
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:04:09.999
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:04:09.812
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:04:09.718
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:04:09.671
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:04:09.578
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:03:55.943
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-08 21:03:55.881
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Percentage of memory in use: 45%
Total physical RAM: 3068.03 MB
Available physical RAM: 1677.68 MB
Total Pagefile: 6341.08 MB
Available Pagefile: 4650.35 MB
Total Virtual: 2047.88 MB
Available Virtual: 1912.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:289.06 GB) (Free:202.49 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:298.09 GB) (Free:283.14 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:9.03 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (2014-07-29_1202) (CDROM) (Total:0.67 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 133E133E)
Partition 1: (Active) - (Size=289.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 9DC051CF)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by Andrücha (administrator) on ANDRÜCHA-PC on 08-12-2014 21:03:29
Running from C:\Users\Andrücha\Downloads
Loaded Profiles: Andrücha &  (Available profiles: Andrücha)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(IDT, Inc.) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Hewlett-Packard Corporation) C:\WINDOWS\System32\hpservice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
() C:\WINDOWS\SMINST\BLService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(TomTom) C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\WINDOWS\System32\wuauclt.exe
(Microsoft Corporation) C:\WINDOWS\System32\conime.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [144784 2008-03-25] (Sun Microsystems, Inc.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-12-07] (Avira)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-12-07] (Avira)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-12-07] (Avira)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-12-07] (Avira)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7227
HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7227
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 - Спутник@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - Спутник@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = 
SearchScopes: HKLM -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = 
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: MailRuBHO Class -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
BHO: AlterGeoBHO Class -> {9BFBA68E-E21B-458E-AE12-FE85E903D2C0} -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Toolbar: HKLM - ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\vkontakteru-audiosearch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: Avira Browser Safety - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: HTML5 location provider - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{B100D0FF-0001-8CE4-2790-AACE49B8AE35} [2014-03-25]
FF Extension: VKontakte.ru MP3 Музыка Качалка - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\ffvkontaktemusic@chupakabr.ru.xpi [2014-09-09]
FF Extension: Vkontakte Download - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\support@videoadd.ru.xpi [2014-09-09]
FF Extension: ВКонтакте.ру Downloader - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\vk@sergeykolosov.mp.xpi [2011-10-08]
FF Extension: Adblock Plus - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-03-06]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-10-08]
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Mail.Ru) - C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi [2014-11-17]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [jggbjbmnfmipgcanidamjfpechdeekoi] - No Path
CHR HKLM\...\Chrome\Extension: [nhgcieglcpdegkhamigiokdphfhhnlhh] - C:\Program Files\AlterGeo\Html5 geolocation provider\altergeo.crx [Not Found]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [993584 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-04-15] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-02-26] (Hewlett-Packard Company) [File not signed]
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [292216 2008-06-25] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [116080 2008-06-25] ()
R2 Recovery Service for Windows; C:\Windows\SMINST\BLService.exe [361808 2008-04-26] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe [221273 2008-06-27] (IDT, Inc.)
R2 TomTomHOMEService; C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-04-22] (TomTom)
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)
S2 Guard.Mail.ru; "C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-08 21:02 - 2014-12-08 21:02 - 00000771 _____ () C:\Users\Andrücha\Desktop\JRT.txt
2014-12-08 20:59 - 2014-12-08 20:59 - 00001211 _____ () C:\Users\Andrücha\Desktop\mbam.txt
2014-12-08 10:11 - 2014-12-08 10:11 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-12-08 09:48 - 2014-12-08 09:50 - 00025540 _____ () C:\Users\Andrücha\Downloads\Addition.txt
2014-12-08 09:47 - 2014-12-08 21:04 - 00018092 _____ () C:\Users\Andrücha\Downloads\FRST.txt
2014-12-08 09:47 - 2014-12-08 21:03 - 00000000 ____D () C:\FRST
2014-12-08 09:47 - 2014-12-08 09:47 - 01111040 _____ (Farbar) C:\Users\Andrücha\Downloads\FRST.exe
2014-12-08 09:34 - 2014-12-08 09:34 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\AviraSpeedup
2014-12-07 21:27 - 2014-12-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-12-07 21:20 - 2014-12-07 21:20 - 00000000 ____D () C:\Windows\ERUNT
2014-12-07 20:57 - 2014-12-08 20:22 - 00000000 ____D () C:\AdwCleaner
2014-12-07 20:57 - 2014-12-08 20:20 - 00000220 _____ () C:\AdwCleanerDebug.txt
2014-12-07 20:35 - 2014-12-08 20:56 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-07 20:35 - 2014-12-07 20:35 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-07 20:31 - 2014-12-07 20:31 - 02153472 _____ () C:\Users\Andrücha\Downloads\AdwCleaner_4.104.exe
2014-12-07 20:31 - 2014-12-07 20:31 - 01707646 _____ (Thisisu) C:\Users\Andrücha\Downloads\JRT.exe
2014-12-07 20:29 - 2014-12-07 20:30 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Andrücha\Downloads\mbam-setup-2.0.4.1028.exe
2014-11-19 18:33 - 2014-12-08 20:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-19 18:33 - 2014-11-26 15:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-19 18:33 - 2014-11-19 18:33 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Macromedia
2014-11-19 18:09 - 2014-11-23 17:57 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-11-19 18:09 - 2014-11-19 18:09 - 00001894 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-11-19 18:08 - 2014-11-19 18:08 - 00000000 ____D () C:\Program Files\Adobe
2014-11-19 18:06 - 2014-11-19 18:06 - 01055952 _____ (Adobe) C:\Users\Andrücha\Downloads\install_reader10_de_mssa_aaa_aih.exe
2014-11-19 15:05 - 2014-11-19 15:05 - 01055936 _____ (Adobe) C:\Users\Andrücha\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-08 20:43 - 2011-10-06 13:17 - 01353133 _____ () C:\Windows\WindowsUpdate.log
2014-12-08 20:38 - 2013-04-18 20:07 - 00000439 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-08 20:30 - 2006-11-02 11:33 - 01445310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-08 20:24 - 2013-04-18 20:20 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-12-08 20:24 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.dat
2014-12-08 20:24 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.001
2014-12-08 20:24 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-08 20:24 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-08 20:24 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-08 20:23 - 2008-01-21 03:47 - 00273630 _____ () C:\Windows\PFRO.log
2014-12-08 20:22 - 2008-07-31 21:52 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-08 20:22 - 2006-11-02 14:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-08 10:11 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-08 10:09 - 2012-06-01 11:59 - 00000986 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job
2014-12-07 21:26 - 2013-11-03 19:12 - 00000000 ____D () C:\Program Files\Avira
2014-12-03 19:18 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\tracing
2014-11-30 13:09 - 2012-06-01 11:59 - 00000964 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job
2014-11-26 15:53 - 2011-10-08 14:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-20 19:33 - 2006-11-02 13:52 - 00149443 _____ () C:\Windows\setupact.log
2014-11-20 19:15 - 2008-07-31 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-20 19:14 - 2013-03-24 14:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-19 18:33 - 2012-08-20 14:35 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Adobe
2014-11-19 18:29 - 2014-03-06 16:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-19 18:12 - 2011-10-06 13:58 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Adobe
2014-11-19 18:09 - 2008-07-31 23:19 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-19 15:00 - 2013-08-01 23:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-19 14:55 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-19 14:51 - 2012-01-08 18:40 - 00000000 ____D () C:\ProgramData\Guard.Mail.Ru

Some content of TEMP:
====================
C:\Users\Andrücha\AppData\Local\Temp\A861.exe
C:\Users\Andrücha\AppData\Local\Temp\amigo_setup.exe
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe
C:\Users\Andrücha\AppData\Local\Temp\Delta.exe
C:\Users\Andrücha\AppData\Local\Temp\ffdshow.exe
C:\Users\Andrücha\AppData\Local\Temp\GuardMailRu.exe
C:\Users\Andrücha\AppData\Local\Temp\HPQSi.exe
C:\Users\Andrücha\AppData\Local\Temp\installhelper.dll
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (1).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2)_1.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih_1.exe
C:\Users\Andrücha\AppData\Local\Temp\Internet_s.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv_cf5873ae.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u37-windows-i586-iftw_e22a15f2.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-7u71-windows-i586-iftw_717d7de5.exe
C:\Users\Andrücha\AppData\Local\Temp\MailRuUpdater.exe
C:\Users\Andrücha\AppData\Local\Temp\propsys.dll
C:\Users\Andrücha\AppData\Local\Temp\Quarantine.exe
C:\Users\Andrücha\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Andrücha\AppData\Local\Temp\sqlite3.dll
C:\Users\Andrücha\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Andrücha\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Andrücha\AppData\Local\Temp\WSSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-08 20:32

==================== End Of Log ============================

--- --- ---

Hier mal ein Log von AVIRA (vlt hilft das)

Code:

ATTFilter

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 8. Dezember 2014  10:07


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira Antivirus Free
Seriennummer   : 0000149996-AVHOE-0000001
Plattform      : Windows Vista (TM) Home Premium
Windowsversion : (Service Pack 1)  [6.0.6001]
Boot Modus     : Normal gebootet
Benutzername   : SYSTEM
Computername   : ANDRÜCHA-PC

Versionsinformationen:
BUILD.DAT      : 14.0.7.342     92013 Bytes  23.10.2014 14:02:00
AVSCAN.EXE     : 14.0.7.312   1015544 Bytes  19.11.2014 13:57:03
AVSCANRC.DLL   : 14.0.7.308     64304 Bytes  19.11.2014 13:57:03
LUKE.DLL       : 14.0.7.310     60664 Bytes  19.11.2014 13:57:11
AVSCPLR.DLL    : 14.0.7.310     93488 Bytes  19.11.2014 13:57:03
REPAIR.DLL     : 14.0.7.312    366328 Bytes  19.11.2014 13:57:02
REPAIR.RDF     : 1.0.2.30      596694 Bytes  07.11.2014 18:52:02
AVREG.DLL      : 14.0.7.310    264952 Bytes  19.11.2014 13:57:02
AVLODE.DLL     : 14.0.7.312    563448 Bytes  19.11.2014 13:57:01
AVLODE.RDF     : 14.0.4.54      78895 Bytes  07.12.2014 19:23:42
XBV00013.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00014.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00015.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00016.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00017.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00018.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00019.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00020.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00021.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00022.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00023.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00024.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00025.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00026.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00027.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00028.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00029.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00030.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00031.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00032.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00033.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00034.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00035.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00036.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00037.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00038.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00039.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00040.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:52
XBV00041.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 18:48:53
XBV00068.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00069.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00070.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00071.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00072.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00073.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00074.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00075.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00076.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00077.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00078.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00079.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00080.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00081.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00082.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00083.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00084.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00085.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00086.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00087.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00088.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00089.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00090.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00091.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00092.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00093.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00094.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00095.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00096.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00097.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:28
XBV00098.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00099.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00100.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00101.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00102.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00103.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00104.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00105.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00106.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00107.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00108.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00109.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00110.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00111.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00112.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00113.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00114.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00115.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00116.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00117.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00118.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00119.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00120.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00121.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00122.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00123.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00124.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00125.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00126.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00127.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00128.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00129.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00130.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00131.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00132.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00133.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00134.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00135.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00136.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00137.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00138.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00139.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:29
XBV00140.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00141.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00142.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00143.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00144.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00145.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00146.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00147.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00148.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00149.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00150.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00151.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00152.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00153.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00154.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00155.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00156.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00157.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00158.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00159.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00160.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00161.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00162.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00163.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00164.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00165.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00166.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00167.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00168.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00169.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00170.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00171.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00172.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00173.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00174.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00175.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00176.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00177.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00178.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00179.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00180.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:30
XBV00181.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00182.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00183.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00184.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00185.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00186.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00187.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00188.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00189.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00190.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00191.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00192.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00193.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00194.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00195.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00196.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00197.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00198.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00199.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00200.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00201.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00202.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00203.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00204.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00205.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00206.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00207.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00208.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00209.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00210.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00211.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00212.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00213.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00214.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00215.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00216.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00217.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00218.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00219.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00220.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00221.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:31
XBV00222.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00223.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00224.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00225.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00226.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00227.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00228.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00229.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00230.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00231.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00232.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00233.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00234.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00235.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00236.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00237.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00238.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00239.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00240.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00241.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00242.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00243.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00244.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00245.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00246.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00247.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00248.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00249.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00250.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00251.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00252.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00253.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00254.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00255.VDF   : 8.11.190.32     2048 Bytes  03.12.2014 18:23:32
XBV00000.VDF   : 7.11.70.0   66736640 Bytes  04.04.2013 18:14:08
XBV00001.VDF   : 7.11.74.226  2201600 Bytes  30.04.2013 18:14:08
XBV00002.VDF   : 7.11.80.60   2751488 Bytes  28.05.2013 18:14:08
XBV00003.VDF   : 7.11.85.214  2162688 Bytes  21.06.2013 18:14:08
XBV00004.VDF   : 7.11.91.176  3903488 Bytes  23.07.2013 18:14:08
XBV00005.VDF   : 7.11.98.186  6822912 Bytes  29.08.2013 18:14:08
XBV00006.VDF   : 7.11.139.38 15708672 Bytes  27.03.2014 17:20:38
XBV00007.VDF   : 7.11.152.100  4193792 Bytes  02.06.2014 14:52:35
XBV00008.VDF   : 8.11.165.192  4251136 Bytes  07.08.2014 18:48:51
XBV00009.VDF   : 8.11.172.30  2094080 Bytes  15.09.2014 16:56:23
XBV00010.VDF   : 8.11.178.32  1581056 Bytes  14.10.2014 18:51:48
XBV00011.VDF   : 8.11.184.50  2178560 Bytes  11.11.2014 19:20:10
XBV00012.VDF   : 8.11.190.32  1876992 Bytes  03.12.2014 18:23:27
XBV00042.VDF   : 8.11.190.56    35840 Bytes  03.12.2014 18:23:27
XBV00043.VDF   : 8.11.192.58     2048 Bytes  03.12.2014 18:23:27
XBV00044.VDF   : 8.11.192.86    18944 Bytes  03.12.2014 19:23:43
XBV00045.VDF   : 8.11.192.110     7680 Bytes  03.12.2014 19:23:43
XBV00046.VDF   : 8.11.192.134     5120 Bytes  03.12.2014 19:23:43
XBV00047.VDF   : 8.11.192.138     9216 Bytes  03.12.2014 19:23:43
XBV00048.VDF   : 8.11.192.140     4608 Bytes  04.12.2014 19:23:43
XBV00049.VDF   : 8.11.192.144     8192 Bytes  04.12.2014 19:23:43
XBV00050.VDF   : 8.11.192.146    20480 Bytes  04.12.2014 19:23:43
XBV00051.VDF   : 8.11.192.148    19456 Bytes  04.12.2014 19:23:43
XBV00052.VDF   : 8.11.192.152    12800 Bytes  04.12.2014 19:23:43
XBV00053.VDF   : 8.11.192.154     5120 Bytes  04.12.2014 19:23:43
XBV00054.VDF   : 8.11.192.158     2048 Bytes  04.12.2014 19:23:43
XBV00055.VDF   : 8.11.192.160     2048 Bytes  04.12.2014 19:23:43
XBV00056.VDF   : 8.11.192.162     2048 Bytes  04.12.2014 19:23:43
XBV00057.VDF   : 8.11.192.166     8192 Bytes  04.12.2014 19:23:43
XBV00058.VDF   : 8.11.192.168     6144 Bytes  05.12.2014 19:23:43
XBV00059.VDF   : 8.11.192.172     6144 Bytes  05.12.2014 19:23:43
XBV00060.VDF   : 8.11.192.236    24064 Bytes  05.12.2014 19:23:44
XBV00061.VDF   : 8.11.192.238     2048 Bytes  05.12.2014 19:23:44
XBV00062.VDF   : 8.11.193.22    11776 Bytes  05.12.2014 19:23:44
XBV00063.VDF   : 8.11.193.42    29696 Bytes  06.12.2014 19:23:44
XBV00064.VDF   : 8.11.193.66    41472 Bytes  06.12.2014 19:23:44
XBV00065.VDF   : 8.11.193.68     2048 Bytes  06.12.2014 19:23:44
XBV00066.VDF   : 8.11.193.70    37888 Bytes  07.12.2014 19:23:44
XBV00067.VDF   : 8.11.193.76    13824 Bytes  07.12.2014 19:23:44
LOCAL001.VDF   : 8.11.193.76 115884032 Bytes  07.12.2014 19:24:34
Engineversion  : 8.3.26.32 
AEVDF.DLL      : 8.3.1.6       133992 Bytes  21.08.2014 16:32:16
AESCRIPT.DLL   : 8.2.2.36      542632 Bytes  07.12.2014 19:23:42
AESCN.DLL      : 8.3.2.2       139456 Bytes  26.07.2014 18:29:33
AESBX.DLL      : 8.2.20.24    1409224 Bytes  08.05.2014 17:59:38
AERDL.DLL      : 8.2.1.16      743328 Bytes  07.11.2014 18:51:30
AEPACK.DLL     : 8.4.0.56      789360 Bytes  28.11.2014 18:24:16
AEOFFICE.DLL   : 8.3.1.8       350120 Bytes  28.11.2014 18:24:16
AEHEUR.DLL     : 8.1.4.1430   7853992 Bytes  07.12.2014 19:23:42
AEHELP.DLL     : 8.3.1.0       278728 Bytes  09.06.2014 14:52:19
AEGEN.DLL      : 8.1.7.36      457576 Bytes  28.11.2014 18:24:15
AEEXP.DLL      : 8.4.2.48      252776 Bytes  25.11.2014 19:22:17
AEEMU.DLL      : 8.1.3.4       399264 Bytes  10.08.2014 18:48:43
AEDROID.DLL    : 8.4.2.248     812968 Bytes  17.11.2014 19:20:09
AECORE.DLL     : 8.3.3.0       244592 Bytes  25.11.2014 19:22:16
AEBB.DLL       : 8.1.2.0        60448 Bytes  10.08.2014 18:48:43
AVWINLL.DLL    : 14.0.7.308     25904 Bytes  19.11.2014 13:57:00
AVPREF.DLL     : 14.0.7.308     52016 Bytes  19.11.2014 13:57:02
AVREP.DLL      : 14.0.7.308    220976 Bytes  19.11.2014 13:57:02
AVARKT.DLL     : 14.0.7.308    227632 Bytes  19.11.2014 13:57:00
AVEVTLOG.DLL   : 14.0.7.310    184112 Bytes  19.11.2014 13:57:01
SQLITE3.DLL    : 14.0.7.308    453936 Bytes  19.11.2014 13:57:12
AVSMTP.DLL     : 14.0.7.308     79096 Bytes  19.11.2014 13:57:03
NETNT.DLL      : 14.0.7.308     15152 Bytes  19.11.2014 13:57:12
RCIMAGE.DLL    : 14.0.7.308   4865328 Bytes  19.11.2014 13:57:00
RCTEXT.DLL     : 14.0.7.318     77048 Bytes  19.11.2014 13:57:00

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_5485629f\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: Reparieren
Sekundäre Aktion......................: Quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: Vollständig

Beginn des Suchlaufs: Montag, 8. Dezember 2014  10:07

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'conime.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'jucheck.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'wuauclt.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'hphc_service.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'WPFFontCache_v0400.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'alg.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.ServiceHost.exe' - '148' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '7' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'TomTomHOMEService.exe' - '8' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '126' Modul(e) wurden durchsucht
Durchsuche Prozess 'c2c_service.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'avira_system_speedup.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'BLService.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'QPSched.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'QPCapSvc.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'LSSrvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '128' Modul(e) wurden durchsucht
Durchsuche Prozess 'aestsrv.exe' - '5' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '154' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'Hpservice.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'STacSV.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '157' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'E:\$RECYCLE.BIN.exe'
E:\$RECYCLE.BIN.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '51e1fff0.qua' verschoben!
Beginne mit der Suche in 'E:\HP.exe'
E:\HP.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '490fd055.qua' verschoben!
Beginne mit der Suche in 'E:\PRELOAD.exe'
E:\PRELOAD.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1b298abf.qua' verschoben!
Beginne mit der Suche in 'E:\RECOVERY.exe'
E:\RECOVERY.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7d1cc560.qua' verschoben!
Beginne mit der Suche in 'E:\SOURCES.exe'
E:\SOURCES.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '388ae840.qua' verschoben!
Beginne mit der Suche in 'E:\System Volume Information.exe'
E:\System Volume Information.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '47b3da0b.qua' verschoben!
Beginne mit der Suche in 'E:\Tools.exe'
E:\Tools.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0b07f64b.qua' verschoben!
Beginne mit der Suche in 'E:\WINDOWS.exe'
E:\WINDOWS.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7738b621.qua' verschoben!
Beginne mit der Suche in 'E:\boot.exe'
E:\boot.exe
  [FUND]      Ist das Trojanische Pferd TR/ShipUp.J.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5a459956.qua' verschoben!


Ende des Suchlaufs: Montag, 8. Dezember 2014  10:07
Benötigte Zeit: 00:09 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

      0 Verzeichnisse wurden überprüft
    700 Dateien wurden geprüft
      9 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      9 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
    691 Dateien ohne Befall
      1 Archive wurden durchsucht
      0 Warnungen
      9 Hinweise

Machiavelli · 08.12.2014, 22:45

Schritt 1: FRST Fix

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM\...\Run: [] => [X]
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 - Спутник@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = 
SearchScopes: HKLM -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = 
BHO: MailRuBHO Class -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
BHO: AlterGeoBHO Class -> {9BFBA68E-E21B-458E-AE12-FE85E903D2C0} -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
Toolbar: HKLM - ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [jggbjbmnfmipgcanidamjfpechdeekoi] - No Path
CHR HKLM\...\Chrome\Extension: [nhgcieglcpdegkhamigiokdphfhhnlhh] - C:\Program Files\AlterGeo\Html5 geolocation provider\altergeo.crx [Not Found]
C:\Users\Andrücha\AppData\Local\Temp\A861.exe
C:\Users\Andrücha\AppData\Local\Temp\amigo_setup.exe
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe
C:\Users\Andrücha\AppData\Local\Temp\Delta.exe
C:\Users\Andrücha\AppData\Local\Temp\ffdshow.exe
C:\Users\Andrücha\AppData\Local\Temp\GuardMailRu.exe
C:\Users\Andrücha\AppData\Local\Temp\HPQSi.exe
C:\Users\Andrücha\AppData\Local\Temp\installhelper.dll
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (1).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2)_1.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih_1.exe
C:\Users\Andrücha\AppData\Local\Temp\Internet_s.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv_cf5873ae.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u37-windows-i586-iftw_e22a15f2.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-7u71-windows-i586-iftw_717d7de5.exe
C:\Users\Andrücha\AppData\Local\Temp\MailRuUpdater.exe
C:\Users\Andrücha\AppData\Local\Temp\propsys.dll
C:\Users\Andrücha\AppData\Local\Temp\Quarantine.exe
C:\Users\Andrücha\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Andrücha\AppData\Local\Temp\sqlite3.dll
C:\Users\Andrücha\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Andrücha\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Andrücha\AppData\Local\Temp\WSSetup.exe
EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2: FRST Scan

Bitte starte FRST erneut, setze den Haken auch bei Addition.txt und drücke auf Scan.

Schritt 3: ESET

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4: Frage

Wie läuft Dein PC?

andrey86 · 09.12.2014, 10:14

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-09 08:30:50 Run:1
Running from C:\Users\Andrücha\Downloads
Loaded Profile: Andrücha (Available profiles: Andrücha)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM\...\Run: [] => [X]
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 - ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = 
SearchScopes: HKLM -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = 
BHO: MailRuBHO Class -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
BHO: AlterGeoBHO Class -> {9BFBA68E-E21B-458E-AE12-FE85E903D2C0} -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
Toolbar: HKLM - ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [jggbjbmnfmipgcanidamjfpechdeekoi] - No Path
CHR HKLM\...\Chrome\Extension: [nhgcieglcpdegkhamigiokdphfhhnlhh] - C:\Program Files\AlterGeo\Html5 geolocation provider\altergeo.crx [Not Found]
C:\Users\Andrücha\AppData\Local\Temp\A861.exe
C:\Users\Andrücha\AppData\Local\Temp\amigo_setup.exe
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe
C:\Users\Andrücha\AppData\Local\Temp\Delta.exe
C:\Users\Andrücha\AppData\Local\Temp\ffdshow.exe
C:\Users\Andrücha\AppData\Local\Temp\GuardMailRu.exe
C:\Users\Andrücha\AppData\Local\Temp\HPQSi.exe
C:\Users\Andrücha\AppData\Local\Temp\installhelper.dll
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (1).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2)_1.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih_1.exe
C:\Users\Andrücha\AppData\Local\Temp\Internet_s.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv_cf5873ae.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u37-windows-i586-iftw_e22a15f2.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-7u71-windows-i586-iftw_717d7de5.exe
C:\Users\Andrücha\AppData\Local\Temp\MailRuUpdater.exe
C:\Users\Andrücha\AppData\Local\Temp\propsys.dll
C:\Users\Andrücha\AppData\Local\Temp\Quarantine.exe
C:\Users\Andrücha\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Andrücha\AppData\Local\Temp\sqlite3.dll
C:\Users\Andrücha\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Andrücha\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Andrücha\AppData\Local\Temp\WSSetup.exe
EmptyTemp:
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
Error setting Default URLSearchHook.
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{09900DE8-1DCA-443F-9243-26FF581438AF} => value deleted successfully.
"HKCR\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}" => Key deleted successfully.
Error setting Default URLSearchHook.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}" => Key deleted successfully.
"HKCR\CLSID\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8984B388-A5BB-4DF7-B274-77B879E179DB}" => Key deleted successfully.
"HKCR\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9BFBA68E-E21B-458E-AE12-FE85E903D2C0}" => Key deleted successfully.
"HKCR\CLSID\{9BFBA68E-E21B-458E-AE12-FE85E903D2C0}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{09900DE8-1DCA-443F-9243-26FF581438AF} => value deleted successfully.
"HKCR\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}" => Key not found.
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{09900DE8-1DCA-443F-9243-26FF581438AF} => value deleted successfully.
"HKCR\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}" => Key not found.
HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{{09900DE8-1DCA-443F-9243-26FF581438AF} => Value not found.
"HKCR\CLSID\Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{{09900DE8-1DCA-443F-9243-26FF581438AF}" => Key not found.
"HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\MozillaPlugins\@altergeo.ru/Html5loc" => Key deleted successfully.
C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll not found.
"HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\MozillaPlugins\@altergeo.ru/Html5loc" => Key not found.
C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll not found.
C:\Program Files\mozilla firefox\browser\searchplugins\Ask.xml => Moved successfully.
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found] => not found.
"HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi" => Key deleted successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\nhgcieglcpdegkhamigiokdphfhhnlhh" => Key deleted successfully.
C:\Users\Andrücha\AppData\Local\Temp\A861.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\amigo_setup.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\Delta.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\ffdshow.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\GuardMailRu.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\HPQSi.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\installhelper.dll => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (1).exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2).exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2)_1.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih_1.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\Internet_s.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv_cf5873ae.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\jre-6u37-windows-i586-iftw_e22a15f2.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\jre-7u71-windows-i586-iftw_717d7de5.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\MailRuUpdater.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\propsys.dll => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\SRAssetsHelper.dll => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\vcredist_x86.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\WSSetup.exe => Moved successfully.
EmptyTemp: => Removed 900.1 MB temporary data.


The system needed a reboot. 

==== End of Fixlog ====

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by Andrücha (administrator) on ANDRÜCHA-PC on 09-12-2014 09:06:44
Running from C:\Users\Andrücha\Downloads
Loaded Profile: Andrücha (Available profiles: Andrücha)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(IDT, Inc.) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Hewlett-Packard Corporation) C:\WINDOWS\System32\hpservice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\mobsync.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
() C:\WINDOWS\SMINST\BLService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(TomTom) C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Avira) C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\WINDOWS\System32\wuauclt.exe
(Microsoft Corporation) C:\WINDOWS\System32\taskmgr.exe
(Microsoft Corporation) C:\WINDOWS\System32\conime.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [144784 2008-03-25] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-12-07] (Avira)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7227
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\vkontakteru-audiosearch.xml
FF Extension: Avira Browser Safety - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: HTML5 location provider - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{B100D0FF-0001-8CE4-2790-AACE49B8AE35} [2014-03-25]
FF Extension: VKontakte.ru MP3 Музыка Качалка - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\ffvkontaktemusic@chupakabr.ru.xpi [2014-09-09]
FF Extension: Vkontakte Download - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\support@videoadd.ru.xpi [2014-09-09]
FF Extension: ВКонтакте.ру Downloader - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\vk@sergeykolosov.mp.xpi [2011-10-08]
FF Extension: Adblock Plus - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-03-06]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-10-08]
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Mail.Ru) - C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi [2014-11-17]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [993584 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-04-15] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-02-26] (Hewlett-Packard Company) [File not signed]
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [292216 2008-06-25] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [116080 2008-06-25] ()
R2 Recovery Service for Windows; C:\Windows\SMINST\BLService.exe [361808 2008-04-26] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe [221273 2008-06-27] (IDT, Inc.)
R2 TomTomHOMEService; C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-04-22] (TomTom)
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)
S2 Guard.Mail.ru; "C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-09 09:02 - 2014-12-09 09:02 - 02347384 _____ (ESET) C:\Users\Andrücha\Downloads\esetsmartinstaller_deu.exe
2014-12-08 10:11 - 2014-12-08 10:11 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-12-08 09:48 - 2014-12-09 09:04 - 00025506 _____ () C:\Users\Andrücha\Downloads\Addition.txt
2014-12-08 09:47 - 2014-12-09 09:06 - 00013048 _____ () C:\Users\Andrücha\Downloads\FRST.txt
2014-12-08 09:47 - 2014-12-09 09:06 - 00000000 ____D () C:\FRST
2014-12-08 09:47 - 2014-12-08 09:47 - 01111040 _____ (Farbar) C:\Users\Andrücha\Downloads\FRST.exe
2014-12-08 09:34 - 2014-12-08 09:34 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\AviraSpeedup
2014-12-07 21:27 - 2014-12-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-12-07 21:20 - 2014-12-07 21:20 - 00000000 ____D () C:\Windows\ERUNT
2014-12-07 20:57 - 2014-12-08 20:22 - 00000000 ____D () C:\AdwCleaner
2014-12-07 20:57 - 2014-12-08 20:20 - 00000220 _____ () C:\AdwCleanerDebug.txt
2014-12-07 20:35 - 2014-12-08 20:56 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-07 20:35 - 2014-12-07 20:35 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-07 20:31 - 2014-12-07 20:31 - 02153472 _____ () C:\Users\Andrücha\Downloads\AdwCleaner_4.104.exe
2014-12-07 20:31 - 2014-12-07 20:31 - 01707646 _____ (Thisisu) C:\Users\Andrücha\Downloads\JRT.exe
2014-12-07 20:29 - 2014-12-07 20:30 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Andrücha\Downloads\mbam-setup-2.0.4.1028.exe
2014-11-19 18:33 - 2014-12-09 08:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-19 18:33 - 2014-11-26 15:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-19 18:33 - 2014-11-19 18:33 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Macromedia
2014-11-19 18:09 - 2014-11-23 17:57 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-11-19 18:09 - 2014-11-19 18:09 - 00001894 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-11-19 18:08 - 2014-11-19 18:08 - 00000000 ____D () C:\Program Files\Adobe
2014-11-19 18:06 - 2014-11-19 18:06 - 01055952 _____ (Adobe) C:\Users\Andrücha\Downloads\install_reader10_de_mssa_aaa_aih.exe
2014-11-19 15:05 - 2014-11-19 15:05 - 01055936 _____ (Adobe) C:\Users\Andrücha\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-09 09:03 - 2006-11-02 11:33 - 01445310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-09 09:01 - 2011-10-06 13:17 - 01382089 _____ () C:\Windows\WindowsUpdate.log
2014-12-09 08:57 - 2013-04-18 20:07 - 00000439 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-09 08:57 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.dat
2014-12-09 08:57 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.001
2014-12-09 08:56 - 2013-04-18 20:20 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-12-09 08:56 - 2008-01-21 03:47 - 00274048 _____ () C:\Windows\PFRO.log
2014-12-09 08:56 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-09 08:56 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-09 08:56 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-09 08:55 - 2008-07-31 21:52 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-09 08:55 - 2006-11-02 14:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-08 10:11 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-08 10:09 - 2012-06-01 11:59 - 00000986 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job
2014-12-07 21:26 - 2013-11-03 19:12 - 00000000 ____D () C:\Program Files\Avira
2014-12-03 19:18 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\tracing
2014-11-30 13:09 - 2012-06-01 11:59 - 00000964 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job
2014-11-26 15:53 - 2011-10-08 14:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-24 14:04 - 2011-10-07 13:02 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-20 19:33 - 2006-11-02 13:52 - 00149443 _____ () C:\Windows\setupact.log
2014-11-20 19:15 - 2008-07-31 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-20 19:14 - 2013-03-24 14:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-19 18:33 - 2012-08-20 14:35 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Adobe
2014-11-19 18:29 - 2014-03-06 16:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-19 18:12 - 2011-10-06 13:58 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Adobe
2014-11-19 18:09 - 2008-07-31 23:19 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-19 15:00 - 2013-08-01 23:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-19 14:55 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-19 14:51 - 2012-01-08 18:40 - 00000000 ____D () C:\ProgramData\Guard.Mail.Ru

Some content of TEMP:
====================
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-09 09:04

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-09 09:07:08
Running from C:\Users\Andrücha\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.115.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
Avira (HKLM\...\{9480d4af-12b9-4e56-8034-4031ef6ab39d}) (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C1500}) (Version: 12.21.0.3975 - APN, LLC)
Avira System Speedup (HKLM\...\AviraSpeedup) (Version: 1.3.1.9970 - Avira System Speedup)
Canon Utilities Digital Photo Professional 3.10 (HKLM\...\DPP) (Version: 3.10.2.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM\...\EOS Utility) (Version: 2.10.2.0 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM\...\Picture Style Editor) (Version: 1.9.0.0 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.)
CleanUp! (HKLM\...\CleanUp!) (Version:  - )
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
ESU for Microsoft Vista (HKLM\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
ffdshow v1.2.4422 [2012-04-09] (HKLM\...\ffdshow_is1) (Version: 1.2.4422.0 - FreeCodecPack)
Free Mp3 Wma Converter V 2.2 (HKLM\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)
Guard.Mail.ru (HKLM\...\Guard.Mail.ru) (Version:  - Mail.ru) <==== ATTENTION
Hewlett-Packard Active Check for Health Check (Version: 1.1.15.2 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.63.2 - HP) Hidden
HP Customer Experience Enhancements (HKLM\...\{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.01.0005 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Help and Support (HKLM\...\{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}) (Version: 2.0.9.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.6204 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.6204 - HP)
HP Quick Launch Buttons 6.40 D1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.40 D1 - Hewlett-Packard)
HP QuickPlay 3.7 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - Hewlett-Packard)
HP QuickTouch 1.00 D2 (HKLM\...\{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}) (Version: 1.0.9 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{f32502b5-5b64-4882-bf61-77f23edcac4f}) (Version: 2.1.3359.2635 - Hewlett-Packard)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP User Guides 0103 (HKLM\...\{B8169E45-8E23-430B-91D1-EC64540C8ED0}) (Version: 1.01.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{340F521E-3576-4E1A-B75C-EB0ACF751379}) (Version: 3.00 J1 - Hewlett-Packard)
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Html5 geolocation provider (HKLM\...\{12644DC5-2271-442B-816F-8CFFD3DDDF32}) (Version: 3.5.4.872 - AlterGeo)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6017.13 - IDT)
Java(TM) 6 Update 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160060}) (Version: 1.6.0.60 - Sun Microsystems, Inc.)
JMicron JMB38X Flash Media Controller (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.16.01 - JMicron Technology Corp.)
LightScribe System Software  1.12.33.2 (HKLM\...\{582287DA-0806-4AC0-BF19-C15E3A466034}) (Version: 1.12.33.2 - LightScribe)
Mail.Ru Агент 5.10 (сборка 5308, для всех пользователей) (HKLM\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Агент 6.0 (сборка 5831, для текущего пользователя) (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Спутник 2.4.1.44 (HKLM\...\MailRuSputnik) (Version:  - Mail.Ru) <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: 1.0.0.43 - WildTangent)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
Opera 12.13 (HKLM\...\Opera 12.13.1734) (Version: 12.13.1734 - Opera Software ASA)
Power MP3 WMA Converter 2006, (ver 3.42) (HKLM\...\Power MP3 WMA Converter_is1) (Version: 3.42 - CooolSoft, Inc.)
ProtectSmart Hard Drive Protection (HKLM\...\{CB71A20E-B1B4-4562-81FA-33E1DBD0342F}) (Version: 3.10 A7 - Hewlett-Packard)
QuickPlay SlingPlayer 0.4.6 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.6 - SlingMedia)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.0 (HKLM\...\{EA17F4FC-FDBF-4CF8-A529-2D983132D053}) (Version: 6.0.126 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.2.4.0 - Synaptics)
TomTom HOME 2.8.2.2264 (HKLM\...\TomTom HOME) (Version: 2.8.2.2264 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for Html5 geolocation provider (HKLM\...\{45BECC2D-582C-472D-A754-E2AD10706397}) (Version: 3.5.2.858 - AlterGeo)
Update for Html5 geolocation provider (HKLM\...\{D492942E-9368-48D9-BB8B-68E8E4CE2D43}) (Version: 3.7.6.911 - AlterGeo)
Update for Office 2007 (KB934528) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{2B939677-2FFD-48F6-9075-7BF48CB87C80}) (Version:  - )
VKontakte (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\VKontakte) (Version:  - Andrew Rogozov)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

==================== Restore Points  =========================

19-10-2013 15:03:39 Windows Update
22-10-2013 17:31:53 Windows Update
29-10-2013 18:55:33 Windows Update
31-10-2013 19:08:07 Installed Adobe Reader XI.
31-10-2013 19:12:48 Installed Adobe Reader XI.
01-11-2013 18:44:05 Windows Update
05-11-2013 20:28:15 Installed Adobe Reader XI.
16-11-2013 17:06:56 Windows Update
15-12-2013 20:52:29 Windows Update
26-01-2014 14:03:00 Windows Update
09-02-2014 18:20:47 PC Performer So, Feb 09, 14  19:20
14-02-2014 13:54:13 Windows Update
17-03-2014 19:06:00 Installed Adobe Reader XI.
23-03-2014 12:39:27 Windows Update
11-04-2014 12:37:07 Windows Update
14-05-2014 19:19:36 Windows Update
14-06-2014 22:46:50 Windows Update
10-07-2014 18:02:30 Windows Update
16-08-2014 16:00:04 Windows Update
31-08-2014 10:05:45 Removed Facebook Video Calling 3.1.0.521
10-09-2014 15:56:36 Windows Update
17-11-2014 19:16:22 Windows Update
19-11-2014 13:54:53 Windows Update
07-12-2014 20:25:39 Avira System Speedup(1.3.1.9970)
07-12-2014 20:28:50 Windows Update
09-12-2014 07:45:13 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1F286ADE-039E-474D-8EF2-83C14C3CFA0F} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-04-15] (Hewlett-Packard)
Task: {324F6E3C-D83B-431F-BD8A-D240B2CAB216} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {65349617-D6AF-4DA0-B523-2EFCC6B3BB54} - System32\Tasks\AviraSpeedup => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [2014-12-07] (Avira)
Task: {6E1CF2A5-F9D9-46D5-B68E-D6A811E76CDF} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {C163C141-F757-4156-8BE3-AEF8AEE4217C} - System32\Tasks\{6F3DAAC4-5DFC-4603-933B-572D9826C258} => Chrome.exe hxxp://ui.skype.com/ui/0/5.10.0.116/ru/abandoninstall?page=tsProgressBar
Task: {E5724EA0-F9B1-44B9-8EE9-8C85044BF062} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {FAD4286E-AA44-4B22-93DC-0231985E42AE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForAndrьcha.job => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{5FD033D5-882A-4E63-8500-180E11B1449B}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2008-07-31 22:31 - 2008-06-25 21:36 - 00292216 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2008-07-31 22:31 - 2008-06-25 21:36 - 00259480 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00116080 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2008-07-31 23:35 - 2008-04-26 00:15 - 00361808 _____ () C:\Windows\SMINST\BLService.exe
2008-07-31 23:35 - 2007-11-15 00:46 - 00126976 _____ () C:\Windows\SMINST\STWmiM.dll
2008-07-31 22:30 - 2008-06-25 21:34 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll
2014-03-06 16:38 - 2014-11-19 18:29 - 03649648 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk => C:\Windows\pss\BTTray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Andrücha^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AlterGeoUpdater => C:\Program Files\AlterGeo\Html5 geolocation provider\html5locsvc.exe
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpWirelessAssistant => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
MSCONFIG\startupreg: iLivid => "C:\Users\Andrücha\AppData\Local\iLivid\iLivid.exe" -autorun
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: MAgent => C:\Program Files\Mail.Ru\Agent\magent.exe -LM
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: OnScreenDisplay => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QPService => "C:\Program Files\HP\QuickPlay\QPService.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => %ProgramFiles%\IDT\WDM\sttray.exe
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMERunner.exe"
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide

========================= Accounts: ==========================

Administrator (S-1-5-21-2119122295-1896836890-182237168-500 - Administrator - Disabled)
Andrücha (S-1-5-21-2119122295-1896836890-182237168-1000 - Administrator - Enabled) => C:\Users\Andrücha
Gast (S-1-5-21-2119122295-1896836890-182237168-501 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/09/2014 09:06:29 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 7.12.2014.1 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 16e8
Anfangszeit: 01d013866bbc7bc5
Zeitpunkt der Beendigung: 52765

Error: (12/09/2014 09:06:09 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.0.6001.18164 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 660
Anfangszeit: 01d01385b32a9335
Zeitpunkt der Beendigung: 60000

Error: (12/09/2014 09:01:57 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 7.12.2014.1 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 126c
Anfangszeit: 01d013860b0a4d75
Zeitpunkt der Beendigung: 2

Error: (12/09/2014 08:58:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/09/2014 06:29:44 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/09/2014 06:29:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung QPSched.exe, Version 5.0.0.2922, Zeitstempel 0x48353a4d, fehlerhaftes Modul QPSched.exe, Version 5.0.0.2922, Zeitstempel 0x48353a4d, Ausnahmecode 0xc0000005, Fehleroffset 0x00007684,
Prozess-ID 0x95c, Anwendungsstartzeit QPSched.exe0.


System errors:
=============
Error: (12/09/2014 08:58:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/09/2014 08:57:56 AM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (12/09/2014 08:57:56 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.

Error: (12/09/2014 08:56:52 AM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (12/09/2014 08:25:28 AM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (12/09/2014 08:25:28 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.

Error: (12/09/2014 08:24:59 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: QuickPlay Task Scheduler (QTS)1

Error: (12/09/2014 06:29:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/09/2014 06:29:20 AM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-12-09 09:07:03.926
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:07:03.858
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:07:03.797
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:07:03.733
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:07:03.568
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:07:03.501
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:07:03.440
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:07:03.354
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:06:52.446
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 09:06:52.390
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Percentage of memory in use: 44%
Total physical RAM: 3068.03 MB
Available physical RAM: 1696.3 MB
Total Pagefile: 6341.08 MB
Available Pagefile: 4769.44 MB
Total Virtual: 2047.88 MB
Available Virtual: 1908.31 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:289.06 GB) (Free:208.15 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:298.09 GB) (Free:283.14 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:9.03 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 133E133E)
Partition 1: (Active) - (Size=289.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 9DC051CF)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ec8d9aaf38d16d4b9ebfb1d597adc466
# engine=21464
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-09 08:17:12
# local_time=2014-12-09 09:17:12 (+0100, Mitteleuropäische Zeit)
# country="Russia"
# lang=1031
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 6386 36684190 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 5038 255645760 0 0
# scanned=10405
# found=3
# cleaned=0
# scan_time=344
sh=DC2F44E408378C231AFA4D5E0BC65855573FA17D ft=1 fh=576bb7911dc12d10 vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrücha\AppData\Local\iLivid\Helper.dll.vir"
sh=97200776036142F9D86A9E159FFB02F266065E78 ft=1 fh=2d9d215ea2994e2e vn="Variante von Win32/Toolbar.SearchSuite.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrücha\AppData\Local\torch\Helper.dll.vir"
sh=6EF4B349F23F2B83D07BAAFF09F65ED63482818C ft=1 fh=c71c001182c4fa88 vn="Variante von Win32/Toolbar.SearchSuite.Z evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Andrücha\AppData\Local\Temp\installhelper.dll.xBAD"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ec8d9aaf38d16d4b9ebfb1d597adc466
# engine=21464
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-09 09:09:53
# local_time=2014-12-09 10:09:53 (+0100, Mitteleuropäische Zeit)
# country="Russia"
# lang=1031
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 5947 36687351 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 4599 255648921 0 0
# scanned=158488
# found=9
# cleaned=0
# scan_time=3114
sh=DC2F44E408378C231AFA4D5E0BC65855573FA17D ft=1 fh=576bb7911dc12d10 vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrücha\AppData\Local\iLivid\Helper.dll.vir"
sh=97200776036142F9D86A9E159FFB02F266065E78 ft=1 fh=2d9d215ea2994e2e vn="Variante von Win32/Toolbar.SearchSuite.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrücha\AppData\Local\torch\Helper.dll.vir"
sh=6EF4B349F23F2B83D07BAAFF09F65ED63482818C ft=1 fh=c71c001182c4fa88 vn="Variante von Win32/Toolbar.SearchSuite.Z evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Andrücha\AppData\Local\Temp\installhelper.dll.xBAD"
sh=64011682BF5F058CFE85661A38D03560E1E42712 ft=0 fh=0000000000000000 vn="INF/Autorun.gen Wurm" ac=I fn="E:\AUTORUN.INF"
sh=725F8FB6802AB9736A294EE4BA5D12B85413A9C7 ft=1 fh=60b1a670b66fa197 vn="Variante von Win32/ShipUp.NAJ Trojaner" ac=I fn="E:\keybd.exe"
sh=725F8FB6802AB9736A294EE4BA5D12B85413A9C7 ft=1 fh=60b1a670b66fa197 vn="Variante von Win32/ShipUp.NAJ Trojaner" ac=I fn="E:\msdn\KB914268-inf.log"
sh=27CADB87E4739D62070B050F272B84B01C0D5A4C ft=1 fh=653eeaf13d1b8ddf vn="Win32/ShipUp.NAH Trojaner" ac=I fn="E:\msdn\KB925273-dir.log"
sh=E04BD50B33C5149F2F9DF0A843A760680DE4DC1A ft=1 fh=a9d0e49a4d0eb69c vn="Win32/Small.BXO Trojaner" ac=I fn="E:\msdn\KB936891-doc.log"
sh=53BAD53092A0F97305F02A46957F05C512322474 ft=1 fh=bee555219d80b6c1 vn="Win32/AutoRun.Agent.NT Wurm" ac=I fn="E:\XP-Update\KB877527-ldup.log"

Zu der 4ten Frage:
Das System läuft nicht stabil, die Mailwareentfernung Programme muss ich teilweise 3x starten, da dass system ständig einfriert.

Machiavelli · 09.12.2014, 14:17

Zitat:

Running from C:\Users\Andrücha\Downloads

Alle Tools auf dem Desktop speichern.

andrey86 · 09.12.2014, 14:29

Erledigt und jetzt?

Machiavelli · 09.12.2014, 15:28

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe
E:\AUTORUN.INF
E:\keybd.exe
E:\msdn\KB914268-inf.log
E:\msdn\KB925273-dir.log
E:\msdn\KB936891-doc.log
E:\XP-Update\KB877527-ldup.log
EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Danach erneuten FRST Scan, Log posten.

andrey86 · 09.12.2014, 19:12

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-09 19:07:23 Run:2
Running from C:\Users\Andrücha\Desktop
Loaded Profile: Andrücha (Available profiles: Andrücha)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe
E:\AUTORUN.INF
E:\keybd.exe
E:\msdn\KB914268-inf.log
E:\msdn\KB925273-dir.log
E:\msdn\KB936891-doc.log
E:\XP-Update\KB877527-ldup.log
EmptyTemp:
        
*****************

Error setting Default URLSearchHook.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe => Moved successfully.
Could not move "E:\AUTORUN.INF" => Scheduled to move on reboot.
Could not move "E:\keybd.exe" => Scheduled to move on reboot.
E:\msdn\KB914268-inf.log => Moved successfully.
E:\msdn\KB925273-dir.log => Moved successfully.
E:\msdn\KB936891-doc.log => Moved successfully.
E:\XP-Update\KB877527-ldup.log => Moved successfully.
EmptyTemp: => Removed 22.3 MB temporary data.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-12-09 19:09:46)<=

"E:\AUTORUN.INF" => File could not move.
"E:\keybd.exe" => File could not move.

==== End of Fixlog ====

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by Andrücha (administrator) on ANDRÜCHA-PC on 09-12-2014 19:13:48
Running from C:\Users\Andrücha\Desktop
Loaded Profile: Andrücha (Available profiles: Andrücha)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(IDT, Inc.) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Hewlett-Packard Corporation) C:\WINDOWS\System32\hpservice.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
() C:\WINDOWS\SMINST\BLService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(TomTom) C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira) C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\WINDOWS\System32\wuauclt.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\WMIADAP.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [144784 2008-03-25] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-12-07] (Avira)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7227
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\vkontakteru-audiosearch.xml
FF Extension: Avira Browser Safety - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: HTML5 location provider - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{B100D0FF-0001-8CE4-2790-AACE49B8AE35} [2014-03-25]
FF Extension: VKontakte.ru MP3 Музыка Качалка - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\ffvkontaktemusic@chupakabr.ru.xpi [2014-09-09]
FF Extension: Vkontakte Download - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\support@videoadd.ru.xpi [2014-09-09]
FF Extension: ВКонтакте.ру Downloader - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\vk@sergeykolosov.mp.xpi [2011-10-08]
FF Extension: Adblock Plus - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-09]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-10-08]
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Mail.Ru) - C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi [2014-11-17]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [993584 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-04-15] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-02-26] (Hewlett-Packard Company) [File not signed]
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [292216 2008-06-25] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [116080 2008-06-25] ()
R2 Recovery Service for Windows; C:\Windows\SMINST\BLService.exe [361808 2008-04-26] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe [221273 2008-06-27] (IDT, Inc.)
R2 TomTomHOMEService; C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-04-22] (TomTom)
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)
S2 Guard.Mail.ru; "C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-09 19:13 - 2014-12-09 19:16 - 00012938 _____ () C:\Users\Andrücha\Desktop\FRST.txt
2014-12-09 19:05 - 2014-12-09 19:06 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-12-09 09:08 - 2014-12-09 09:08 - 00000000 ____D () C:\Program Files\ESET
2014-12-09 09:02 - 2014-12-09 09:02 - 02347384 _____ (ESET) C:\Users\Andrücha\Downloads\esetsmartinstaller_deu.exe
2014-12-08 10:11 - 2014-12-08 10:11 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-12-08 09:48 - 2014-12-09 09:07 - 00026927 _____ () C:\Users\Andrücha\Downloads\Addition.txt
2014-12-08 09:47 - 2014-12-09 19:13 - 00000000 ____D () C:\FRST
2014-12-08 09:47 - 2014-12-09 09:07 - 00020273 _____ () C:\Users\Andrücha\Downloads\FRST.txt
2014-12-08 09:47 - 2014-12-08 09:47 - 01111040 _____ (Farbar) C:\Users\Andrücha\Desktop\FRST.exe
2014-12-08 09:34 - 2014-12-08 09:34 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\AviraSpeedup
2014-12-07 21:27 - 2014-12-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-12-07 21:20 - 2014-12-07 21:20 - 00000000 ____D () C:\Windows\ERUNT
2014-12-07 20:57 - 2014-12-08 20:22 - 00000000 ____D () C:\AdwCleaner
2014-12-07 20:57 - 2014-12-08 20:20 - 00000220 _____ () C:\AdwCleanerDebug.txt
2014-12-07 20:35 - 2014-12-08 20:56 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-07 20:35 - 2014-12-07 20:35 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-07 20:35 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-07 20:31 - 2014-12-07 20:31 - 02153472 _____ () C:\Users\Andrücha\Downloads\AdwCleaner_4.104.exe
2014-12-07 20:31 - 2014-12-07 20:31 - 01707646 _____ (Thisisu) C:\Users\Andrücha\Downloads\JRT.exe
2014-12-07 20:29 - 2014-12-07 20:30 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Andrücha\Downloads\mbam-setup-2.0.4.1028.exe
2014-11-19 18:33 - 2014-12-09 09:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-19 18:33 - 2014-11-26 15:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-19 18:33 - 2014-11-19 18:33 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Macromedia
2014-11-19 18:09 - 2014-11-23 17:57 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-11-19 18:09 - 2014-11-19 18:09 - 00001894 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-11-19 18:08 - 2014-11-19 18:08 - 00000000 ____D () C:\Program Files\Adobe
2014-11-19 18:06 - 2014-11-19 18:06 - 01055952 _____ (Adobe) C:\Users\Andrücha\Downloads\install_reader10_de_mssa_aaa_aih.exe
2014-11-19 15:05 - 2014-11-19 15:05 - 01055936 _____ (Adobe) C:\Users\Andrücha\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-09 19:15 - 2011-10-06 13:17 - 01429457 _____ () C:\Windows\WindowsUpdate.log
2014-12-09 19:15 - 2006-11-02 11:33 - 01445310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-09 19:10 - 2013-03-24 14:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-09 19:09 - 2013-04-18 20:20 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-12-09 19:09 - 2013-04-18 20:07 - 00000439 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-09 19:09 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.001
2014-12-09 19:09 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-09 19:09 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-09 19:09 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-09 19:08 - 2008-01-21 03:47 - 00274804 _____ () C:\Windows\PFRO.log
2014-12-09 19:07 - 2008-07-31 21:52 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-09 19:07 - 2006-11-02 14:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-09 19:04 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.dat
2014-12-09 10:09 - 2012-06-01 11:59 - 00000986 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job
2014-12-08 10:11 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-07 21:26 - 2013-11-03 19:12 - 00000000 ____D () C:\Program Files\Avira
2014-12-03 19:18 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\tracing
2014-11-30 13:09 - 2012-06-01 11:59 - 00000964 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job
2014-11-26 15:53 - 2011-10-08 14:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-24 14:04 - 2011-10-07 13:02 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-20 19:33 - 2006-11-02 13:52 - 00149443 _____ () C:\Windows\setupact.log
2014-11-20 19:15 - 2008-07-31 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-19 18:33 - 2012-08-20 14:35 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Adobe
2014-11-19 18:12 - 2011-10-06 13:58 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Adobe
2014-11-19 18:09 - 2008-07-31 23:19 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-19 15:00 - 2013-08-01 23:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-19 14:55 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-19 14:51 - 2012-01-08 18:40 - 00000000 ____D () C:\ProgramData\Guard.Mail.Ru

Some content of TEMP:
====================
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-09 19:15

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-09 19:16:31
Running from C:\Users\Andrücha\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.115.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
Avira (HKLM\...\{9480d4af-12b9-4e56-8034-4031ef6ab39d}) (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C1500}) (Version: 12.21.0.3975 - APN, LLC)
Avira System Speedup (HKLM\...\AviraSpeedup) (Version: 1.3.1.9970 - Avira System Speedup)
Canon Utilities Digital Photo Professional 3.10 (HKLM\...\DPP) (Version: 3.10.2.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM\...\EOS Utility) (Version: 2.10.2.0 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM\...\Picture Style Editor) (Version: 1.9.0.0 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.)
CleanUp! (HKLM\...\CleanUp!) (Version:  - )
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
ESU for Microsoft Vista (HKLM\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
ffdshow v1.2.4422 [2012-04-09] (HKLM\...\ffdshow_is1) (Version: 1.2.4422.0 - FreeCodecPack)
Free Mp3 Wma Converter V 2.2 (HKLM\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)
Guard.Mail.ru (HKLM\...\Guard.Mail.ru) (Version:  - Mail.ru) <==== ATTENTION
Hewlett-Packard Active Check for Health Check (Version: 1.1.15.2 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.63.2 - HP) Hidden
HP Customer Experience Enhancements (HKLM\...\{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.01.0005 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Help and Support (HKLM\...\{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}) (Version: 2.0.9.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.6204 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.6204 - HP)
HP Quick Launch Buttons 6.40 D1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.40 D1 - Hewlett-Packard)
HP QuickPlay 3.7 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - Hewlett-Packard)
HP QuickTouch 1.00 D2 (HKLM\...\{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}) (Version: 1.0.9 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{f32502b5-5b64-4882-bf61-77f23edcac4f}) (Version: 2.1.3359.2635 - Hewlett-Packard)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP User Guides 0103 (HKLM\...\{B8169E45-8E23-430B-91D1-EC64540C8ED0}) (Version: 1.01.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{340F521E-3576-4E1A-B75C-EB0ACF751379}) (Version: 3.00 J1 - Hewlett-Packard)
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Html5 geolocation provider (HKLM\...\{12644DC5-2271-442B-816F-8CFFD3DDDF32}) (Version: 3.5.4.872 - AlterGeo)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6017.13 - IDT)
Java(TM) 6 Update 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160060}) (Version: 1.6.0.60 - Sun Microsystems, Inc.)
JMicron JMB38X Flash Media Controller (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.16.01 - JMicron Technology Corp.)
LightScribe System Software  1.12.33.2 (HKLM\...\{582287DA-0806-4AC0-BF19-C15E3A466034}) (Version: 1.12.33.2 - LightScribe)
Mail.Ru Агент 5.10 (сборка 5308, для всех пользователей) (HKLM\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Агент 6.0 (сборка 5831, для текущего пользователя) (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\MRA) (Version:  - Mail.Ru) <==== ATTENTION
Mail.Ru Спутник 2.4.1.44 (HKLM\...\MailRuSputnik) (Version:  - Mail.Ru) <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: 1.0.0.43 - WildTangent)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
Opera 12.13 (HKLM\...\Opera 12.13.1734) (Version: 12.13.1734 - Opera Software ASA)
Power MP3 WMA Converter 2006, (ver 3.42) (HKLM\...\Power MP3 WMA Converter_is1) (Version: 3.42 - CooolSoft, Inc.)
ProtectSmart Hard Drive Protection (HKLM\...\{CB71A20E-B1B4-4562-81FA-33E1DBD0342F}) (Version: 3.10 A7 - Hewlett-Packard)
QuickPlay SlingPlayer 0.4.6 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.6 - SlingMedia)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.0 (HKLM\...\{EA17F4FC-FDBF-4CF8-A529-2D983132D053}) (Version: 6.0.126 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.2.4.0 - Synaptics)
TomTom HOME 2.8.2.2264 (HKLM\...\TomTom HOME) (Version: 2.8.2.2264 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for Html5 geolocation provider (HKLM\...\{45BECC2D-582C-472D-A754-E2AD10706397}) (Version: 3.5.2.858 - AlterGeo)
Update for Html5 geolocation provider (HKLM\...\{D492942E-9368-48D9-BB8B-68E8E4CE2D43}) (Version: 3.7.6.911 - AlterGeo)
Update for Office 2007 (KB934528) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{2B939677-2FFD-48F6-9075-7BF48CB87C80}) (Version:  - )
VKontakte (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\VKontakte) (Version:  - Andrew Rogozov)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

==================== Restore Points  =========================

22-10-2013 17:31:53 Windows Update
29-10-2013 18:55:33 Windows Update
31-10-2013 19:08:07 Installed Adobe Reader XI.
31-10-2013 19:12:48 Installed Adobe Reader XI.
01-11-2013 18:44:05 Windows Update
05-11-2013 20:28:15 Installed Adobe Reader XI.
16-11-2013 17:06:56 Windows Update
15-12-2013 20:52:29 Windows Update
26-01-2014 14:03:00 Windows Update
09-02-2014 18:20:47 PC Performer So, Feb 09, 14  19:20
14-02-2014 13:54:13 Windows Update
17-03-2014 19:06:00 Installed Adobe Reader XI.
23-03-2014 12:39:27 Windows Update
11-04-2014 12:37:07 Windows Update
14-05-2014 19:19:36 Windows Update
14-06-2014 22:46:50 Windows Update
10-07-2014 18:02:30 Windows Update
16-08-2014 16:00:04 Windows Update
31-08-2014 10:05:45 Removed Facebook Video Calling 3.1.0.521
10-09-2014 15:56:36 Windows Update
17-11-2014 19:16:22 Windows Update
19-11-2014 13:54:53 Windows Update
07-12-2014 20:25:39 Avira System Speedup(1.3.1.9970)
07-12-2014 20:28:50 Windows Update
09-12-2014 07:45:13 Windows Update
09-12-2014 18:13:17 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1F286ADE-039E-474D-8EF2-83C14C3CFA0F} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-04-15] (Hewlett-Packard)
Task: {324F6E3C-D83B-431F-BD8A-D240B2CAB216} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {65349617-D6AF-4DA0-B523-2EFCC6B3BB54} - System32\Tasks\AviraSpeedup => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [2014-12-07] (Avira)
Task: {C163C141-F757-4156-8BE3-AEF8AEE4217C} - System32\Tasks\{6F3DAAC4-5DFC-4603-933B-572D9826C258} => Chrome.exe hxxp://ui.skype.com/ui/0/5.10.0.116/ru/abandoninstall?page=tsProgressBar
Task: {DCE8E9B0-08B7-4BFF-B877-F8B6BB03705D} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {E5724EA0-F9B1-44B9-8EE9-8C85044BF062} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {FAD4286E-AA44-4B22-93DC-0231985E42AE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForAndrьcha.job => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{5FD033D5-882A-4E63-8500-180E11B1449B}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2008-07-31 22:31 - 2008-06-25 21:36 - 00292216 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2008-07-31 22:31 - 2008-06-25 21:36 - 00259480 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00116080 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2008-07-31 23:35 - 2008-04-26 00:15 - 00361808 _____ () C:\Windows\SMINST\BLService.exe
2008-07-31 23:35 - 2007-11-15 00:46 - 00126976 _____ () C:\Windows\SMINST\STWmiM.dll
2008-07-31 22:30 - 2008-06-25 21:34 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll
2014-12-09 19:05 - 2014-12-09 19:06 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk => C:\Windows\pss\BTTray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Andrücha^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AlterGeoUpdater => C:\Program Files\AlterGeo\Html5 geolocation provider\html5locsvc.exe
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpWirelessAssistant => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
MSCONFIG\startupreg: iLivid => "C:\Users\Andrücha\AppData\Local\iLivid\iLivid.exe" -autorun
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: MAgent => C:\Program Files\Mail.Ru\Agent\magent.exe -LM
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: OnScreenDisplay => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QPService => "C:\Program Files\HP\QuickPlay\QPService.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => %ProgramFiles%\IDT\WDM\sttray.exe
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMERunner.exe"
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide

========================= Accounts: ==========================

Administrator (S-1-5-21-2119122295-1896836890-182237168-500 - Administrator - Disabled)
Andrücha (S-1-5-21-2119122295-1896836890-182237168-1000 - Administrator - Enabled) => C:\Users\Andrücha
Gast (S-1-5-21-2119122295-1896836890-182237168-501 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/09/2014 07:10:42 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (12/09/2014 07:10:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/09/2014 07:05:41 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (12/09/2014 07:04:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/09/2014 11:42:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/09/2014 09:06:29 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 7.12.2014.1 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 16e8
Anfangszeit: 01d013866bbc7bc5
Zeitpunkt der Beendigung: 52765

Error: (12/09/2014 09:06:09 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.0.6001.18164 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 660
Anfangszeit: 01d01385b32a9335
Zeitpunkt der Beendigung: 60000

Error: (12/09/2014 09:01:57 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 7.12.2014.1 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 126c
Anfangszeit: 01d013860b0a4d75
Zeitpunkt der Beendigung: 2

Error: (12/09/2014 08:58:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/09/2014 06:29:44 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (12/09/2014 07:10:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/09/2014 07:09:44 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (12/09/2014 07:09:44 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.

Error: (12/09/2014 07:09:08 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (12/09/2014 07:04:23 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (12/09/2014 07:04:23 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.

Error: (12/09/2014 07:04:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (12/09/2014 07:03:45 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (12/09/2014 11:42:42 AM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (12/09/2014 11:42:42 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-12-09 19:16:15.547
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:16:15.422
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:16:15.271
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:16:15.153
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:16:14.829
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:16:14.575
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:16:14.508
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:16:14.433
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:15:55.986
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 19:15:55.893
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Percentage of memory in use: 44%
Total physical RAM: 3068.03 MB
Available physical RAM: 1692.4 MB
Total Pagefile: 6341.08 MB
Available Pagefile: 4670.08 MB
Total Virtual: 2047.88 MB
Available Virtual: 1917.66 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:289.06 GB) (Free:208.21 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:298.09 GB) (Free:283.14 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:9.03 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 133E133E)
Partition 1: (Active) - (Size=289.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 9DC051CF)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Machiavelli · 09.12.2014, 19:25

Wie läuft das System?

andrey86 · 10.12.2014, 15:53

genauso wie vorher, leider.

Sobald ich auf E: gehe, sehe ich nun 2 Ordner, diese sind aber 93bytes Programme und es meldet sich sofort Antivir.

Machiavelli · 10.12.2014, 15:58

Zwei Möglichkeiten:

- Deaktiviere Dein AV System und öffne die Dateien. Vielleicht infizierst Du Dich.
- Wirf die CD weg

Für welche Möglichkeit willst Du Dich entscheiden?

andrey86 · 10.12.2014, 16:22

Vlt verstehen wir uns falsch.
E: ist eine Festplatte (recovery), wenn ich mein av deaktiviere, ändert es nix daran, dass weiterhin keine ordner sondern lauter win32 dateien angezeigt werden, das ist doch nicht richtig!
Zur cd: habe heute eine sd karte reingesteckt mit fotos und siehe da auch die wird nicht erkannt, der ordner wird auch da als win32 93bytes angezeigt.... Soll ich die auch wegschmeißen? Neeee!

Foto Cd wird nicht erkannt/gelesen/Tr.Dropper.Gen

Log-Analyse und Auswertung: Foto Cd wird nicht erkannt/gelesen/Tr.Dropper.Gen