Werbung durch youradexchange und stamplive

strowbowse · 03.01.2015, 14:09

Hallo zusammen,
Ich habe seit einiger Zeit ein Problem mit Werbung im neuesten Internet Explorer unter windows 8.1. Ständig gehen irgendwelche Fenster auf von youradexchange und stamplive. Die gängigen Tools wie mbam, adwcleaner usw haben schon Dinge entfernt, aber das Problem besteht weiter. Los ging alles glaube ich mit einer safer search Toolbar. Sorry für die wenigen Details, mein Vater hat sich das Ding eingefangen.

Kann mir jemand helfen? Wie gehe ich am besten vor?

Vielen Dank...

schrauber · 03.01.2015, 14:15

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

strowbowse · 03.01.2015, 14:44

Vielen Dank für die schnelle Antwort.

Hier die files:
frst.txt

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-01-2015
Ran by heiner (administrator) on LENOVOBISCHOFF on 03-01-2015 14:39:19
Running from C:\Users\heiner\Desktop
Loaded Profile: heiner (Available profiles: jan & heiner & marie-christin & Margit_2)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Windows\jmesoft\Service.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
() C:\Windows\jmesoft\JME_LOAD.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft) C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe\Solitaire.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Desktop.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13427784 2013-03-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2013-07-24] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-08-16] ()
HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [95192 2013-03-08] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [Lenovo App Shop] => C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\...\Run: [CCleaner] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2302644872-2412186451-4148703486-1002 -> {8BA8B87B-7C77-4818-9924-0351456E7298} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{DD525FD9-ED0B-4239-B1B1-9BF8E3E8F113}: [NameServer] 31.168.224.106,5.135.12.52

FireFox:
========
FF ProfilePath: C:\Users\heiner\AppData\Roaming\Mozilla\Firefox\Profiles\oomrh8ty.default
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [164736 2012-11-29] (Intel Corporation)
R2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-08-16] () [File not signed]
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-11-21] (LENOVO INCORPORATED.)
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2013-05-14] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-01] (Malwarebytes Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [71680 2014-04-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-03 14:39 - 2015-01-03 14:39 - 00011287 _____ () C:\Users\heiner\Desktop\FRST.txt
2015-01-03 14:38 - 2015-01-03 14:40 - 02123264 _____ (Farbar) C:\Users\heiner\Desktop\FRST64.exe
2015-01-01 17:40 - 2015-01-01 17:40 - 00000000 ____D () C:\Users\heiner\AppData\Roaming\Mozilla
2015-01-01 17:40 - 2015-01-01 17:40 - 00000000 ____D () C:\Users\heiner\AppData\Local\Mozilla
2015-01-01 17:39 - 2015-01-01 17:39 - 00012872 _____ (SurfRight B.V.) C:\WINDOWS\system32\bootdelete.exe
2015-01-01 17:31 - 2015-01-01 17:39 - 00043664 _____ () C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2015-01-01 17:23 - 2015-01-01 17:23 - 00001872 _____ () C:\WINDOWS\system32\.crusader
2015-01-01 16:03 - 2015-01-01 17:23 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-01-01 16:02 - 2015-01-01 16:03 - 11222744 _____ (SurfRight B.V.) C:\Users\heiner\Downloads\hitmanpro_x64.exe
2015-01-01 15:55 - 2015-01-03 14:39 - 00000000 ____D () C:\FRST
2015-01-01 15:27 - 2015-01-01 15:31 - 00000000 ____D () C:\WINDOWS\Minidump
2015-01-01 14:03 - 2015-01-01 14:03 - 01707939 _____ (Thisisu) C:\Users\heiner\Downloads\JRT.exe
2015-01-01 14:00 - 2015-01-01 14:00 - 05198336 _____ (AVAST Software) C:\Users\heiner\Downloads\aswmbr.exe
2015-01-01 13:54 - 2015-01-01 13:54 - 00001752 _____ () C:\sc-cleaner.txt
2015-01-01 13:50 - 2015-01-01 13:50 - 02347384 _____ (ESET) C:\Users\heiner\Downloads\esetsmartinstaller_deu.exe
2014-12-31 16:29 - 2013-08-22 14:25 - 00000824 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.20141231-162939.backup
2014-12-31 16:27 - 2013-08-22 14:25 - 00000824 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.20141231-162754.backup
2014-12-31 16:25 - 2014-12-31 16:25 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\LavasoftStatistics
2014-12-31 16:18 - 2015-01-01 15:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-31 16:18 - 2014-12-31 16:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-12-31 16:18 - 2014-12-31 16:18 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2014-12-31 16:10 - 2014-12-31 16:10 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-12-31 16:05 - 2014-12-31 16:05 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-12-31 15:08 - 2014-12-31 15:08 - 00000000 ___HD () C:\Lenovo
2014-12-31 14:51 - 2014-12-31 14:51 - 00001465 _____ () C:\Users\jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-31 14:32 - 2014-12-31 14:32 - 00001465 _____ () C:\Users\Margit_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00001186 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00001174 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-31 14:06 - 2014-12-31 14:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-31 14:04 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\WINDOWS\SysWOW64\dhRichClient3.dll
2014-12-31 14:04 - 2011-03-25 19:42 - 00338432 _____ () C:\WINDOWS\SysWOW64\sqlite36_engine.dll
2014-12-31 14:01 - 2014-12-31 14:02 - 29677544 _____ (Mozilla) C:\Users\Margit_2\Downloads\Firefox Setup 30.0.exe
2014-12-31 13:58 - 2014-12-31 13:58 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Mozilla
2014-12-31 13:58 - 2014-12-31 13:58 - 00000000 ____D () C:\ProgramData\Mozilla
2014-12-31 13:55 - 2014-12-31 13:55 - 00244104 _____ () C:\Users\Margit_2\Downloads\Firefox Setup Stub 34.0.5.exe
2014-12-31 12:29 - 2015-01-01 13:52 - 00000000 ____D () C:\AdwCleaner
2014-12-31 12:26 - 2014-12-31 12:28 - 02173952 _____ () C:\Users\jan\Downloads\adwcleaner_4_106.exe
2014-12-30 20:17 - 2014-12-30 20:17 - 00000000 _____ () C:\Recovery.txt
2014-12-30 18:00 - 2014-12-30 18:02 - 00000000 __SHD () C:\Users\jan\AppData\Local\EmieBrowserModeList
2014-12-30 17:44 - 2014-12-30 17:45 - 00002477 _____ () C:\RHDSetup.log
2014-12-28 11:56 - 2014-12-28 11:56 - 00000000 ____D () C:\Users\jan\AppData\Roaming\Avira
2014-12-25 18:20 - 2014-12-25 18:20 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2014-12-16 10:25 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-16 10:25 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-15 10:44 - 2014-12-15 10:44 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 07:51 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 07:51 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 07:51 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 07:51 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 07:50 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 07:50 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 07:50 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 07:49 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 07:49 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 07:49 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 07:49 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 07:49 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 07:49 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 07:49 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 07:49 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 07:49 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 07:49 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 07:49 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 07:49 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 07:49 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 07:49 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 07:49 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 07:49 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 07:49 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 07:49 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 07:49 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 07:49 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 07:49 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 07:49 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 07:49 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 07:49 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 07:49 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 07:49 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 07:49 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 07:49 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 07:49 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 07:49 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 07:49 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 07:49 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 07:49 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 07:49 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 07:49 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 07:49 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 07:49 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 07:49 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 07:49 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 07:49 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 07:49 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 07:49 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-06 17:01 - 2014-12-13 12:22 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-06 17:01 - 2014-12-06 17:01 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-03 14:30 - 2014-11-29 17:24 - 01556593 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-03 14:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-03 13:36 - 2014-04-20 04:34 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1002
2015-01-03 13:34 - 2014-04-20 15:32 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{1011892B-1536-4D62-9EAC-6140A32AC69E}
2015-01-03 13:32 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-03 13:26 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-01 17:24 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\heiner
2015-01-01 17:24 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-01 16:04 - 2014-11-26 22:09 - 00000000 ____D () C:\Users\Margit_2
2015-01-01 16:04 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\marie-christin
2015-01-01 16:04 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\jan
2015-01-01 13:58 - 2014-11-26 20:44 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-31 18:15 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-31 17:54 - 2014-11-26 22:26 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1005
2014-12-31 15:10 - 2013-12-03 15:28 - 00000000 ____D () C:\ProgramData\Temp
2014-12-31 15:10 - 2013-12-03 15:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-31 15:04 - 2014-11-26 22:17 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Packages
2014-12-31 15:03 - 2014-11-30 11:40 - 00003966 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2D4D6AD2-5955-4779-903D-711A48E2EEA1}
2014-12-31 14:47 - 2013-12-03 15:21 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo
2014-12-31 14:40 - 2014-04-19 21:23 - 00002774 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-12-31 14:40 - 2014-04-19 21:23 - 00000845 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-12-31 14:40 - 2014-04-19 21:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-31 14:40 - 2014-04-19 21:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-31 13:58 - 2014-11-30 12:05 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\Mozilla
2014-12-31 12:49 - 2014-04-20 04:09 - 00003946 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{C435D8AC-EDFA-435A-8C09-BEFA58E95F75}
2014-12-31 12:47 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-31 12:31 - 2014-04-19 21:13 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1001
2014-12-31 12:31 - 2013-12-03 15:28 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-12-30 20:31 - 2014-03-18 11:03 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-30 20:31 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-30 20:31 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-30 19:37 - 2014-11-26 20:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-30 19:37 - 2014-11-26 20:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-30 19:37 - 2014-04-20 00:15 - 00000000 ____D () C:\WINDOWS\SysWOW64\RTCOM
2014-12-30 19:37 - 2013-12-03 15:18 - 00000000 ____D () C:\WINDOWS\SysWOW64\sda
2014-12-30 19:30 - 2014-04-19 17:38 - 00000000 ____D () C:\Users\jan\AppData\Local\Packages
2014-12-30 19:30 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\registration
2014-12-30 19:29 - 2013-12-03 15:18 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-12-30 17:45 - 2013-12-03 15:18 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-12-28 11:54 - 2014-04-19 17:39 - 00000000 ____D () C:\Users\jan\AppData\Local\Lenovo
2014-12-27 18:17 - 2014-10-26 14:21 - 00000000 ____D () C:\Users\heiner\Desktop\Bilder
2014-12-17 10:20 - 2014-06-23 16:18 - 00000000 ____D () C:\Users\heiner\Desktop\Privat
2014-12-15 10:44 - 2014-07-09 15:09 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-15 10:30 - 2014-04-19 21:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-15 10:29 - 2014-04-19 20:28 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 10:27 - 2014-04-19 20:28 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-14 15:20 - 2014-09-20 12:52 - 00000000 ____D () C:\Users\heiner\AppData\Local\Adobe
2014-12-14 15:20 - 2014-04-20 04:28 - 00000000 ____D () C:\Users\heiner\AppData\Roaming\Adobe
2014-12-11 14:19 - 2014-11-30 12:05 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-11 14:19 - 2014-11-30 12:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-11 14:19 - 2014-11-30 12:05 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-11 14:19 - 2014-11-30 12:04 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-06 17:04 - 2013-12-03 15:34 - 00000000 ____D () C:\ProgramData\Adobe
2014-12-06 17:03 - 2014-11-26 22:18 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\Adobe
2014-12-06 17:03 - 2014-11-26 22:17 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Adobe
2014-12-06 17:01 - 2013-12-03 15:34 - 00000000 ____D () C:\Program Files (x86)\Adobe

Some content of TEMP:
====================
C:\Users\heiner\AppData\Local\Temp\avgnt.exe
C:\Users\jan\AppData\Local\Temp\avgnt.exe
C:\Users\Margit_2\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-28 12:03

==================== End Of Log ============================

--- --- ---

--- --- ---

addition.txt
FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-01-2015
Ran by heiner at 2015-01-03 14:40:09
Running from C:\Users\heiner\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4107 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dependency Package Update (Version: 1.6.25.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.32.00 - Lenovo Inc.) Hidden
Dependency Package Update (x32 Version: 1.6.32.00 - Lenovo Group Limited) Hidden
Driver & Application Installation (HKLM-x32\...\{BFECCF2A-F094-4066-8BFA-29CCBB7F6602}) (Version: 6.13.0621 - Lenovo)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.20.1337 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3958 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Lenovo App Shop (HKLM-x32\...\Lenovo App Shop 45246) (Version: 3.10.0.45246.24 - Lenovo)
Lenovo Assistant (HKLM-x32\...\{B2DE4F30-B8C7-49C0-85B9-2F37A5290F00}) (Version: 2.0.0.29 - Lenovo)
Lenovo Blacksilk USB Keyboard Driver (HKLM-x32\...\{B266E062-D6C5-485B-B426-51B152B041A6}) (Version: V1.6.13.0724 - Lenovo)
Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.32.00 - Lenovo Group Limited)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.3.0 - Lenovo)
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: 4.8.7 - CEWE COLOR AG u Co. OHG)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.7408 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.7408 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5108.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5108.52 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.1511 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.1511 - CyberLink Corp.) Hidden
Lenovo Solution Center (HKLM\...\{4041B18B-DE30-4D78-9D60-6ADC586C5E00}) (Version: 2.1.003.00 - Lenovo Group Limited)
LVT (HKLM-x32\...\{9E3469A6-443A-452C-BF44-8D7CE3A9A7E2}) (Version: 5.00.0914 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Standard 2007 (HKLM-x32\...\STANDARDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
Nitro Pro 8 (HKLM\...\{84DAF9F1-513C-49F8-89D2-63CB3F4A7E39}) (Version: 8.5.7.1 - Nitro)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.18.621.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6864 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.27614 - TeamViewer)
TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_STANDARDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_STANDARDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_STANDARDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_STANDARDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
WEB.DE Desktop Icons (HKLM-x32\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.5.0 - 1&1 Mail & Media GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {099A4572-C95F-49EF-A135-BAF25B52C2C1} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-03-13] (Lenovo)
Task: {168DC684-D0EB-46FE-AA92-EC1CC9725058} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2014-11-21] ()
Task: {1A7E7359-CAFA-47AF-878E-E723191272C2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {34D71863-073E-42E0-8940-9026505CBCCB} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-15] (Microsoft Corporation)
Task: {45E4B7E7-41CF-45DB-8024-EEAF19F30236} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {62D49B3C-82D8-49EB-B428-2B7E53A9D1C5} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)
Task: {A3A9A15A-C340-4D20-A1C2-7619BB0609AD} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {D9309FA3-BA97-4609-8729-A592353E4443} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-05-17] ()

==================== Loaded Modules (whitelisted) =============

2013-12-03 15:19 - 2011-08-16 20:46 - 00032768 _____ () C:\Windows\jmesoft\Service.exe
2013-12-03 15:31 - 2013-05-14 19:53 - 00390632 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2013-12-03 15:19 - 2011-08-16 20:46 - 00024576 _____ () C:\Windows\jmesoft\JME_LOAD.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2013-12-03 15:19 - 2011-05-17 13:27 - 00028672 _____ () C:\Windows\jmesoft\hidhook.dll
2009-12-04 16:59 - 2009-12-04 16:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
2009-12-04 17:04 - 2009-12-04 17:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
2013-12-03 15:18 - 2012-11-29 06:34 - 01199648 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 03530752 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.UI.Xaml\90a4331ab5b5bb3ead23d75d4349a491\Windows.UI.Xaml.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00318464 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.CdnModule\fb2a7acae28e48a3be2947dff5e7ddf2\Arkadium.CdnModule.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 02051584 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Dae4911807#\7489d435538be54ecd0702765266896f\Arkadium.DailyChallengeModule.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00971264 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Wi3ea2618e#\d365c6aa928d57ab15f29976306a7c8c\Arkadium.Win8.PuzzleMode.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00351744 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\UpsellModule\4279f16002a53092370f2115565506f6\UpsellModule.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\f7e726805e56676bd7b8662a3d842b0e\Windows.Foundation.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 01130496 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.App640a3541#\6e37f358bf8363dad51e2333292d61a9\Windows.ApplicationModel.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00960000 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.UI\6c2169e34bfb3814fa44f267572335f6\Windows.UI.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00038400 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Wi82189356#\bca0415f3391cdc00ac8e09b58f54b12\Arkadium.Win8.MediaPlayer.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00122880 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Ap4e5cc921#\5583b251bf3683a562057dc1688d13ff\Arkadium.ApplicationFramework.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00175104 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Acc213f109#\608d3007b8d07473c679cf531bb9b1ee\Arkadium.AchievementsModule.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00264704 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Awd4f12c8f#\028672eb91d96b23e8c1ff58daa180ad\Arkadium.AwardsModule.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00374784 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Le816657bc#\b86d8a53356b1e00b32c8f47a13aa0fb\Arkadium.LeaderboardModule.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00302080 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Wi4bbc307d#\78f0fbf277167043869e4f815073d749\Arkadium.WindowsStoreModule.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00686080 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Ad1735b4ba#\50d7025b9414832ddc555c93d878d7bf\Arkadium.Advertisement.ni.dll
2014-11-25 09:26 - 2014-11-25 09:26 - 00122880 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Xaba8eb3bf#\5e88e521cd840136e9f752221bc87465\Arkadium.Xaml.Toolkit.ni.dll
2014-11-25 09:26 - 2014-11-25 09:26 - 00141312 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.NewsModule\75267553bfe313a7bdb4709cee062f27\Arkadium.NewsModule.ni.dll
2014-11-25 09:26 - 2014-11-25 09:26 - 00215040 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\CustomProgr3d91ab4c#\de434950c2e5136c4f235c5fbcda3ce5\CustomProgressControl.ni.dll
2014-05-08 16:01 - 2014-05-08 16:01 - 00483840 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Microsoft.Xbox\7334cf3cd56e548536e510cce0ed4e14\Microsoft.Xbox.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00770560 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Media\ca5d421f33f051f1b561add6753e4360\Windows.Media.ni.dll
2014-10-27 11:04 - 2014-10-27 11:04 - 00227328 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\CEServices\c1cbabc316caabe260365f723757062f\CEServices.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00808448 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Storage\f0a2c10499402eff632a7a7df0b4afef\Windows.Storage.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00402432 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Security\ade4f25e9d8384f190ede9eb090281cb\Windows.Security.ni.dll
2014-05-08 16:00 - 2014-05-08 16:00 - 00238080 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Gloaae92e31#\a1306b1fdd9c22508f9e5d901fceb4cd\Windows.Globalization.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00797696 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\e1a2f3f274995f1f847c00f962657943\Windows.Networking.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00133120 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.System\7819e306c2c55c42f35a5fa10b93710f\Windows.System.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00197120 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\MicroStudioe45cbf8f#\701c8eca3d3515aed6c0eccdcbc6ffb2\MicroStudios.HouseAdController.ni.dll
2014-11-25 09:25 - 2014-11-25 09:25 - 00337408 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\FlurryWin8SDK\657459d53b3fbf35bb8af108cce8a0d5\FlurryWin8SDK.ni.dll
2014-05-08 15:59 - 2014-05-08 15:59 - 01282048 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Devices\bf5509cf3a0d2e3afbd0c33e9153ecbd\Windows.Devices.ni.dll
2014-05-08 16:00 - 2014-05-08 16:00 - 00304128 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Graphics\4e33edd5ee2ee09f751c0071ba0a26c3\Windows.Graphics.ni.dll
2014-05-08 16:01 - 2014-05-08 16:01 - 00041984 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Microsoft.G42d2c636#\c9c9d32d102cd8eb4ad7d760ede11f62\Microsoft.Games.Sentient.ni.dll
2014-10-27 11:03 - 2014-10-27 11:03 - 00337920 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Data\fe565d34d4335337c06264bb0d85e3b0\Windows.Data.ni.dll
2014-05-08 16:01 - 2014-05-08 16:01 - 00012800 _____ () C:\Users\heiner\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0_32\NativeImages\Arkadium.Sh130cfbe4#\9ef21ae2ff95f96dcc5d7181d3ef82d5\Arkadium.SharpDXEngine.AudioLoader.ni.dll
2014-04-20 10:11 - 2014-04-20 10:11 - 00038912 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe\Arkadium.SharpDXEngine.AudioLoader.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\heiner\OneDrive:ms-properties
AlternateDataStreams: C:\Users\jan\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2302644872-2412186451-4148703486-500 - Administrator - Disabled)
Gast (S-1-5-21-2302644872-2412186451-4148703486-501 - Limited - Disabled)
heiner (S-1-5-21-2302644872-2412186451-4148703486-1002 - Administrator - Enabled) => C:\Users\heiner
jan (S-1-5-21-2302644872-2412186451-4148703486-1001 - Administrator - Enabled) => C:\Users\jan
Margit_2 (S-1-5-21-2302644872-2412186451-4148703486-1005 - Administrator - Enabled) => C:\Users\Margit_2
marie-christin (S-1-5-21-2302644872-2412186451-4148703486-1004 - Administrator - Enabled) => C:\Users\marie-christin

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/01/2015 08:44:16 PM) (Source: ESENT) (EventID: 439) (User: )
Description: SearchIndexer (3516) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.chk konnte nicht geschrieben werden. Fehler -1032.

Error: (01/01/2015 08:44:16 PM) (Source: ESENT) (EventID: 490) (User: )
Description: SearchIndexer (3516) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error: (01/01/2015 07:03:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Solitaire.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1050

Startzeit: 01d025ed28eac40a

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe\Solitaire.exe

Berichts-ID: 71d3ff53-91e0-11e4-be91-c03fd506a8a4

Vollständiger Name des fehlerhaften Pakets: Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (01/01/2015 07:03:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: LENOVOBISCHOFF)
Description: Die App „Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe+App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (01/01/2015 06:30:43 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.

Error: (01/01/2015 06:29:25 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Solitaire.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 10f0

Startzeit: 01d025e870c4c9c1

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe\Solitaire.exe

Berichts-ID: b903925e-91db-11e4-be91-c03fd506a8a4

Vollständiger Name des fehlerhaften Pakets: Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (01/01/2015 06:29:20 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: LENOVOBISCHOFF)
Description: Die App „Microsoft.MicrosoftSolitaireCollection_2.5.1411.701_x86__8wekyb3d8bbwe+App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (01/01/2015 05:34:38 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.

Error: (01/01/2015 05:34:35 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.

Error: (01/01/2015 05:22:37 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid(S-1-5-21-2302644872-2412186451-4148703486-1003.bak)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.
.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {1c438abb-0be5-49b9-9685-32f173be9f24}


System errors:
=============
Error: (01/01/2015 08:24:30 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (01/01/2015 07:32:55 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (01/01/2015 07:32:53 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (01/01/2015 07:30:42 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (01/01/2015 07:29:24 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (01/01/2015 05:28:36 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit dem folgenden dienstspezifischen Fehler beendet: 
%%0

Error: (01/01/2015 05:19:22 PM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung vom Remoteendpunkt empfangen. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 20.

Error: (01/01/2015 04:10:19 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (01/01/2015 04:10:19 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (01/01/2015 04:07:36 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-11-30 12:08:58.442
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\abengine64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-30 12:08:58.352
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\abengine64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-30 12:08:58.243
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\abengine64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-30 12:08:58.128
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\abengine64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 20:57:04.115
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 20:57:03.975
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 08:14:45.449
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 08:14:45.347
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 08:14:45.235
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 08:14:45.085
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3240T CPU @ 2.90GHz
Percentage of memory in use: 38%
Total physical RAM: 3991.26 MB
Available physical RAM: 2461.42 MB
Total Pagefile: 8087.26 MB
Available Pagefile: 6143.23 MB
Total Virtual: 131072 MB
Available Virtual: 131071.82 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:904.81 GB) (Free:780.01 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: FC4C6887)

Partition: GPT Partition Type.

==================== End Of Log ============================

--- --- ---

schrauber · 03.01.2015, 15:53

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2302644872-2412186451-4148703486-1002 -> {8BA8B87B-7C77-4818-9924-0351456E7298} URL = 
Tcpip\..\Interfaces\{DD525FD9-ED0B-4239-B1B1-9BF8E3E8F113}: [NameServer] 31.168.224.106,5.135.12.52
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

strowbowse · 03.01.2015, 16:21

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-01-2015
Ran by heiner at 2015-01-03 16:04:03 Run:1
Running from C:\Users\heiner\Desktop
Loaded Profile: heiner (Available profiles: jan & heiner & marie-christin & Margit_2)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2302644872-2412186451-4148703486-1002 -> {8BA8B87B-7C77-4818-9924-0351456E7298} URL = 
Tcpip\..\Interfaces\{DD525FD9-ED0B-4239-B1B1-9BF8E3E8F113}: [NameServer] 31.168.224.106,5.135.12.52
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
Emptytemp:
         
*****************

C:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully.
C:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page => value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8BA8B87B-7C77-4818-9924-0351456E7298}" => Key deleted successfully.
HKCR\CLSID\{8BA8B87B-7C77-4818-9924-0351456E7298} => Key not found. 
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DD525FD9-ED0B-4239-B1B1-9BF8E3E8F113}\\NameServer => value deleted successfully.
CHR dev: Chrome dev build detected! <======= ATTENTION => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
EmptyTemp: => Removed 64.5 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 16:04:18 ====

schrauber · 03.01.2015, 16:23

und weiter im Text

strowbowse · 03.01.2015, 17:13

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=42359ab40957404bbb553215a9293b57
# engine=21770
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-12-31 04:47:34
# local_time=2014-12-31 05:47:34 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 19282 5975139 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 2701403 10348773 0 0
# scanned=277312
# found=63
# cleaned=54
# scan_time=4797
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\Users\jan\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Users\jan\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
sh=25CF9B7BB46B581ED8DE03DDC56E1574087CACAA ft=1 fh=10c5a1651be6049d vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Users\jan\Documents\Downloads\ccsetup326.exe"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\Users\Margit_2\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Users\Margit_2\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
sh=85417D64E9874995D7D55E89A538485D14F686B3 ft=1 fh=0ae2c364fbd4e580 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Margit_2\Downloads\Firefox - CHIP-Installer.exe"
sh=A1E273224C0D44DF1D61AB3AA3ED36E3E3D875F1 ft=1 fh=6a568732e78918c6 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Margit_2\Downloads\Internet Explorer 11 64 Bit - CHIP-Installer.exe"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner" ac=I fn="C:\Users\marie-christin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\Users\marie-christin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Gast\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\heiner\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\heiner\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\heiner\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\heiner\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\heiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\heiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\heiner\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\heiner\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\jan\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\jan\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\jan\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\jan\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\jan\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\jan\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Margit_2\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Margit_2\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Margit_2\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Margit_2\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Margit_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Margit_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Margit_2\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Margit_2\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\marie-christin\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\marie-christin\AppData\Local\Chromatic Browser\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\marie-christin\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\marie-christin\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\marie-christin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\marie-christin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\marie-christin\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js.vir"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\marie-christin\AppData\Local\torch\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js.vir"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\heiner\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\heiner\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=42359ab40957404bbb553215a9293b57
# engine=21779
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-01 06:08:44
# local_time=2015-01-01 07:08:44 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 9287 6066409 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 2796273 10440043 0 0
# scanned=276821
# found=9
# cleaned=9
# scan_time=5594
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\jan\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\jan\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
sh=25CF9B7BB46B581ED8DE03DDC56E1574087CACAA ft=1 fh=10c5a1651be6049d vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\jan\Documents\Downloads\ccsetup326.exe"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Margit_2\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Margit_2\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
sh=85417D64E9874995D7D55E89A538485D14F686B3 ft=1 fh=0ae2c364fbd4e580 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Margit_2\Downloads\Firefox - CHIP-Installer.exe"
sh=A1E273224C0D44DF1D61AB3AA3ED36E3E3D875F1 ft=1 fh=6a568732e78918c6 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Margit_2\Downloads\Internet Explorer 11 64 Bit - CHIP-Installer.exe"
sh=99704F25656AE502BE22F22074262AF21791701A ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\marie-christin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js"
sh=616B1B55C6F4B88037352AA0E313705EAFA56E9B ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\marie-christin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=42359ab40957404bbb553215a9293b57
# engine=21803
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-03 03:59:03
# local_time=2015-01-03 04:59:03 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 15837 6231428 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 2961292 10605062 0 0
# scanned=183255
# found=0
# cleaned=0
# scan_time=2105

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.93  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop      
Windows Defender   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 2.0.3.1025  
 Adobe Reader XI  
 Mozilla Firefox (34.0.5) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 ESET ESET Online Scanner OnlineScannerApp.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-01-2015 02
Ran by heiner (administrator) on LENOVOBISCHOFF on 03-01-2015 17:08:40
Running from C:\Users\heiner\Desktop
Loaded Profile: heiner (Available profiles: jan & heiner & marie-christin & Margit_2)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Windows\jmesoft\Service.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
() C:\Windows\jmesoft\JME_LOAD.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Desktop.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13427784 2013-03-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2013-07-24] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-08-16] ()
HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [95192 2013-03-08] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [Lenovo App Shop] => C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\...\Run: [CCleaner] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\heiner\AppData\Roaming\Mozilla\Firefox\Profiles\oomrh8ty.default
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [164736 2012-11-29] (Intel Corporation)
R2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-08-16] () [File not signed]
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-11-21] (LENOVO INCORPORATED.)
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2013-05-14] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-01] (Malwarebytes Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [71680 2014-04-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-03 17:08 - 2015-01-03 17:08 - 00000000 ____D () C:\Users\heiner\Desktop\FRST-OlderVersion
2015-01-03 17:01 - 2015-01-03 17:03 - 00852505 _____ () C:\Users\heiner\Desktop\SecurityCheck.exe
2015-01-03 14:40 - 2015-01-03 14:40 - 00035180 _____ () C:\Users\heiner\Desktop\Addition.txt
2015-01-03 14:39 - 2015-01-03 17:08 - 00009500 _____ () C:\Users\heiner\Desktop\FRST.txt
2015-01-03 14:38 - 2015-01-03 17:08 - 02123776 _____ (Farbar) C:\Users\heiner\Desktop\FRST64.exe
2015-01-01 17:40 - 2015-01-01 17:40 - 00000000 ____D () C:\Users\heiner\AppData\Roaming\Mozilla
2015-01-01 17:40 - 2015-01-01 17:40 - 00000000 ____D () C:\Users\heiner\AppData\Local\Mozilla
2015-01-01 17:39 - 2015-01-01 17:39 - 00012872 _____ (SurfRight B.V.) C:\WINDOWS\system32\bootdelete.exe
2015-01-01 17:31 - 2015-01-01 17:39 - 00043664 _____ () C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2015-01-01 17:23 - 2015-01-01 17:23 - 00001872 _____ () C:\WINDOWS\system32\.crusader
2015-01-01 16:03 - 2015-01-01 17:23 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-01-01 16:02 - 2015-01-01 16:03 - 11222744 _____ (SurfRight B.V.) C:\Users\heiner\Downloads\hitmanpro_x64.exe
2015-01-01 15:55 - 2015-01-03 17:08 - 00000000 ____D () C:\FRST
2015-01-01 15:27 - 2015-01-01 15:31 - 00000000 ____D () C:\WINDOWS\Minidump
2015-01-01 14:03 - 2015-01-01 14:03 - 01707939 _____ (Thisisu) C:\Users\heiner\Downloads\JRT.exe
2015-01-01 14:00 - 2015-01-01 14:00 - 05198336 _____ (AVAST Software) C:\Users\heiner\Downloads\aswmbr.exe
2015-01-01 13:54 - 2015-01-01 13:54 - 00001752 _____ () C:\sc-cleaner.txt
2015-01-01 13:50 - 2015-01-01 13:50 - 02347384 _____ (ESET) C:\Users\heiner\Downloads\esetsmartinstaller_deu.exe
2014-12-31 16:29 - 2013-08-22 14:25 - 00000824 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.20141231-162939.backup
2014-12-31 16:27 - 2013-08-22 14:25 - 00000824 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.20141231-162754.backup
2014-12-31 16:25 - 2014-12-31 16:25 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\LavasoftStatistics
2014-12-31 16:18 - 2015-01-01 15:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-31 16:18 - 2014-12-31 16:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-12-31 16:18 - 2014-12-31 16:18 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2014-12-31 16:05 - 2014-12-31 16:05 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-12-31 15:08 - 2014-12-31 15:08 - 00000000 ___HD () C:\Lenovo
2014-12-31 14:51 - 2014-12-31 14:51 - 00001465 _____ () C:\Users\jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-31 14:32 - 2014-12-31 14:32 - 00001465 _____ () C:\Users\Margit_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00001186 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00001174 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-31 14:06 - 2014-12-31 14:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-31 14:04 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\WINDOWS\SysWOW64\dhRichClient3.dll
2014-12-31 14:04 - 2011-03-25 19:42 - 00338432 _____ () C:\WINDOWS\SysWOW64\sqlite36_engine.dll
2014-12-31 14:01 - 2014-12-31 14:02 - 29677544 _____ (Mozilla) C:\Users\Margit_2\Downloads\Firefox Setup 30.0.exe
2014-12-31 13:58 - 2014-12-31 13:58 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Mozilla
2014-12-31 13:58 - 2014-12-31 13:58 - 00000000 ____D () C:\ProgramData\Mozilla
2014-12-31 13:55 - 2014-12-31 13:55 - 00244104 _____ () C:\Users\Margit_2\Downloads\Firefox Setup Stub 34.0.5.exe
2014-12-31 12:29 - 2015-01-01 13:52 - 00000000 ____D () C:\AdwCleaner
2014-12-31 12:26 - 2014-12-31 12:28 - 02173952 _____ () C:\Users\jan\Downloads\adwcleaner_4_106.exe
2014-12-30 20:17 - 2014-12-30 20:17 - 00000000 _____ () C:\Recovery.txt
2014-12-30 18:00 - 2014-12-30 18:02 - 00000000 __SHD () C:\Users\jan\AppData\Local\EmieBrowserModeList
2014-12-30 17:44 - 2014-12-30 17:45 - 00002477 _____ () C:\RHDSetup.log
2014-12-28 11:56 - 2014-12-28 11:56 - 00000000 ____D () C:\Users\jan\AppData\Roaming\Avira
2014-12-25 18:20 - 2014-12-25 18:20 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2014-12-16 10:25 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-16 10:25 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-15 10:44 - 2014-12-15 10:44 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 07:51 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 07:51 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 07:51 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 07:51 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 07:50 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 07:50 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 07:50 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 07:49 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 07:49 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 07:49 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 07:49 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 07:49 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 07:49 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 07:49 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 07:49 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 07:49 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 07:49 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 07:49 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 07:49 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 07:49 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 07:49 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 07:49 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 07:49 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 07:49 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 07:49 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 07:49 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 07:49 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 07:49 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 07:49 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 07:49 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 07:49 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 07:49 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 07:49 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 07:49 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 07:49 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 07:49 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 07:49 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 07:49 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 07:49 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 07:49 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 07:49 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 07:49 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 07:49 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 07:49 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 07:49 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 07:49 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 07:49 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 07:49 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 07:49 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-06 17:01 - 2014-12-13 12:22 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-06 17:01 - 2014-12-06 17:01 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-03 17:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-03 16:36 - 2014-11-29 17:24 - 01600228 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-03 16:21 - 2014-04-20 04:34 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1002
2015-01-03 16:13 - 2014-11-22 14:06 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2015-01-03 16:12 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-03 16:04 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2015-01-03 16:04 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-03 13:34 - 2014-04-20 15:32 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{1011892B-1536-4D62-9EAC-6140A32AC69E}
2015-01-03 13:32 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-01 17:24 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\heiner
2015-01-01 16:04 - 2014-11-26 22:09 - 00000000 ____D () C:\Users\Margit_2
2015-01-01 16:04 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\marie-christin
2015-01-01 16:04 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\jan
2015-01-01 13:58 - 2014-11-26 20:44 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-31 18:15 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-31 17:54 - 2014-11-26 22:26 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1005
2014-12-31 15:10 - 2013-12-03 15:28 - 00000000 ____D () C:\ProgramData\Temp
2014-12-31 15:10 - 2013-12-03 15:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-31 15:04 - 2014-11-26 22:17 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Packages
2014-12-31 15:03 - 2014-11-30 11:40 - 00003966 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2D4D6AD2-5955-4779-903D-711A48E2EEA1}
2014-12-31 14:47 - 2013-12-03 15:21 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo
2014-12-31 14:40 - 2014-04-19 21:23 - 00002774 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-12-31 14:40 - 2014-04-19 21:23 - 00000845 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-12-31 14:40 - 2014-04-19 21:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-31 14:40 - 2014-04-19 21:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-31 13:58 - 2014-11-30 12:05 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\Mozilla
2014-12-31 12:49 - 2014-04-20 04:09 - 00003946 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{C435D8AC-EDFA-435A-8C09-BEFA58E95F75}
2014-12-31 12:47 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-31 12:31 - 2014-04-19 21:13 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1001
2014-12-31 12:31 - 2013-12-03 15:28 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-12-30 20:31 - 2014-03-18 11:03 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-30 20:31 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-30 20:31 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-30 19:37 - 2014-11-26 20:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-30 19:37 - 2014-11-26 20:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-30 19:37 - 2014-04-20 00:15 - 00000000 ____D () C:\WINDOWS\SysWOW64\RTCOM
2014-12-30 19:37 - 2013-12-03 15:18 - 00000000 ____D () C:\WINDOWS\SysWOW64\sda
2014-12-30 19:30 - 2014-04-19 17:38 - 00000000 ____D () C:\Users\jan\AppData\Local\Packages
2014-12-30 19:30 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\registration
2014-12-30 19:29 - 2013-12-03 15:18 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-12-30 17:45 - 2013-12-03 15:18 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-12-28 11:54 - 2014-04-19 17:39 - 00000000 ____D () C:\Users\jan\AppData\Local\Lenovo
2014-12-27 18:17 - 2014-10-26 14:21 - 00000000 ____D () C:\Users\heiner\Desktop\Bilder
2014-12-17 10:20 - 2014-06-23 16:18 - 00000000 ____D () C:\Users\heiner\Desktop\Privat
2014-12-15 10:44 - 2014-07-09 15:09 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-15 10:30 - 2014-04-19 21:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-15 10:29 - 2014-04-19 20:28 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 10:27 - 2014-04-19 20:28 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-14 15:20 - 2014-09-20 12:52 - 00000000 ____D () C:\Users\heiner\AppData\Local\Adobe
2014-12-14 15:20 - 2014-04-20 04:28 - 00000000 ____D () C:\Users\heiner\AppData\Roaming\Adobe
2014-12-11 14:19 - 2014-11-30 12:05 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-11 14:19 - 2014-11-30 12:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-11 14:19 - 2014-11-30 12:05 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-11 14:19 - 2014-11-30 12:04 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-06 17:04 - 2013-12-03 15:34 - 00000000 ____D () C:\ProgramData\Adobe
2014-12-06 17:03 - 2014-11-26 22:18 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\Adobe
2014-12-06 17:03 - 2014-11-26 22:17 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Adobe
2014-12-06 17:01 - 2013-12-03 15:34 - 00000000 ____D () C:\Program Files (x86)\Adobe

Some content of TEMP:
====================
C:\Users\heiner\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-28 12:03

==================== End Of Log ============================

--- --- ---

Sieht aus, als sei das Problem behoben! Vielen, vielen Dank. Da ich selbst ITler bin, hat es mich schon sehr gefuchst, dass ich es nicht selbst lösen konnte. Wie genau hast du den Schädling denn gefunden?

schrauber · 03.01.2015, 18:01

Naja, Logs lesen und auswerten

Ist ne richtige Ausbildung.

Hast Du chrome gemacht? Auch nochmal neu installiert?

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\jan\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js

C:\Users\jan\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js

C:\Users\jan\Documents\Downloads\ccsetup326.exe

C:\Users\Margit_2\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js

C:\Users\Margit_2\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js

C:\Users\Margit_2\Downloads\Firefox - CHIP-Installer.exe

C:\Users\Margit_2\Downloads\Internet Explorer 11 64 Bit - CHIP-Installer.exe

C:\Users\marie-christin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js

C:\Users\marie-christin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js

C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js

C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js

C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js

C:\Users\Gast\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js

C:\Users\heiner\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\content.js

C:\Users\heiner\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\jbofkfeapbcncagpddhlcdfdkheadjoc\5.2\ey8xShtPAo.js
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

strowbowse · 04.01.2015, 09:22

Naja, ich werte beruflich zum Teil auch logfiles aus ;-) Naja, anderes Umfeld.

Chrome war auf dem Rechner nie drauf...

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-01-2015 03
Ran by heiner at 2015-01-03 19:46:06
Running from C:\Users\heiner\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4107 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dependency Package Update (Version: 1.6.25.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.32.00 - Lenovo Inc.) Hidden
Dependency Package Update (x32 Version: 1.6.32.00 - Lenovo Group Limited) Hidden
Driver & Application Installation (HKLM-x32\...\{BFECCF2A-F094-4066-8BFA-29CCBB7F6602}) (Version: 6.13.0621 - Lenovo)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.20.1337 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3958 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Lenovo App Shop (HKLM-x32\...\Lenovo App Shop 45246) (Version: 3.10.0.45246.24 - Lenovo)
Lenovo Assistant (HKLM-x32\...\{B2DE4F30-B8C7-49C0-85B9-2F37A5290F00}) (Version: 2.0.0.29 - Lenovo)
Lenovo Blacksilk USB Keyboard Driver (HKLM-x32\...\{B266E062-D6C5-485B-B426-51B152B041A6}) (Version: V1.6.13.0724 - Lenovo)
Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.32.00 - Lenovo Group Limited)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.3.0 - Lenovo)
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: 4.8.7 - CEWE COLOR AG u Co. OHG)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.7408 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.7408 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5108.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5108.52 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.1511 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.1511 - CyberLink Corp.) Hidden
Lenovo Solution Center (HKLM\...\{4041B18B-DE30-4D78-9D60-6ADC586C5E00}) (Version: 2.1.003.00 - Lenovo Group Limited)
LVT (HKLM-x32\...\{9E3469A6-443A-452C-BF44-8D7CE3A9A7E2}) (Version: 5.00.0914 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Standard 2007 (HKLM-x32\...\STANDARDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
Nitro Pro 8 (HKLM\...\{84DAF9F1-513C-49F8-89D2-63CB3F4A7E39}) (Version: 8.5.7.1 - Nitro)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.18.621.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6864 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.27614 - TeamViewer)
TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_STANDARDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_STANDARDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_STANDARDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_STANDARDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
WEB.DE Desktop Icons (HKLM-x32\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.5.0 - 1&1 Mail & Media GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {099A4572-C95F-49EF-A135-BAF25B52C2C1} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-03-13] (Lenovo)
Task: {168DC684-D0EB-46FE-AA92-EC1CC9725058} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2014-11-21] ()
Task: {1A7E7359-CAFA-47AF-878E-E723191272C2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {34D71863-073E-42E0-8940-9026505CBCCB} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-15] (Microsoft Corporation)
Task: {45E4B7E7-41CF-45DB-8024-EEAF19F30236} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {62D49B3C-82D8-49EB-B428-2B7E53A9D1C5} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)
Task: {A3A9A15A-C340-4D20-A1C2-7619BB0609AD} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {D9309FA3-BA97-4609-8729-A592353E4443} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-05-17] ()

==================== Loaded Modules (whitelisted) =============

2013-12-03 15:19 - 2011-08-16 20:46 - 00032768 _____ () C:\Windows\jmesoft\Service.exe
2013-12-03 15:31 - 2013-05-14 19:53 - 00390632 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2010-07-15 05:44 - 2010-07-15 05:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2014-11-25 12:37 - 2014-11-25 12:37 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\ErrorReporting.dll
2013-12-03 15:19 - 2011-08-16 20:46 - 00024576 _____ () C:\Windows\jmesoft\JME_LOAD.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2013-12-03 15:18 - 2012-11-29 06:34 - 01199648 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-12-03 15:19 - 2011-05-17 13:27 - 00028672 _____ () C:\Windows\jmesoft\hidhook.dll
2009-12-04 16:59 - 2009-12-04 16:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
2009-12-04 17:04 - 2009-12-04 17:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\heiner\OneDrive:ms-properties
AlternateDataStreams: C:\Users\jan\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2302644872-2412186451-4148703486-500 - Administrator - Disabled)
Gast (S-1-5-21-2302644872-2412186451-4148703486-501 - Limited - Disabled)
heiner (S-1-5-21-2302644872-2412186451-4148703486-1002 - Administrator - Enabled) => C:\Users\heiner
jan (S-1-5-21-2302644872-2412186451-4148703486-1001 - Administrator - Enabled) => C:\Users\jan
Margit_2 (S-1-5-21-2302644872-2412186451-4148703486-1005 - Administrator - Enabled) => C:\Users\Margit_2
marie-christin (S-1-5-21-2302644872-2412186451-4148703486-1004 - Administrator - Enabled) => C:\Users\marie-christin

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/03/2015 06:13:54 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid(S-1-5-21-2302644872-2412186451-4148703486-1003.bak)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.
.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {bf698b31-3ebf-489d-afc0-d0062104b4f0}

Error: (01/03/2015 06:13:54 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {0c737ab9-4669-4092-b36e-393d5e8d3319}

Error: (01/03/2015 06:13:31 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid(S-1-5-21-2302644872-2412186451-4148703486-1003.bak)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.
.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {bf698b31-3ebf-489d-afc0-d0062104b4f0}

Error: (01/03/2015 06:13:31 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {0c737ab9-4669-4092-b36e-393d5e8d3319}

Error: (01/03/2015 05:15:22 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid(S-1-5-21-2302644872-2412186451-4148703486-1003.bak)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.
.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {4358ea10-f44f-4083-b760-e4cd284701f3}

Error: (01/03/2015 05:15:22 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {0c737ab9-4669-4092-b36e-393d5e8d3319}

Error: (01/03/2015 05:00:09 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.

Error: (01/03/2015 04:21:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.

Error: (01/03/2015 04:21:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.

Error: (01/01/2015 08:44:16 PM) (Source: ESENT) (EventID: 439) (User: )
Description: SearchIndexer (3516) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.chk konnte nicht geschrieben werden. Fehler -1032.


System errors:
=============
Error: (01/03/2015 06:37:50 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (01/03/2015 06:37:50 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (01/03/2015 06:37:50 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (01/03/2015 04:04:47 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (01/03/2015 04:04:47 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (01/03/2015 04:04:47 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (01/01/2015 08:24:30 PM) (Source: DCOM) (EventID: 10010) (User: LENOVOBISCHOFF)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (01/01/2015 07:32:55 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (01/01/2015 07:32:53 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (01/01/2015 07:30:42 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-11-30 12:08:58.442
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\abengine64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-30 12:08:58.352
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\abengine64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-30 12:08:58.243
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\abengine64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-30 12:08:58.128
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\abengine64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 20:57:04.115
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 20:57:03.975
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 08:14:45.449
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 08:14:45.347
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 08:14:45.235
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-26 08:14:45.085
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3240T CPU @ 2.90GHz
Percentage of memory in use: 28%
Total physical RAM: 3991.26 MB
Available physical RAM: 2845.89 MB
Total Pagefile: 8087.26 MB
Available Pagefile: 6426.07 MB
Total Virtual: 131072 MB
Available Virtual: 131071.82 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:904.81 GB) (Free:836.1 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: FC4C6887)

Partition: GPT Partition Type.

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-01-2015 03
Ran by heiner (administrator) on LENOVOBISCHOFF on 03-01-2015 19:45:07
Running from C:\Users\heiner\Desktop
Loaded Profile: heiner (Available profiles: jan & heiner & marie-christin & Margit_2)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Windows\jmesoft\Service.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
() C:\Windows\jmesoft\JME_LOAD.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Desktop.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13427784 2013-03-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2013-07-24] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-08-16] ()
HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [95192 2013-03-08] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [Lenovo App Shop] => C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\...\Run: [CCleaner] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2302644872-2412186451-4148703486-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\heiner\AppData\Roaming\Mozilla\Firefox\Profiles\oomrh8ty.default
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [164736 2012-11-29] (Intel Corporation)
R2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-08-16] () [File not signed]
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-11-21] (LENOVO INCORPORATED.)
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2013-05-14] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-01] (Malwarebytes Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [71680 2014-04-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-03 19:45 - 2015-01-03 19:45 - 00009638 _____ () C:\Users\heiner\Desktop\FRST.txt
2015-01-03 18:30 - 2015-01-03 18:30 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-03 18:27 - 2015-01-03 18:32 - 02123776 _____ (Farbar) C:\Users\heiner\Desktop\FRST64.exe
2015-01-01 17:40 - 2015-01-01 17:40 - 00000000 ____D () C:\Users\heiner\AppData\Roaming\Mozilla
2015-01-01 17:40 - 2015-01-01 17:40 - 00000000 ____D () C:\Users\heiner\AppData\Local\Mozilla
2015-01-01 17:39 - 2015-01-01 17:39 - 00012872 _____ (SurfRight B.V.) C:\WINDOWS\system32\bootdelete.exe
2015-01-01 17:31 - 2015-01-01 17:39 - 00043664 _____ () C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2015-01-01 17:23 - 2015-01-01 17:23 - 00001872 _____ () C:\WINDOWS\system32\.crusader
2015-01-01 16:03 - 2015-01-01 17:23 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-01-01 16:02 - 2015-01-01 16:03 - 11222744 _____ (SurfRight B.V.) C:\Users\heiner\Downloads\hitmanpro_x64.exe
2015-01-01 15:55 - 2015-01-03 19:45 - 00000000 ____D () C:\FRST
2015-01-01 15:27 - 2015-01-01 15:31 - 00000000 ____D () C:\WINDOWS\Minidump
2015-01-01 14:03 - 2015-01-01 14:03 - 01707939 _____ (Thisisu) C:\Users\heiner\Downloads\JRT.exe
2015-01-01 14:00 - 2015-01-01 14:00 - 05198336 _____ (AVAST Software) C:\Users\heiner\Downloads\aswmbr.exe
2015-01-01 13:54 - 2015-01-01 13:54 - 00001752 _____ () C:\sc-cleaner.txt
2015-01-01 13:50 - 2015-01-01 13:50 - 02347384 _____ (ESET) C:\Users\heiner\Downloads\esetsmartinstaller_deu.exe
2014-12-31 16:29 - 2013-08-22 14:25 - 00000824 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.20141231-162939.backup
2014-12-31 16:27 - 2013-08-22 14:25 - 00000824 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.20141231-162754.backup
2014-12-31 16:25 - 2014-12-31 16:25 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\LavasoftStatistics
2014-12-31 16:18 - 2015-01-01 15:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-31 16:18 - 2014-12-31 16:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-12-31 16:18 - 2014-12-31 16:18 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2014-12-31 16:05 - 2014-12-31 16:05 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-12-31 15:08 - 2014-12-31 15:08 - 00000000 ___HD () C:\Lenovo
2014-12-31 14:51 - 2014-12-31 14:51 - 00001465 _____ () C:\Users\jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-31 14:32 - 2014-12-31 14:32 - 00001465 _____ () C:\Users\Margit_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00001186 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00001174 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-12-31 14:06 - 2014-12-31 14:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-31 14:06 - 2014-12-31 14:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-31 14:04 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\WINDOWS\SysWOW64\dhRichClient3.dll
2014-12-31 14:04 - 2011-03-25 19:42 - 00338432 _____ () C:\WINDOWS\SysWOW64\sqlite36_engine.dll
2014-12-31 14:01 - 2014-12-31 14:02 - 29677544 _____ (Mozilla) C:\Users\Margit_2\Downloads\Firefox Setup 30.0.exe
2014-12-31 13:58 - 2014-12-31 13:58 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Mozilla
2014-12-31 13:58 - 2014-12-31 13:58 - 00000000 ____D () C:\ProgramData\Mozilla
2014-12-31 13:55 - 2014-12-31 13:55 - 00244104 _____ () C:\Users\Margit_2\Downloads\Firefox Setup Stub 34.0.5.exe
2014-12-31 12:29 - 2015-01-01 13:52 - 00000000 ____D () C:\AdwCleaner
2014-12-31 12:26 - 2014-12-31 12:28 - 02173952 _____ () C:\Users\jan\Downloads\adwcleaner_4_106.exe
2014-12-30 20:17 - 2014-12-30 20:17 - 00000000 _____ () C:\Recovery.txt
2014-12-30 18:00 - 2014-12-30 18:02 - 00000000 __SHD () C:\Users\jan\AppData\Local\EmieBrowserModeList
2014-12-30 17:44 - 2014-12-30 17:45 - 00002477 _____ () C:\RHDSetup.log
2014-12-28 11:56 - 2014-12-28 11:56 - 00000000 ____D () C:\Users\jan\AppData\Roaming\Avira
2014-12-25 18:20 - 2014-12-25 18:20 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2014-12-16 10:25 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-16 10:25 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-15 10:44 - 2014-12-15 10:44 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 07:51 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 07:51 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 07:51 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 07:51 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 07:50 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 07:50 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 07:50 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 07:49 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 07:49 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 07:49 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 07:49 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 07:49 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 07:49 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 07:49 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 07:49 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 07:49 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 07:49 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 07:49 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 07:49 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 07:49 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 07:49 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 07:49 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 07:49 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 07:49 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 07:49 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 07:49 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 07:49 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 07:49 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 07:49 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 07:49 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 07:49 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 07:49 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 07:49 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 07:49 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 07:49 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 07:49 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 07:49 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 07:49 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 07:49 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 07:49 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 07:49 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 07:49 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 07:49 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 07:49 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 07:49 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 07:49 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 07:49 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 07:49 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 07:49 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 07:49 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-06 17:01 - 2014-12-13 12:22 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-06 17:01 - 2014-12-06 17:01 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-03 19:04 - 2014-11-29 17:24 - 01640918 ____N () C:\WINDOWS\WindowsUpdate.log
2015-01-03 19:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-03 18:58 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-03 18:38 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-03 18:36 - 2014-04-20 04:34 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1002
2015-01-03 18:35 - 2014-11-26 22:17 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Google
2015-01-03 18:35 - 2014-11-22 14:06 - 00000000 ____D () C:\Users\jan\AppData\Local\Google
2015-01-03 18:35 - 2014-11-22 14:06 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2015-01-03 16:13 - 2014-11-22 14:06 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2015-01-03 16:04 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2015-01-03 13:34 - 2014-04-20 15:32 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{1011892B-1536-4D62-9EAC-6140A32AC69E}
2015-01-03 13:32 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-01 17:24 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\heiner
2015-01-01 16:04 - 2014-11-26 22:09 - 00000000 ____D () C:\Users\Margit_2
2015-01-01 16:04 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\marie-christin
2015-01-01 16:04 - 2014-04-20 00:19 - 00000000 ____D () C:\Users\jan
2015-01-01 13:58 - 2014-11-26 20:44 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-31 18:15 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-31 17:54 - 2014-11-26 22:26 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1005
2014-12-31 15:10 - 2013-12-03 15:28 - 00000000 ____D () C:\ProgramData\Temp
2014-12-31 15:10 - 2013-12-03 15:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-31 15:04 - 2014-11-26 22:17 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Packages
2014-12-31 15:03 - 2014-11-30 11:40 - 00003966 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2D4D6AD2-5955-4779-903D-711A48E2EEA1}
2014-12-31 14:47 - 2013-12-03 15:21 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo
2014-12-31 14:40 - 2014-04-19 21:23 - 00002774 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-12-31 14:40 - 2014-04-19 21:23 - 00000845 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-12-31 14:40 - 2014-04-19 21:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-31 14:40 - 2014-04-19 21:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-31 13:58 - 2014-11-30 12:05 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\Mozilla
2014-12-31 12:49 - 2014-04-20 04:09 - 00003946 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{C435D8AC-EDFA-435A-8C09-BEFA58E95F75}
2014-12-31 12:47 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-31 12:31 - 2014-04-19 21:13 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2302644872-2412186451-4148703486-1001
2014-12-31 12:31 - 2013-12-03 15:28 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-12-30 20:31 - 2014-03-18 11:03 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-30 20:31 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-30 20:31 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-30 19:37 - 2014-11-26 20:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-30 19:37 - 2014-11-26 20:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-30 19:37 - 2014-04-20 00:15 - 00000000 ____D () C:\WINDOWS\SysWOW64\RTCOM
2014-12-30 19:37 - 2013-12-03 15:18 - 00000000 ____D () C:\WINDOWS\SysWOW64\sda
2014-12-30 19:30 - 2014-04-19 17:38 - 00000000 ____D () C:\Users\jan\AppData\Local\Packages
2014-12-30 19:30 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\registration
2014-12-30 19:29 - 2013-12-03 15:18 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-12-30 17:45 - 2013-12-03 15:18 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-12-28 11:54 - 2014-04-19 17:39 - 00000000 ____D () C:\Users\jan\AppData\Local\Lenovo
2014-12-27 18:17 - 2014-10-26 14:21 - 00000000 ____D () C:\Users\heiner\Desktop\Bilder
2014-12-17 10:20 - 2014-06-23 16:18 - 00000000 ____D () C:\Users\heiner\Desktop\Privat
2014-12-15 10:44 - 2014-07-09 15:09 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-15 10:44 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-15 10:30 - 2014-04-19 21:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-15 10:29 - 2014-04-19 20:28 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 10:27 - 2014-04-19 20:28 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-14 15:20 - 2014-09-20 12:52 - 00000000 ____D () C:\Users\heiner\AppData\Local\Adobe
2014-12-14 15:20 - 2014-04-20 04:28 - 00000000 ____D () C:\Users\heiner\AppData\Roaming\Adobe
2014-12-11 14:19 - 2014-11-30 12:05 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-11 14:19 - 2014-11-30 12:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-11 14:19 - 2014-11-30 12:05 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-11 14:19 - 2014-11-30 12:04 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-06 17:04 - 2013-12-03 15:34 - 00000000 ____D () C:\ProgramData\Adobe
2014-12-06 17:03 - 2014-11-26 22:18 - 00000000 ____D () C:\Users\Margit_2\AppData\Roaming\Adobe
2014-12-06 17:03 - 2014-11-26 22:17 - 00000000 ____D () C:\Users\Margit_2\AppData\Local\Adobe
2014-12-06 17:01 - 2013-12-03 15:34 - 00000000 ____D () C:\Program Files (x86)\Adobe

Some content of TEMP:
====================
C:\Users\heiner\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-28 12:03

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

[/CODE]

Files hab ich ja gepostet. Was war denn das jetzt eigentlich genau für ne Infektion und ist sie jetzt weg? Seltsam ist echt, dass auf dem Rechner bislang niemand Chrome installiert hatte. Entsprechend gibt es auch keine deinstallationsroutine...
Sieht das Logfile gut aus?

schrauber · 04.01.2015, 11:51

Haste den FRST Fix auch gemacht? Da war jede Menge Adware drauf.

Wenn Du den FRST Fix auch gemacht hast sind wir durch.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

strowbowse · 05.01.2015, 21:45

Danke dir nochmal. Hier kann zu...

schrauber · 06.01.2015, 11:33

Gern Geschehen

03.01.2015, 16:23	#6
schrauber /// the machine /// TB-Ausbilder	Werbung durch youradexchange und stamplive und weiter im Text __________________ --> Werbung durch youradexchange und stamplive

06.01.2015, 11:33	#12
schrauber /// the machine /// TB-Ausbilder	Werbung durch youradexchange und stamplive Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Werbung durch youradexchange und stamplive

Plagegeister aller Art und deren Bekämpfung: Werbung durch youradexchange und stamplive