Hallo habe das Problem das ständig neue Fenster bei mir aufgehen. Habe schon den Adw cleaner und Malwarebytes Anti-Malware durchlaufen lassen, aber die seiten kommen immer wieder kann mir jemand Helfen?



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: browsersupport helper - {B5147546-9359-4D9B-8B36-F54C54555799} - C:\Program Files (x86)\browsersupport\browsersupport.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ECtiClient] "C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe" -autostart
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe" -HideWindow
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [winengine] C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
O4 - HKCU\..\Run: [winengine2] C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
O4 - Startup: OptimizerProInstaller.lnk = C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kollmer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kollmer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = kollmer.local
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: ESTOS Automatic Client Update (EACUSrv) - Unknown owner - C:\windows\system32\EACuSrv.exe (file missing)
O23 - Service: ESTOS Desktop Sharing Services (edsservice) - ESTOS GmbH - C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Trend Micro Security Agent Echtzeitsuche (ntrtscan) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\windows\system32\nvvsvc.exe (file missing)
O23 - Service: PDF Architect Helper Service - pdfforge GbR - C:\Program Files (x86)\PDF Architect\HelperService.exe
O23 - Service: PDF Architect Service - pdfforge GbR - C:\Program Files (x86)\PDF Architect\ConversionService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Trend Micro Common Client Solution Framework (TmCCSF) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
O23 - Service: Trend Micro Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe
O23 - Service: Trend Micro Security Agent NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
(PC Utilities Software Limited) C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe
(Flexera Software, Inc.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\AdExchange\AcBrowserHost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: No Name -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 14:13 - 2015-02-05 14:13 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-05 13:53 - 2015-02-05 13:53 - 00009271 _____ () C:\Users\andreas.chudalla\Desktop\hijackthis.log
2015-02-05 13:05 - 2015-02-05 13:05 - 00000085 _____ () C:\windows\wininit.ini
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:54 - 2015-02-05 12:54 - 05027328 _____ () C:\Users\andreas.chudalla\Desktop\stuttgart.dwg
2015-02-05 12:54 - 2015-02-05 12:54 - 01191200 _____ () C:\Users\andreas.chudalla\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-02-05 12:54 - 2015-02-05 12:54 - 00000213 ____H () C:\Users\andreas.chudalla\Desktop\stuttgart.dwl2
2015-02-05 12:54 - 2015-02-05 12:54 - 00000063 ____H () C:\Users\andreas.chudalla\Desktop\stuttgart.dwl
2015-02-05 12:52 - 2015-02-05 13:49 - 00018492 _____ () C:\windows\WindowsUpdate.log
2015-02-05 12:47 - 2015-02-05 12:47 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(2).exe
2015-02-05 10:16 - 2015-02-05 10:16 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109(1).exe
2015-02-05 10:11 - 2015-02-05 10:11 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109.exe
2015-02-05 09:56 - 2015-02-05 09:56 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(1).exe
2015-02-05 09:50 - 2015-02-05 09:50 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09.exe
2015-02-05 09:47 - 2015-02-05 13:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-02-05 07:49 - 2015-02-05 07:49 - 37968904 _____ (ICQ) C:\Users\andreas.chudalla\Downloads\icq_83rfrset.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-22 14:48 - 2015-01-22 14:48 - 00880784 _____ (Google Inc.) C:\Users\andreas.chudalla\Downloads\ChromeSetup.exe
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-03 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieUserList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieSiteList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Macromedia
2015-01-08 07:57 - 2015-01-08 07:57 - 00003886 _____ () C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-08 07:56 - 2015-01-16 12:10 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp
2015-01-08 07:56 - 2015-01-08 07:56 - 00001425 _____ () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000842 __RSH () C:\Users\Lena.Fraunholz\ntuser.pol
2015-01-08 07:56 - 2015-01-08 07:56 - 00000020 ___SH () C:\Users\Lena.Fraunholz\ntuser.ini
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Vorlagen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Startmenü
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Netzwerkumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Lokale Einstellungen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Eigene Dateien
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Druckumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Musik
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Bilder
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Verlauf
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ___RD () C:\Users\Lena.Fraunholz\Virtual Machines
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Windows Small Business Server
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Small Business Server 2008
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\ESTOS
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Adobe
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\NVIDIA
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\Autodesk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz
2015-01-08 07:56 - 2014-01-15 17:22 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\ESTOS
2015-01-08 07:56 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-08 07:56 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 14:01 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-05 13:39 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 13:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-05 13:16 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-05 13:16 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-05 12:57 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-05 12:57 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-05 12:57 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-05 12:57 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:57 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:51 - 2014-08-18 11:10 - 00983160 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-05 12:51 - 2014-08-18 11:10 - 00543424 _____ () C:\windows\system32\TmInstall.log
2015-02-05 12:51 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-05 12:50 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-05 12:50 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-05 12:50 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-05 12:50 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:35 - 2014-02-11 09:08 - 00035852 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-02 14:07 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-26 09:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-26 09:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-26 09:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-08 07:56 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================

FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2015 01
Ran by andreas.chudalla at 2015-02-05 14:13:45
Running from C:\Users\andreas.chudalla\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TP6WHV59
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Trend Micro Security Agent (Enabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Trend Micro Security Agent Anti-Spyware (Enabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
AutoCAD LT 2013 - Deutsch (German) (HKLM\...\AutoCAD LT 2013 - Deutsch (German)) (Version: 19.0.55.0 - Autodesk)
AutoCAD LT 2013 - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
AutoCAD LT 2013 Language Pack - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.0.84.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.13 - Autodesk)
Autodesk Sync (HKLM\...\{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}) (Version: 3.5.24.0 - Autodesk, Inc.)
browsersupport (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 Version: 5 - ${CompanyName}) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DigiTrakLWD (HKLM-x32\...\{D16E1774-E054-4684-815E-1D7E652327EF}) (Version: 2.012.00.000 - Digital-Control, Inc.)
ESS Energie Indikator (HKLM-x32\...\{6E83470B-5EE2-407D-ABFC-CC87E070ED8C}) (Version: 20.13.0 - Nemetschek Allplan GmbH)
ESTOS ProCall (HKLM-x32\...\{F2D50027-E910-4C2C-AC57-E7D806AAE64E}) (Version: 4.1.10.20036 - ESTOS)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Standard 2010 (HKLM-x32\...\Office14.STANDARD) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft ReportViewer 2010 SP1 Redistributable (KB2549864) (HKLM-x32\...\{1282C0BC-3B22-33D4-B72E-62922415DDCA}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{6BC1F8BE-E812-43FC-B648-90770D1C8F34}) (Version: 6.3a - Silicon Laboratories, Inc.)
Trend Micro Worry-Free Business Security Agent (HKLM\...\Wofie) (Version: 19.0.1240 - Trend Micro Inc.)
Trend Micro Worry-Free Business Security Agent (Version: 9.0 - Trend Micro Inc.) Hidden
Windows Small Business Server 2008 ClientAgent (HKLM\...\{E4FF4DF1-F99C-49AC-B398-BE0887432846}) (Version: 6.0.5601.6 - Microsoft Corporation)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (10/18/2013 6.6.1.0) (HKLM\...\F92C2D6CB4EA0EE558BDF5F8BDD69083DFC62179) (Version: 10/18/2013 6.6.1.0 - Silicon Laboratories)
winengine (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\winengine) (Version: 20.020 - Ad business Crown Solutions)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\de-DE\acadltficn.dll (Autodesk, Inc.)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-05-13 13:31 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {309DDB9E-E5B2-49C4-A862-37419536E206} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-26] (Adobe Systems Incorporated)
Task: {386DF147-2C4A-43F7-BFBA-74BEECE839E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {39CCE3F9-BEB4-4791-85E6-1F7E953517E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {3DBC1268-8B24-4A0D-B3C9-B0D747045405} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {462282DE-B532-47A9-9088-E092C9F7DD9B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {E144FE06-4742-4F39-904C-BCC78CF23486} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {F561A6DF-A3DF-43D0-87F0-D328B86A4C31} - System32\Tasks\sondhschedule => C:\Users\andreas.chudalla\AppData\Roaming\browsersupport\browsersupport-Installer.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2011-08-31 12:55 - 2011-08-31 12:55 - 00801792 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\sqlite3.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\windows\system32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\windows\system32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\windows\system32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\windows\system32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\windows\system32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\windows\system32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\windows\system32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\windows\system32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\windows\system32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\windows\system32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\windows\system32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\windows\system32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\windows\system32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\windows\system32\xi.dll
2009-07-02 15:32 - 2009-07-02 15:32 - 00089088 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\zlibwapi.dll
2012-05-31 09:03 - 2014-02-08 18:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-01-16 09:19 - 2013-01-16 09:19 - 00048128 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_date_time-vc110-mt-1_49.dll
2013-04-02 11:25 - 2013-04-02 11:25 - 00675840 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\sqlite3.dll
2013-01-16 09:23 - 2013-01-16 09:23 - 00058368 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_thread-vc110-mt-1_49.dll
2013-04-17 14:32 - 2010-09-16 15:34 - 00146176 _____ () C:\Windows\System32\xdnorbgnd.exe
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\Windows\System32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\Windows\System32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\Windows\System32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\Windows\System32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\Windows\System32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\Windows\System32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\Windows\System32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\Windows\System32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\Windows\System32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\Windows\System32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\Windows\System32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\Windows\System32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\Windows\System32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\Windows\System32\xi.dll
2014-11-22 01:03 - 2014-11-22 01:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-12-12 13:34 - 2014-12-12 13:34 - 00511416 _____ () C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
2012-02-07 06:10 - 2012-02-07 06:10 - 00755624 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acapp.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00184744 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accloudconnect.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00181672 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acismui.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 01382312 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acvmtools.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00826280 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accmmgr.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00111016 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acparameter.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00973736 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acdim.crx
2011-04-29 20:23 - 2011-04-29 20:23 - 00125376 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axutil.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00385984 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_engine.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00158144 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axiom.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00034752 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_parser.dll
2011-04-29 20:27 - 2011-04-29 20:27 - 01315264 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\libxml2.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00103360 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\neethi.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Control Panel\Desktop\\Wallpaper -> C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

admin (S-1-5-21-3572959257-616895921-2767358109-1001 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-3572959257-616895921-2767358109-500 - Administrator - Disabled)
Gast (S-1-5-21-3572959257-616895921-2767358109-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.


Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (02/05/2015 00:43:57 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows (4412) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00074.log.


System errors:
=============
Error: (02/05/2015 01:43:59 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:43:59 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:43:59 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:35:03 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:35:02 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 01:35:02 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/05/2015 00:44:27 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (02/05/2015 00:43:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/05/2015 00:43:57 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (02/05/2015 09:52:50 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "FLEXnet Licensing Service 64" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
4700

Error: (02/05/2015 00:43:57 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: 
Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (02/05/2015 00:43:57 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows4412Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00074.log-1811


CodeIntegrity Errors:
===================================
  Date: 2014-05-13 14:30:37.730
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-13 14:30:37.714
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 35%
Total physical RAM: 8154.33 MB
Available physical RAM: 5251.36 MB
Total Pagefile: 16306.84 MB
Available Pagefile: 13381.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:55.8 GB) (Free:8.99 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Fixed) (Total:465.76 GB) (Free:292.87 GB) NTFS
Drive g: (kollmerdaten) (Network) (Total:557.75 GB) (Free:241.45 GB) NTFS
Drive r: (Daten) (Network) (Total:309.4 GB) (Free:203.6 GB) NTFS
Drive u: (Daten) (Network) (Total:309.4 GB) (Free:203.6 GB) NTFS
Drive y: () (Network) (Total:400.19 GB) (Free:180.18 GB) 

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: E3B0152C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=55.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 495EDE2A)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
(PC Utilities Software Limited) C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe
(Flexera Software, Inc.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\AdExchange\AcBrowserHost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: No Name -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 14:13 - 2015-02-05 14:13 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\  Malwarebytes Anti-Malware  .lnk
2015-02-05 13:53 - 2015-02-05 13:53 - 00009271 _____ () C:\Users\andreas.chudalla\Desktop\hijackthis.log
2015-02-05 13:05 - 2015-02-05 13:05 - 00000085 _____ () C:\windows\wininit.ini
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:54 - 2015-02-05 12:54 - 05027328 _____ () C:\Users\andreas.chudalla\Desktop\stuttgart.dwg
2015-02-05 12:54 - 2015-02-05 12:54 - 01191200 _____ () C:\Users\andreas.chudalla\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-02-05 12:54 - 2015-02-05 12:54 - 00000213 ____H () C:\Users\andreas.chudalla\Desktop\stuttgart.dwl2
2015-02-05 12:54 - 2015-02-05 12:54 - 00000063 ____H () C:\Users\andreas.chudalla\Desktop\stuttgart.dwl
2015-02-05 12:52 - 2015-02-05 13:49 - 00018492 _____ () C:\windows\WindowsUpdate.log
2015-02-05 12:47 - 2015-02-05 12:47 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(2).exe
2015-02-05 10:16 - 2015-02-05 10:16 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109(1).exe
2015-02-05 10:11 - 2015-02-05 10:11 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109.exe
2015-02-05 09:56 - 2015-02-05 09:56 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(1).exe
2015-02-05 09:50 - 2015-02-05 09:50 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09.exe
2015-02-05 09:47 - 2015-02-05 13:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-02-05 07:49 - 2015-02-05 07:49 - 37968904 _____ (ICQ) C:\Users\andreas.chudalla\Downloads\icq_83rfrset.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-22 14:48 - 2015-01-22 14:48 - 00880784 _____ (Google Inc.) C:\Users\andreas.chudalla\Downloads\ChromeSetup.exe
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-03 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieUserList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieSiteList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Macromedia
2015-01-08 07:57 - 2015-01-08 07:57 - 00003886 _____ () C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-08 07:56 - 2015-01-16 12:10 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp
2015-01-08 07:56 - 2015-01-08 07:56 - 00001425 _____ () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000842 __RSH () C:\Users\Lena.Fraunholz\ntuser.pol
2015-01-08 07:56 - 2015-01-08 07:56 - 00000020 ___SH () C:\Users\Lena.Fraunholz\ntuser.ini
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Vorlagen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Startmenü
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Netzwerkumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Lokale Einstellungen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Eigene Dateien
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Druckumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Musik
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Bilder
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Verlauf
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ___RD () C:\Users\Lena.Fraunholz\Virtual Machines
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Windows Small Business Server
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Small Business Server 2008
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\ESTOS
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Adobe
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\NVIDIA
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\Autodesk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz
2015-01-08 07:56 - 2014-01-15 17:22 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\ESTOS
2015-01-08 07:56 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-08 07:56 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 14:01 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-05 13:39 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 13:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-05 13:16 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-05 13:16 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-05 12:57 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-05 12:57 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-05 12:57 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-05 12:57 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:57 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-05 12:51 - 2014-08-18 11:10 - 00983160 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-05 12:51 - 2014-08-18 11:10 - 00543424 _____ () C:\windows\system32\TmInstall.log
2015-02-05 12:51 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-05 12:50 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-05 12:50 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-05 12:50 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-05 12:50 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:35 - 2014-02-11 09:08 - 00035852 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\  Malwarebytes Anti-Malware  
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\  Malwarebytes Anti-Malware  
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-02 14:07 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-26 09:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-26 09:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-26 09:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-08 07:56 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================
         

FRST.txt bitte nochmal, ist unvollständig und teilweise nicht in Codetags.

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2015
Ran by andreas.chudalla (administrator) on PC-0406 on 06-02-2015 07:31:10
Running from C:\Users\andreas.chudalla\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8U1QR2MI
Loaded Profiles: andreas.chudalla (Available profiles: angela.hinse & michael.meisel & ulrich.scherer & mimi.hafner & manuel.hoeller & markus.kleber & andrea.hafner & Lena.Fraunholz & andreas.chudalla & andreas.regner & administrator & admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
(PC Utilities Software Limited) C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: No Name -> {3A2D5EBA-F86D-4BD3-A177-019765996711} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-05] (Malwarebytes Corporation)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-06 07:22 - 2015-02-06 07:22 - 00482080 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-06 07:22 - 2015-02-06 07:22 - 00003232 _____ () C:\windows\PFRO.log
2015-02-06 07:22 - 2015-02-06 07:22 - 00000168 _____ () C:\windows\setupact.log
2015-02-06 07:22 - 2015-02-06 07:22 - 00000000 _____ () C:\windows\setuperr.log
2015-02-05 14:13 - 2015-02-06 07:31 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-05 13:05 - 2015-02-05 13:05 - 00000085 _____ () C:\windows\wininit.ini
2015-02-05 12:55 - 2015-02-06 07:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:54 - 2015-02-05 16:37 - 05187233 _____ () C:\Users\andreas.chudalla\Desktop\stuttgart.dwg
2015-02-05 12:54 - 2015-02-05 12:54 - 01191200 _____ () C:\Users\andreas.chudalla\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-02-05 12:52 - 2015-02-06 07:25 - 00064903 _____ () C:\windows\WindowsUpdate.log
2015-02-05 12:47 - 2015-02-05 12:47 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(2).exe
2015-02-05 10:16 - 2015-02-05 10:16 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109(1).exe
2015-02-05 10:11 - 2015-02-05 10:11 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109.exe
2015-02-05 09:56 - 2015-02-05 09:56 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(1).exe
2015-02-05 09:50 - 2015-02-05 09:50 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09.exe
2015-02-05 09:47 - 2015-02-05 13:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-02-05 07:49 - 2015-02-05 07:49 - 37968904 _____ (ICQ) C:\Users\andreas.chudalla\Downloads\icq_83rfrset.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-22 14:48 - 2015-01-22 14:48 - 00880784 _____ (Google Inc.) C:\Users\andreas.chudalla\Downloads\ChromeSetup.exe
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-03 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieUserList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 __SHD () C:\Users\Lena.Fraunholz\AppData\Local\EmieSiteList
2015-01-09 09:01 - 2015-01-09 09:01 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Macromedia
2015-01-08 07:57 - 2015-01-08 07:57 - 00003886 _____ () C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-08 07:56 - 2015-01-16 12:10 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp
2015-01-08 07:56 - 2015-01-08 07:56 - 00001425 _____ () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000842 __RSH () C:\Users\Lena.Fraunholz\ntuser.pol
2015-01-08 07:56 - 2015-01-08 07:56 - 00000020 ___SH () C:\Users\Lena.Fraunholz\ntuser.ini
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Vorlagen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Startmenü
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Netzwerkumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Lokale Einstellungen
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Eigene Dateien
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Druckumgebung
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Musik
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Documents\Eigene Bilder
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Verlauf
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\AppData\Local\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 _SHDL () C:\Users\Lena.Fraunholz\Anwendungsdaten
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ___RD () C:\Users\Lena.Fraunholz\Virtual Machines
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Windows Small Business Server
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Small Business Server 2008
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\ESTOS
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Roaming\Adobe
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\NVIDIA
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\Autodesk
2015-01-08 07:56 - 2015-01-08 07:56 - 00000000 ____D () C:\Users\Lena.Fraunholz
2015-01-08 07:56 - 2014-01-15 17:22 - 00000000 ____D () C:\Users\Lena.Fraunholz\AppData\Local\ESTOS
2015-01-08 07:56 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-08 07:56 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Lena.Fraunholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-06 07:29 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-06 07:29 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-06 07:28 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-06 07:28 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-06 07:26 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-06 07:26 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-06 07:26 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-06 07:23 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-06 07:22 - 2014-08-18 11:10 - 00987488 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-06 07:22 - 2014-08-18 11:10 - 00545860 _____ () C:\windows\system32\TmInstall.log
2015-02-06 07:22 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-06 07:22 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-06 07:22 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-05 16:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-05 16:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 16:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 16:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 16:05 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 16:05 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-05 14:57 - 2014-02-11 09:08 - 00036116 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-05 12:50 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-02 14:07 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-08 07:56 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================
         

--- --- ---

--- --- ---

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ComboFix 15-02-02.01 - andreas.chudalla 06.02.2015  12:21:31.2.8 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8154.6256 [GMT 1:00]
ausgeführt von:: c:\users\andreas.chudalla\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TP6WHV59\ComboFix.exe
AV: Trend Micro Security Agent *Enabled/Updated* {5D349EF8-873B-C657-917F-F1D93E101A7C}
SP: Trend Micro Security Agent Anti-Spyware *Enabled/Updated* {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-01-06 bis 2015-02-06  ))))))))))))))))))))))))))))))
.
.
2015-02-05 13:13 . 2015-02-06 06:32	--------	d-----w-	C:\FRST
2015-02-05 11:55 . 2015-02-05 12:05	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2015-02-05 11:55 . 2015-02-06 06:22	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy 2
2015-02-05 07:16 . 2015-02-05 07:16	--------	d-----w-	c:\program files (x86)\browsersupport
2015-02-05 07:05 . 2015-02-05 07:05	--------	d-----w-	C:\shoplog
2015-02-05 06:58 . 2015-02-05 06:58	--------	d-----w-	c:\users\andreas.chudalla\AppData\Local\winengine
2015-02-05 06:55 . 2015-02-05 06:56	--------	d-----w-	c:\program files (x86)\Opera
2015-02-05 06:55 . 2015-02-05 07:02	--------	d-----w-	c:\programdata\BlueStacksSetup
2015-02-05 06:55 . 2015-02-05 07:00	25136	----a-w-	c:\windows\DCEBoot64.exe
2015-02-05 06:55 . 2015-02-05 06:55	240176	----a-w-	c:\windows\RegBootClean64.exe
2015-02-05 06:55 . 2015-02-05 07:00	--------	d-----w-	c:\programdata\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-03 04:34 . 2014-12-15 03:13	11870360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F40C3F50-06E7-4151-A388-337C829114A6}\mpengine.dll
2015-01-22 13:51 . 2015-01-22 13:51	--------	d-sh--w-	c:\users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 13:51 . 2015-01-22 13:51	--------	d-sh--w-	c:\users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-08 06:56 . 2015-01-08 06:56	--------	d-----w-	c:\users\Lena.Fraunholz
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-06 07:16 . 2013-03-25 13:23	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-02-06 07:16 . 2013-03-25 13:23	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-05 15:05 . 2014-05-13 12:13	129752	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-12-22 23:41 . 2010-11-21 03:27	298120	------w-	c:\windows\system32\MpSigStub.exe
2014-11-21 05:14 . 2014-05-13 12:13	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-11-21 05:14 . 2014-05-13 12:13	93400	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-11-21 05:14 . 2014-05-13 12:13	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2014-11-21 7063832]
"winengine"="c:\users\andreas.chudalla\AppData\Local\winengine\rkr0.exe" [2014-12-12 511416]
"winengine2"="c:\users\andreas.chudalla\AppData\Local\winengine\rkr1.exe" [2014-12-12 511416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"ECtiClient"="c:\program files (x86)\ESTOS\ProCall 4\eCtiClient.exe" [2013-01-18 21245240]
"OfficeScanNT Monitor"="c:\program files (x86)\Trend Micro\Security Agent\pccntmon.exe" [2014-02-17 1989040]
.
c:\users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OptimizerProInstaller.lnk - c:\programdata\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe /startup [2014-2-5 6466040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 3wareDrv;3wareDrv;c:\windows\system32\drivers\3wareDrv.sys;c:\windows\SYSNATIVE\drivers\3wareDrv.sys [x]
R3 ahcix64s;ahcix64s;c:\windows\system32\drivers\ahcix64s.sys;c:\windows\SYSNATIVE\drivers\ahcix64s.sys [x]
R3 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys;c:\windows\SYSNATIVE\drivers\asmthub3.sys [x]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys;c:\windows\SYSNATIVE\drivers\asmtxhci.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 edsservice;ESTOS Desktop Sharing Services;c:\program files (x86)\ESTOS\ProCall 4\EDeskShareService.exe;c:\program files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [x]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\System32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\System32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 megasas2;megasas2;c:\windows\system32\drivers\megasas2.sys;c:\windows\SYSNATIVE\drivers\megasas2.sys [x]
R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x]
R3 NmPar;PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys;c:\windows\SYSNATIVE\drivers\NmPar.sys [x]
R3 nmserial;PCI Serial Port;c:\windows\system32\drivers\nmserial.sys;c:\windows\SYSNATIVE\drivers\nmserial.sys [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys;c:\windows\SYSNATIVE\drivers\nvstusb.sys [x]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2mdx64.sys;c:\windows\SYSNATIVE\drivers\o2mdx64.sys [x]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sdx64.sys;c:\windows\SYSNATIVE\drivers\o2sdx64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys;c:\windows\SYSNATIVE\DRIVERS\silabenm.sys [x]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys;c:\windows\SYSNATIVE\DRIVERS\silabser.sys [x]
R3 TmProxy;Trend Micro Security Agent NT Proxy Service;c:\program files (x86)\Trend Micro\Security Agent\TmProxy.exe;c:\program files (x86)\Trend Micro\Security Agent\TmProxy.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [x]
S2 EACUSrv;ESTOS Automatic Client Update;c:\windows\system32\EACuSrv.exe;c:\windows\SYSNATIVE\EACuSrv.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TmFilter;Trend Micro Filter;c:\program files (x86)\Trend Micro\Security Agent\TmXPFlt.sys;c:\program files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [x]
S2 TmPreFilter;Trend Micro PreFilter;c:\program files (x86)\Trend Micro\Security Agent\TmPreFlt.sys;c:\program files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 TmCCSF;Trend Micro Common Client Solution Framework;c:\program files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe;c:\program files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-25 07:16]
.
2015-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-25 06:22]
.
2015-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-25 06:22]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Autodesk Sync"="c:\program files\Autodesk\Autodesk Sync\AdSync.exe" [2012-02-05 415680]
"XeroxScanUtility"="c:\program files\Xerox\Scan_Utility\xrxzipui.exe" [2010-09-16 2390784]
"XeroxEndeavorBackgroundTask"="c:\windows\system32\xdnorbgnd.exe" [2010-09-16 146176]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-02-05 2234144]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
TCP: DhcpNameServer = 192.168.81.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-02-06  12:26:57
ComboFix-quarantined-files.txt  2015-02-06 11:26
ComboFix2.txt  2014-05-13 12:33
.
Vor Suchlauf: 8.725.757.952 Bytes frei
Nach Suchlauf: 8.640.872.448 Bytes frei
.
- - End Of File - - 8ED5501015FA8847437D7D2AE829053A
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{3A2D5EBA-F86D-4BD3-A177-019765996711}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{3A2D5EBA-F86D-4BD3-A177-019765996711}



~~~ Files

Successfully deleted: [File] "C:\windows\wininit.ini"



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.02.2015 at  7:57:03,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Beim adw cleaner und Malwarebytes wurde nix weiter gefunden daher auch keine log Datei in meiner antwort

Was machen die Popups? Wenn sie noch da sind, in welchem Browser? Das frisch FRST Log fehlt noch.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-02-2015 02
Ran by andreas.chudalla at 2015-02-12 07:39:07 Run:1
Running from C:\Users\andreas.chudalla\Desktop
Loaded Profiles: andreas.chudalla (Available profiles: angela.hinse & michael.meisel & ulrich.scherer & mimi.hafner & manuel.hoeller & markus.kleber & andrea.hafner & Lena.Fraunholz & andreas.chudalla & andreas.regner & administrator & admin)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}

C:\Users\andrea.hafner\Desktop\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001c7a

C:\Users\andrea.hafner\Desktop\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5FJ8OAA\pack[1].7z

C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BabMaint.exe

C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BExternal.dll

C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BUSolution.dll

C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\CrxInstaller.dll

C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\delta.crx

C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\IEHelper.dll

C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\MyBabylonTB.exe

C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\Setup.exe

C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\CR\Delta.crx

C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\Shared\BabMaint.exe

C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\Shared\BUSolution.dll

C:\Users\andrea.hafner\Desktop\AppData\Roaming\OpenCandy\6DCCF8E2E0764F6F9C355F37FC9D78FE\DeltaTB.exe

C:\Users\andreas.chudalla\AppData\Local\Temp\DMR\dmr_72.exe

E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 1.zip

E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 21.zip

E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 5.zip

E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 7.zip

E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 8.zip

E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2014-03-04 073341\Backup files 1.zip

E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 1.zip

E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 2.zip

E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 31.zip

E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 6.zip

E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 8.zip

E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 9.zip

E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 32.zip

E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 6.zip

E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 7.zip

E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 9.zip

E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 33.zip

E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 6.zip

E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 7.zip

E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 9.zip

E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 35.zip

E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 7.zip

E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 8.zip

E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 9.zip

E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 35.zip

E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 7.zip

E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 8.zip

E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 9.zip

E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 25.zip

E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 7.zip

E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 8.zip

E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 9.zip

E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-02-09 074010\Backup files 1.zip

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
C:\Users\andreas.chudalla\AppData\Local\winengine
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
Emptytemp:
*****************


"C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}" directory move:

C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\54a97918cc9937ce => Moved successfully.
Could not move "C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\9954df4deb4dd01a" => Scheduled to move on reboot.
C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.dat => Moved successfully.
C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe => Moved successfully.
Could not move "C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}" directory. => Scheduled to move on reboot.

C:\Users\andrea.hafner\Desktop\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001c7a => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P5FJ8OAA\pack[1].7z => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BabMaint.exe => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BExternal.dll => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\BUSolution.dll => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\CrxInstaller.dll => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\delta.crx => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\IEHelper.dll => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\MyBabylonTB.exe => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Local\Temp\EEE47331-BAB0-7891-AE75-8531FCB0104C\Latest\Setup.exe => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\CR\Delta.crx => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\Shared\BabMaint.exe => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Roaming\BabSolution\Shared\BUSolution.dll => Moved successfully.
C:\Users\andrea.hafner\Desktop\AppData\Roaming\OpenCandy\6DCCF8E2E0764F6F9C355F37FC9D78FE\DeltaTB.exe => Moved successfully.
C:\Users\andreas.chudalla\AppData\Local\Temp\DMR\dmr_72.exe => Moved successfully.
E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 1.zip => Moved successfully.
E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 21.zip => Moved successfully.
E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 5.zip => Moved successfully.
E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 7.zip => Moved successfully.
E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2013-10-01 150158\Backup files 8.zip => Moved successfully.
E:\PC-0406\Backup Set 2013-10-01 150158\Backup Files 2014-03-04 073341\Backup files 1.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 1.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 2.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 31.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 6.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 8.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-04-14 073903\Backup Files 2014-04-14 073903\Backup files 9.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 32.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 6.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 7.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-06-02 073326\Backup Files 2014-06-02 073326\Backup files 9.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 33.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 6.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 7.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-07-21 073442\Backup Files 2014-07-21 073442\Backup files 9.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 35.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 7.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 8.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-09-22 073726\Backup Files 2014-09-22 073726\Backup files 9.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 35.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 7.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 8.zip => Moved successfully.
E:\PC-0406\Backup Set 2014-11-17 073148\Backup Files 2014-11-17 073148\Backup files 9.zip => Moved successfully.
E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 25.zip => Moved successfully.
E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 7.zip => Moved successfully.
E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 8.zip => Moved successfully.
E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-01-12 073627\Backup files 9.zip => Moved successfully.
E:\PC-0406\Backup Set 2015-01-12 073627\Backup Files 2015-02-09 074010\Backup files 1.zip => Moved successfully.
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Windows\CurrentVersion\Run\\winengine => value deleted successfully.
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Windows\CurrentVersion\Run\\winengine2 => value deleted successfully.
C:\Users\andreas.chudalla\AppData\Local\winengine => Moved successfully.
C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk => Moved successfully.
C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe not found.
EmptyTemp: => Removed 95.8 MB temporary data.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-02-12 07:42:09)<=

C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\9954df4deb4dd01a => Is moved successfully.
C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9} => Is moved successfully.

==== End of Fixlog 07:42:09 ====
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-02-2015 02
Ran by andreas.chudalla at 2015-02-12 07:43:51
Running from C:\Users\andreas.chudalla\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Trend Micro Security Agent (Disabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Trend Micro Security Agent Anti-Spyware (Disabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
AutoCAD LT 2013 - Deutsch (German) (HKLM\...\AutoCAD LT 2013 - Deutsch (German)) (Version: 19.0.55.0 - Autodesk)
AutoCAD LT 2013 - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
AutoCAD LT 2013 Language Pack - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.0.84.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.13 - Autodesk)
Autodesk Sync (HKLM\...\{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}) (Version: 3.5.24.0 - Autodesk, Inc.)
browsersupport (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 Version: 5 - ${CompanyName}) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DigiTrakLWD (HKLM-x32\...\{D16E1774-E054-4684-815E-1D7E652327EF}) (Version: 2.012.00.000 - Digital-Control, Inc.)
ESS Energie Indikator (HKLM-x32\...\{6E83470B-5EE2-407D-ABFC-CC87E070ED8C}) (Version: 20.13.0 - Nemetschek Allplan GmbH)
ESTOS ProCall (HKLM-x32\...\{F2D50027-E910-4C2C-AC57-E7D806AAE64E}) (Version: 4.1.10.20036 - ESTOS)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Standard 2010 (HKLM-x32\...\Office14.STANDARD) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft ReportViewer 2010 SP1 Redistributable (KB2549864) (HKLM-x32\...\{1282C0BC-3B22-33D4-B72E-62922415DDCA}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{6BC1F8BE-E812-43FC-B648-90770D1C8F34}) (Version: 6.3a - Silicon Laboratories, Inc.)
Trend Micro Worry-Free Business Security Agent (HKLM\...\Wofie) (Version: 19.0.1240 - Trend Micro Inc.)
Trend Micro Worry-Free Business Security Agent (Version: 9.0 - Trend Micro Inc.) Hidden
Windows Small Business Server 2008 ClientAgent (HKLM\...\{E4FF4DF1-F99C-49AC-B398-BE0887432846}) (Version: 6.0.5601.6 - Microsoft Corporation)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (10/18/2013 6.6.1.0) (HKLM\...\F92C2D6CB4EA0EE558BDF5F8BDD69083DFC62179) (Version: 10/18/2013 6.6.1.0 - Silicon Laboratories)
winengine (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\winengine) (Version: 20.020 - Ad business Crown Solutions)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\de-DE\acadltficn.dll (Autodesk, Inc.)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-05-13 13:31 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {309DDB9E-E5B2-49C4-A862-37419536E206} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {386DF147-2C4A-43F7-BFBA-74BEECE839E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {39CCE3F9-BEB4-4791-85E6-1F7E953517E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {3DBC1268-8B24-4A0D-B3C9-B0D747045405} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {462282DE-B532-47A9-9088-E092C9F7DD9B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {E144FE06-4742-4F39-904C-BCC78CF23486} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {F561A6DF-A3DF-43D0-87F0-D328B86A4C31} - System32\Tasks\sondhschedule => C:\Users\andreas.chudalla\AppData\Roaming\browsersupport\browsersupport-Installer.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2012-05-31 09:03 - 2014-02-08 18:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-08-31 12:55 - 2011-08-31 12:55 - 00801792 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\sqlite3.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\windows\system32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\windows\system32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\windows\system32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\windows\system32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\windows\system32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\windows\system32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\windows\system32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\windows\system32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\windows\system32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\windows\system32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\windows\system32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\windows\system32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\windows\system32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\windows\system32\xi.dll
2009-07-02 15:32 - 2009-07-02 15:32 - 00089088 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\zlibwapi.dll
2013-01-16 09:19 - 2013-01-16 09:19 - 00048128 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_date_time-vc110-mt-1_49.dll
2013-04-02 11:25 - 2013-04-02 11:25 - 00675840 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\sqlite3.dll
2013-01-16 09:23 - 2013-01-16 09:23 - 00058368 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_thread-vc110-mt-1_49.dll
2013-04-17 14:32 - 2010-09-16 15:34 - 00146176 _____ () C:\Windows\System32\xdnorbgnd.exe
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\Windows\System32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\Windows\System32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\Windows\System32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\Windows\System32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\Windows\System32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\Windows\System32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\Windows\System32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\Windows\System32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\Windows\System32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\Windows\System32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\Windows\System32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\Windows\System32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\Windows\System32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\Windows\System32\xi.dll
2014-11-22 01:03 - 2014-11-22 01:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-02-10 07:46 - 2015-01-23 11:37 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-02-06 08:16 - 2015-02-06 08:16 - 16852144 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Control Panel\Desktop\\Wallpaper -> C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.81.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

admin (S-1-5-21-3572959257-616895921-2767358109-1001 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-3572959257-616895921-2767358109-500 - Administrator - Disabled)
Gast (S-1-5-21-3572959257-616895921-2767358109-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/12/2015 07:39:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x1688
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (02/11/2015 04:15:24 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (02/11/2015 03:15:57 PM) (Source: Outlook) (EventID: 35) (User: )
Description: Fehler beim Bestimmen, ob sich der Speicher im Durchforstungsbereich befindet (Fehler=0x8007041d).

Error: (02/11/2015 03:15:57 PM) (Source: Outlook) (EventID: 34) (User: )
Description: Fehler beim Abrufen des Durchforstungsbereichs-Managers. Fehler=0x8007041d.

Error: (02/11/2015 03:15:57 PM) (Source: Outlook) (EventID: 35) (User: )
Description: Fehler beim Bestimmen, ob sich der Speicher im Durchforstungsbereich befindet (Fehler=0x8007041d).

Error: (02/11/2015 03:15:57 PM) (Source: Outlook) (EventID: 34) (User: )
Description: Fehler beim Abrufen des Durchforstungsbereichs-Managers. Fehler=0x8007041d.

Error: (02/11/2015 03:15:45 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 03:15:45 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 03:15:45 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 03:15:45 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)


System errors:
=============
Error: (02/12/2015 07:40:55 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (02/11/2015 03:15:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/11/2015 03:15:59 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (02/11/2015 03:15:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/11/2015 03:15:59 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (02/11/2015 03:15:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/11/2015 03:15:59 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (02/11/2015 03:15:59 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (02/11/2015 03:15:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/11/2015 03:15:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.


Microsoft Office Sessions:
=========================
Error: (02/12/2015 07:39:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f2248000000300001425168801d0468d4589b3fcC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlld82070f4-b281-11e4-9612-902b3411fc4b

Error: (02/11/2015 04:15:24 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (02/11/2015 03:15:57 PM) (Source: Outlook) (EventID: 35) (User: )
Description: 0x8007041d

Error: (02/11/2015 03:15:57 PM) (Source: Outlook) (EventID: 34) (User: )
Description: 0x8007041d

Error: (02/11/2015 03:15:57 PM) (Source: Outlook) (EventID: 35) (User: )
Description: 0x8007041d

Error: (02/11/2015 03:15:57 PM) (Source: Outlook) (EventID: 34) (User: )
Description: 0x8007041d

Error: (02/11/2015 03:15:45 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 03:15:45 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 03:15:45 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/11/2015 03:15:45 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer


CodeIntegrity Errors:
===================================
  Date: 2014-05-13 14:30:37.730
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-13 14:30:37.714
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 23%
Total physical RAM: 8154.33 MB
Available physical RAM: 6271.94 MB
Total Pagefile: 16306.84 MB
Available Pagefile: 14139.56 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:55.8 GB) (Free:3.62 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Fixed) (Total:465.76 GB) (Free:298.08 GB) NTFS
Drive g: (kollmerdaten) (Network) (Total:557.75 GB) (Free:234.94 GB) NTFS
Drive r: (Daten) (Network) (Total:309.4 GB) (Free:203.53 GB) NTFS
Drive u: (Daten) (Network) (Total:309.4 GB) (Free:203.53 GB) NTFS
Drive y: () (Network) (Total:400.19 GB) (Free:180.18 GB) 

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: E3B0152C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=55.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 495EDE2A)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-02-2015 02
Ran by andreas.chudalla (administrator) on PC-0406 on 12-02-2015 07:43:19
Running from C:\Users\andreas.chudalla\Desktop
Loaded Profiles: andreas.chudalla (Available profiles: angela.hinse & michael.meisel & ulrich.scherer & mimi.hafner & manuel.hoeller & markus.kleber & andrea.hafner & Lena.Fraunholz & andreas.chudalla & andreas.regner & administrator & admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-12 07:43 - 2015-02-12 07:43 - 00012043 _____ () C:\Users\andreas.chudalla\Desktop\FRST.txt
2015-02-12 07:41 - 2015-02-12 07:41 - 00006356 _____ () C:\windows\PFRO.log
2015-02-12 07:38 - 2015-02-12 07:38 - 02134016 _____ (Farbar) C:\Users\andreas.chudalla\Desktop\FRST64.exe
2015-02-12 07:32 - 2015-02-12 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-12 07:32 - 2013-06-25 13:30 - 00867240 _____ (Oracle Corporation) C:\windows\SysWOW64\npDeployJava1.dll
2015-02-12 07:32 - 2013-06-25 13:30 - 00789416 _____ (Oracle Corporation) C:\windows\SysWOW64\deployJava1.dll
2015-02-12 07:31 - 2015-02-12 07:31 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-12 07:22 - 2015-02-12 07:41 - 00000336 _____ () C:\windows\setupact.log
2015-02-12 07:22 - 2015-02-12 07:22 - 00482080 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-12 07:22 - 2015-02-12 07:22 - 00000000 _____ () C:\windows\setuperr.log
2015-02-11 16:00 - 2015-02-11 16:00 - 00141312 _____ () C:\Users\andreas.chudalla\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-11 13:25 - 2015-02-11 13:25 - 00015118 _____ () C:\Users\andreas.chudalla\Desktop\Mappe1.xlsx
2015-02-11 08:36 - 2015-02-11 11:45 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-10 16:04 - 2015-02-11 08:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Mozilla
2015-02-10 07:46 - 2015-02-10 07:46 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-06 12:26 - 2015-02-06 12:26 - 00018431 _____ () C:\ComboFix.txt
2015-02-05 14:13 - 2015-02-12 07:43 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-05 12:55 - 2015-02-06 07:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:52 - 2015-02-12 07:40 - 00470422 _____ () C:\windows\WindowsUpdate.log
2015-02-05 09:47 - 2015-02-10 07:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-11 16:10 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-12 07:43 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-12 07:41 - 2014-08-18 11:10 - 01017784 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-12 07:41 - 2014-08-18 11:10 - 00562912 _____ () C:\windows\system32\TmInstall.log
2015-02-12 07:41 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-12 07:41 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-12 07:41 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-12 07:41 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-12 07:34 - 2012-05-01 11:40 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-02-12 07:32 - 2013-06-25 13:30 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2015-02-12 07:32 - 2013-06-25 13:30 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2015-02-12 07:32 - 2013-06-25 13:30 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2015-02-12 07:32 - 2013-06-25 13:30 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-12 07:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-12 07:31 - 2013-06-25 13:30 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-12 07:30 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-12 07:30 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-12 07:28 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-12 07:27 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-12 07:27 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-12 07:27 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-11 15:43 - 2014-02-11 09:08 - 00038098 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-11 15:17 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-02-11 15:16 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-11 13:09 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-10 15:50 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-06 12:27 - 2014-05-13 13:25 - 00000000 ____D () C:\Qoobox
2015-02-06 12:25 - 2009-07-14 03:34 - 00000215 ____N () C:\windows\system.ini
2015-02-06 11:40 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-02-06 08:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 08:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 08:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-16 12:10 - 2015-01-08 07:56 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================
         

--- --- ---

--- --- ---

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Professional x64
Ran by andreas.chudalla on 10.02.2015 at  7:39:33,67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.02.2015 at  7:40:55,84
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Und ja die kommen noch.. Benutze den Internet Explorer

Das neue FRST log fehlt immer noch

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by andreas.chudalla (administrator) on PC-0406 on 10-02-2015 15:41:56
Running from C:\Users\andreas.chudalla\Downloads
Loaded Profiles: andreas.chudalla (Available profiles: angela.hinse & michael.meisel & ulrich.scherer & mimi.hafner & manuel.hoeller & markus.kleber & andrea.hafner & Lena.Fraunholz & andreas.chudalla & andreas.regner & administrator & admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(ESTOS GmbH) C:\Windows\System32\EACuSrv.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\NTRTScan.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\TmListen.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Xerox Corporation) C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe
() C:\Windows\System32\xdnorbgnd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe
(Flexera Software, Inc.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\AutoCAD LT 2013\AdExchange\AcBrowserHost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Autodesk, Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\Aec32BitAppServer57.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [XeroxScanUtility] => C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2390784 2010-09-16] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] => C:\windows\system32\xdnorbgnd.exe [146176 2010-09-16] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ECtiClient] => C:\Program Files (x86)\ESTOS\ProCall 4\eCtiClient.exe [21245240 2013-01-18] (ESTOS GmbH)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\Security Agent\pccntmon.exe [1989040 2014-02-17] (Trend Micro Inc.)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: browsersupport helper -> {B5147546-9359-4D9B-8B36-F54C54555799} -> C:\Program Files (x86)\browsersupport\browsersupport.dll (appllc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.81.1

FireFox:
========
FF ProfilePath: C:\Users\andreas.chudalla\AppData\Roaming\Mozilla\Firefox\Profiles\s2nhj9ft.default-1423134047471
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-22]
CHR Extension: (Google Docs) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-22]
CHR Extension: (Google Drive) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-22]
CHR Extension: (YouTube) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-22]
CHR Extension: (Google-Suche) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-22]
CHR Extension: (Google Tabellen) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-22]
CHR Extension: (Google Wallet) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-22]
CHR Extension: (Google Mail) - C:\Users\andreas.chudalla\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-22]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 EACUSrv; C:\Windows\system32\EACuSrv.exe [6876008 2014-01-15] (ESTOS GmbH)
S3 edsservice; C:\Program Files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [652632 2013-01-18] (ESTOS GmbH)
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\Security Agent\ntrtscan.exe [3747816 2014-02-17] (Trend Micro Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R3 TmCCSF; C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\TmCCSF.exe [661912 2014-02-17] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\Security Agent\tmlisten.exe [4041088 2014-02-17] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\Security Agent\TmProxy.exe [929328 2014-01-22] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2011-08-11] (LSI)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [51496 2012-01-17] (LSI Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-06-03] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2009-05-07] (O2Micro )
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [286232 2013-10-31] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmXPFlt.sys [351032 2014-08-30] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\Security Agent\TmPreFlt.sys [44856 2014-08-30] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2013-09-26] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\Security Agent\VSApiNt.sys [2316600 2014-08-30] (Trend Micro Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 15:41 - 2015-02-10 15:42 - 00015278 _____ () C:\Users\andreas.chudalla\Downloads\FRST.txt
2015-02-10 15:41 - 2015-02-10 15:41 - 02132992 _____ (Farbar) C:\Users\andreas.chudalla\Downloads\FRST64.exe
2015-02-10 07:46 - 2015-02-10 07:46 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-10 07:46 - 2015-02-10 07:46 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Mozilla
2015-02-06 12:26 - 2015-02-06 12:26 - 00018431 _____ () C:\ComboFix.txt
2015-02-05 14:13 - 2015-02-10 15:42 - 00000000 ____D () C:\FRST
2015-02-05 14:03 - 2015-02-05 14:03 - 00001124 _____ () C:\Users\andreas.chudalla\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-05 12:55 - 2015-02-06 07:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-05 12:55 - 2015-02-05 13:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-05 12:55 - 2015-02-05 12:55 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-02-05 12:54 - 2015-02-05 12:54 - 01191200 _____ () C:\Users\andreas.chudalla\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-02-05 12:52 - 2015-02-10 15:33 - 00335157 _____ () C:\windows\WindowsUpdate.log
2015-02-05 12:47 - 2015-02-05 12:47 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(2).exe
2015-02-05 10:16 - 2015-02-05 10:16 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109(1).exe
2015-02-05 10:11 - 2015-02-05 10:11 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\adwcleaner_4.109.exe
2015-02-05 09:56 - 2015-02-05 09:56 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09(1).exe
2015-02-05 09:50 - 2015-02-05 09:50 - 02194432 _____ () C:\Users\andreas.chudalla\Downloads\AdwCleaner09.exe
2015-02-05 09:47 - 2015-02-10 07:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-05 08:16 - 2015-02-05 08:16 - 00000000 ____D () C:\Program Files (x86)\browsersupport
2015-02-05 08:05 - 2015-02-05 08:05 - 00000000 ____D () C:\shoplog
2015-02-05 08:00 - 2015-02-05 08:15 - 00000822 _____ () C:\windows\DCEBOOT.RST
2015-02-05 08:00 - 2015-02-05 08:00 - 00635102 _____ () C:\windows\system32\errordetails.xml
2015-02-05 07:58 - 2015-02-05 07:58 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\winengine
2015-02-05 07:57 - 2015-02-05 07:57 - 00003344 _____ () C:\windows\System32\Tasks\sondhschedule
2015-02-05 07:55 - 2015-02-05 08:02 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-02-05 07:55 - 2015-02-05 08:00 - 00025136 _____ (Trend Micro Inc.) C:\windows\DCEBoot64.exe
2015-02-05 07:55 - 2015-02-05 08:00 - 00000000 ____D () C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
2015-02-05 07:55 - 2015-02-05 07:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-05 07:55 - 2015-02-05 07:55 - 00240176 _____ (Trend Micro Inc.) C:\windows\RegBootClean64.exe
2015-02-05 07:49 - 2015-02-05 07:49 - 37968904 _____ (ICQ) C:\Users\andreas.chudalla\Downloads\icq_83rfrset.exe
2015-01-28 16:07 - 2015-01-28 17:23 - 00562028 ____N () C:\Users\andreas.chudalla\Bauleiterschulung Fa. Kollmer 29.1.15.pptx
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieUserList
2015-01-22 14:51 - 2015-01-22 14:51 - 00000000 __SHD () C:\Users\andreas.chudalla\AppData\Local\EmieSiteList
2015-01-22 14:48 - 2015-01-22 14:48 - 00880784 _____ (Google Inc.) C:\Users\andreas.chudalla\Downloads\ChromeSetup.exe
2015-01-21 08:15 - 2015-01-21 08:15 - 00000211 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl2
2015-01-21 08:15 - 2015-01-21 08:15 - 00000061 ____H () C:\Users\andreas.chudalla\Documents\Zeichnung1.dwl
2015-01-20 15:10 - 2015-02-09 16:18 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\Stunden

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 15:32 - 2013-03-25 14:24 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-10 15:27 - 2014-08-18 11:10 - 00010786 _____ () C:\windows\cfgall.ini
2015-02-10 15:16 - 2013-11-05 07:27 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-10 14:48 - 2012-06-06 08:04 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2015-02-10 12:57 - 2014-02-11 09:08 - 00037102 _____ () C:\Users\andreas.chudalla\Documents\plot.log
2015-02-10 12:32 - 2013-03-25 14:24 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-10 07:32 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-10 07:32 - 2009-07-14 05:45 - 00027344 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-10 07:29 - 2012-05-01 10:44 - 00735410 _____ () C:\windows\system32\perfh007.dat
2015-02-10 07:29 - 2012-05-01 10:44 - 00162808 _____ () C:\windows\system32\perfc007.dat
2015-02-10 07:29 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-10 07:29 - 2009-07-14 06:13 - 01715220 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-10 07:25 - 2014-08-18 11:10 - 00996144 _____ () C:\windows\SysWOW64\TmInstall.log
2015-02-10 07:25 - 2014-08-18 11:10 - 00550732 _____ () C:\windows\system32\TmInstall.log
2015-02-10 07:24 - 2012-05-31 09:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-10 07:24 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-09 16:06 - 2014-05-13 13:13 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-09 07:53 - 2014-05-13 13:37 - 00000000 ____D () C:\AdwCleaner
2015-02-06 12:27 - 2014-05-13 13:25 - 00000000 ____D () C:\Qoobox
2015-02-06 12:25 - 2009-07-14 03:34 - 00000215 ____N () C:\windows\system.ini
2015-02-06 11:40 - 2013-10-01 06:34 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\cache
2015-02-06 08:16 - 2013-11-05 07:27 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 08:16 - 2013-03-25 14:23 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 08:16 - 2013-03-25 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 12:43 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\IME
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-05 12:32 - 2014-05-13 13:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-05 10:17 - 2013-10-01 06:38 - 00002002 ____H () C:\Users\andreas.chudalla\Documents\Default.rdp
2015-02-05 09:22 - 2013-10-01 06:30 - 00001451 _____ () C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-05 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-01-30 08:19 - 2013-10-01 06:30 - 00000000 ____D () C:\Users\andreas.chudalla
2015-01-30 07:48 - 2014-03-25 07:49 - 00000000 ____D () C:\Users\andreas.chudalla\Desktop\F5
2015-01-23 08:18 - 2014-03-24 07:36 - 00000000 ____D () C:\Users\andreas.chudalla\Urlaub
2015-01-22 14:51 - 2013-03-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-22 14:49 - 2013-10-01 06:31 - 00000000 ____D () C:\Users\andreas.chudalla\AppData\Local\Google
2015-01-16 12:10 - 2015-01-08 07:56 - 00001982 ____H () C:\Users\Lena.Fraunholz\Documents\Default.rdp

==================== Files in the root of some directories =======

2013-06-28 08:34 - 2013-06-28 08:34 - 0000949 _____ () C:\Program Files (x86)\Programme (x86) - Verknüpfung.lnk
2013-03-27 15:01 - 2013-03-27 15:01 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:11

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by andreas.chudalla at 2015-02-10 15:42:35
Running from C:\Users\andreas.chudalla\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Trend Micro Security Agent (Enabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Trend Micro Security Agent Anti-Spyware (Enabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
AutoCAD LT 2013 - Deutsch (German) (HKLM\...\AutoCAD LT 2013 - Deutsch (German)) (Version: 19.0.55.0 - Autodesk)
AutoCAD LT 2013 - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
AutoCAD LT 2013 Language Pack - Deutsch (German) (Version: 19.0.55.0 - Autodesk) Hidden
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.0.84.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.13 - Autodesk)
Autodesk Sync (HKLM\...\{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}) (Version: 3.5.24.0 - Autodesk, Inc.)
browsersupport (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245 Version: 5 - ${CompanyName}) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DigiTrakLWD (HKLM-x32\...\{D16E1774-E054-4684-815E-1D7E652327EF}) (Version: 2.012.00.000 - Digital-Control, Inc.)
ESS Energie Indikator (HKLM-x32\...\{6E83470B-5EE2-407D-ABFC-CC87E070ED8C}) (Version: 20.13.0 - Nemetschek Allplan GmbH)
ESTOS ProCall (HKLM-x32\...\{F2D50027-E910-4C2C-AC57-E7D806AAE64E}) (Version: 4.1.10.20036 - ESTOS)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Standard 2010 (HKLM-x32\...\Office14.STANDARD) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft ReportViewer 2010 SP1 Redistributable (KB2549864) (HKLM-x32\...\{1282C0BC-3B22-33D4-B72E-62922415DDCA}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{6BC1F8BE-E812-43FC-B648-90770D1C8F34}) (Version: 6.3a - Silicon Laboratories, Inc.)
Trend Micro Worry-Free Business Security Agent (HKLM\...\Wofie) (Version: 19.0.1240 - Trend Micro Inc.)
Trend Micro Worry-Free Business Security Agent (Version: 9.0 - Trend Micro Inc.) Hidden
Windows Small Business Server 2008 ClientAgent (HKLM\...\{E4FF4DF1-F99C-49AC-B398-BE0887432846}) (Version: 6.0.5601.6 - Microsoft Corporation)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (10/18/2013 6.6.1.0) (HKLM\...\F92C2D6CB4EA0EE558BDF5F8BDD69083DFC62179) (Version: 10/18/2013 6.6.1.0 - Silicon Laboratories)
winengine (HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\winengine) (Version: 20.020 - Ad business Crown Solutions)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\acadlt.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3409918318-3268832435-3554840575-1245_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2013\de-DE\acadltficn.dll (Autodesk, Inc.)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-05-13 13:31 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {309DDB9E-E5B2-49C4-A862-37419536E206} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {386DF147-2C4A-43F7-BFBA-74BEECE839E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {39CCE3F9-BEB4-4791-85E6-1F7E953517E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {3DBC1268-8B24-4A0D-B3C9-B0D747045405} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {462282DE-B532-47A9-9088-E092C9F7DD9B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {E144FE06-4742-4F39-904C-BCC78CF23486} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {F561A6DF-A3DF-43D0-87F0-D328B86A4C31} - System32\Tasks\sondhschedule => C:\Users\andreas.chudalla\AppData\Roaming\browsersupport\browsersupport-Installer.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2012-05-31 09:03 - 2014-02-08 18:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-08-31 12:55 - 2011-08-31 12:55 - 00801792 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\sqlite3.dll
2009-07-02 15:32 - 2009-07-02 15:32 - 00089088 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\zlibwapi.dll
2013-01-16 09:19 - 2013-01-16 09:19 - 00048128 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_date_time-vc110-mt-1_49.dll
2013-04-02 11:25 - 2013-04-02 11:25 - 00675840 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\sqlite3.dll
2013-01-16 09:23 - 2013-01-16 09:23 - 00058368 _____ () C:\Program Files (x86)\Trend Micro\Security Agent\CCSF\boost_thread-vc110-mt-1_49.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\windows\system32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\windows\system32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\windows\system32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\windows\system32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\windows\system32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\windows\system32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\windows\system32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\windows\system32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\windows\system32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\windows\system32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\windows\system32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\windows\system32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\windows\system32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\windows\system32\xi.dll
2013-04-17 14:32 - 2010-09-16 15:34 - 00146176 _____ () C:\Windows\System32\xdnorbgnd.exe
2013-04-17 14:32 - 2009-08-14 04:02 - 00397824 _____ () C:\Windows\System32\xiputil.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00465408 _____ () C:\Windows\System32\xipinterp.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204800 _____ () C:\Windows\System32\xesup.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01737728 _____ () C:\Windows\System32\xeext.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00214016 _____ () C:\Windows\System32\xipsup.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00287232 _____ () C:\Windows\System32\documentio.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00080384 _____ () C:\Windows\System32\diotifffx.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00009216 _____ () C:\Windows\System32\xiplibxml.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 01341952 _____ () C:\Windows\System32\xrx_xml2.dll
2013-04-17 14:32 - 2009-08-14 04:03 - 00207360 _____ () C:\Windows\System32\xrx_xslt.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00587264 _____ () C:\Windows\System32\xipxmlsec.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 04120064 _____ () C:\Windows\System32\xeng.DLL
2013-04-17 14:32 - 2009-08-14 04:02 - 00223232 _____ () C:\Windows\System32\lcms.dll
2013-04-17 14:32 - 2009-08-14 04:02 - 00204288 _____ () C:\Windows\System32\xi.dll
2014-11-22 01:03 - 2014-11-22 01:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-12-12 13:34 - 2014-12-12 13:34 - 00511416 _____ () C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe
2012-02-07 06:10 - 2012-02-07 06:10 - 00755624 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acapp.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00184744 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accloudconnect.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00181672 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acismui.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00339880 _____ () c:\program files\autodesk\autocad lt 2013\acfdeval.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00225704 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accalcengine.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 01382312 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acvmtools.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00826280 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\accmmgr.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00111016 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acparameter.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00973736 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acdim.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00061352 _____ () c:\program files\autodesk\autocad lt 2013\units.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00162728 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\acpltstamp.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 00362408 _____ () c:\program files\autodesk\autocad lt 2013\acmted.crx
2012-02-07 06:10 - 2012-02-07 06:10 - 02391976 _____ () C:\Program Files\Autodesk\AutoCAD LT 2013\aceplotx.crx
2011-04-29 20:23 - 2011-04-29 20:23 - 00125376 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axutil.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00385984 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_engine.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00158144 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axiom.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00034752 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\axis2_parser.dll
2011-04-29 20:27 - 2011-04-29 20:27 - 01315264 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\libxml2.dll
2011-04-29 20:23 - 2011-04-29 20:23 - 00103360 _____ () C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\neethi.dll
2015-02-10 07:46 - 2015-01-23 11:37 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-02-06 08:16 - 2015-02-06 08:16 - 16852144 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\Control Panel\Desktop\\Wallpaper -> C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

admin (S-1-5-21-3572959257-616895921-2767358109-1001 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-3572959257-616895921-2767358109-500 - Administrator - Disabled)
Gast (S-1-5-21-3572959257-616895921-2767358109-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (02/10/2015 11:26:17 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-05-13 14:30:37.730
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-13 14:30:37.714
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 91%
Total physical RAM: 8154.33 MB
Available physical RAM: 686.36 MB
Total Pagefile: 16306.84 MB
Available Pagefile: 8371.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:55.8 GB) (Free:8.51 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Fixed) (Total:465.76 GB) (Free:292.43 GB) NTFS
Drive g: (kollmerdaten) (Network) (Total:557.75 GB) (Free:237.16 GB) NTFS
Drive r: (Daten) (Network) (Total:309.4 GB) (Free:203.57 GB) NTFS
Drive u: (Daten) (Network) (Total:309.4 GB) (Free:203.57 GB) NTFS
Drive y: () (Network) (Total:400.19 GB) (Free:180.18 GB) 

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: E3B0152C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=55.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 495EDE2A)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr0.exe [511416 2014-12-12] ()
HKU\S-1-5-21-3409918318-3268832435-3554840575-1245\...\Run: [winengine2] => C:\Users\andreas.chudalla\AppData\Local\winengine\rkr1.exe [511416 2014-12-12] ()
Startup: C:\Users\andreas.chudalla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OptimizerProInstaller.lnk
ShortcutTarget: OptimizerProInstaller.lnk -> C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}\OptimizerProInstaller.exe (PC Utilities Software Limited)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\andreas.chudalla\AppData\Local\winengine
C:\ProgramData\{55ad6f76-482a-c5b2-55ad-d6f76482bdd9}
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?