Windows 7: E-Mail vom falschen DHL-Absender samt Anhang geöffnet

deeprybka · 13.05.2015, 20:08

Ja, außer Du bist Dir sicher, dass da keine Malware drauf ist.

Patroklos91 · 14.05.2015, 07:40

Hier kommt das Log-File des ESET-Scans ... USB-Sticks oder externe Festplatten hatte ich seit dem Öffnen des Mail-Anhangs nicht an den Rechner angeschlossen und habe diese deshalb auch nicht in den Scan mit einbezogen.

Nächster Schritt? Ansonsten einen schönen Feiertag! Ach ja, meine nächste Antwort gibt es wohl erst wieder am Sonntagabend. Ich melde mich dann zurück.
Gruß Patroklos

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=51404ff545762e4da33e1f23c398b084
# engine=23834
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-14 02:22:15
# local_time=2015-05-14 04:22:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 67942 183201326 0 0
# scanned=448010
# found=26
# cleaned=0
# scan_time=15372
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Avanquest_App'-Anwendungsleiste\Avanquest_App'-AnwendungsleisteToolbarHelper.exe.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Avanquest_App'-Anwendungsleiste\ldrtbAvan.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Avanquest_App'-Anwendungsleiste\prxtbAva0.dll.vir"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Avanquest_App'-Anwendungsleiste\prxtbAvan.dll.vir"
sh=E6F9792E271F52A2245CC8D72C05A57D6DFBBDE3 ft=1 fh=0690a81bbbd9c1b6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Avanquest_App'-Anwendungsleiste\tbAvan.dll.vir"
sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jonas *****\AppData\Local\Conduit\CT2529008\Avanquest_App'-AnwendungsleisteAutoUpdateHelper.exe.vir"
sh=D4D640E4A04D91DEF41DAD844D1EC046FA1D5F3E ft=1 fh=f32a1de57c3d142e vn="Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jonas *****\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckjhoplcbnkhgnnahfbcdmganjhpcceg\10.24.3.503_0\nativeMessaging\TBMessagingHost.exe.vir"
sh=8E285C2E4BD51F93FDFB76801BABFD9BBBB3B1C9 ft=1 fh=5e02ad9896e321fa vn="Variante von Win32/Amonetize.AB evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jonas *****\AppData\Local\SwvUpdater\Updater.exe.vir"
sh=568B7040522AE31BE5FF0BD450B7D0B7A218E7A1 ft=1 fh=bb7982953e0dc058 vn="Variante von Win32/ELEX.BF evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jonas *****\AppData\Local\Temp\Desk365\eInstall\eInstall.exe.vir"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jonas *****\AppData\LocalLow\Avanquest_App'-Anwendungsleiste\ldrtbAvan.dll.vir"
sh=E6F9792E271F52A2245CC8D72C05A57D6DFBBDE3 ft=1 fh=0690a81bbbd9c1b6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jonas *****\AppData\LocalLow\Avanquest_App'-Anwendungsleiste\tbAvan.dll.vir"
sh=019BD6DEB00A8E2947DD741443A105AAA7AE8452 ft=1 fh=478787c8122fddfc vn="Variante von Win32/Toolbar.SearchSuite.Z evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\iLividSetupV1.exe"
sh=67971BFDA4A85D27945D4F77AEFFDD17350C693F ft=1 fh=26404b2de5881d6f vn="Win32/Adware.PCFixCleaner Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\pcfix-v205-de(2).exe"
sh=67971BFDA4A85D27945D4F77AEFFDD17350C693F ft=1 fh=26404b2de5881d6f vn="Win32/Adware.PCFixCleaner Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\pcfix-v205-de.exe"
sh=213CEC4C7200028CE0A49E2AE841EDDFEC821FFE ft=1 fh=d128db2f9733d410 vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\registrybooster(1).exe"
sh=213CEC4C7200028CE0A49E2AE841EDDFEC821FFE ft=1 fh=d128db2f9733d410 vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\registrybooster(2).exe"
sh=213CEC4C7200028CE0A49E2AE841EDDFEC821FFE ft=1 fh=d128db2f9733d410 vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\registrybooster(3).exe"
sh=2A11C812839A4A228019C1FB39238EF5041887B4 ft=1 fh=ccfedff2495351cf vn="Win32/RegistryBooster evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\registrybooster.exe"
sh=1D5316EE651AD2DDE0EA779823507E37CDF90664 ft=1 fh=2d5732c9f96eff3b vn="Variante von Win32/SlowPCfighter evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\slow-pcfighter_Web.exe"
sh=9BB071BC9E49A4C6C0208B6D563FB6C0DFB2F147 ft=1 fh=50b1f8b169c3d753 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\SoftonicDownloader72279(2).exe"
sh=9BB071BC9E49A4C6C0208B6D563FB6C0DFB2F147 ft=1 fh=50b1f8b169c3d753 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\SoftonicDownloader72279.exe"
sh=ECACB71BA4B050039E3FCBBB6805498B0F3FD64A ft=1 fh=78c79ddcb2c04138 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\SoftonicDownloader_fuer_gedit.exe"
sh=A7ADE3B10E94D1662CE72590F644B2CADED1BAE9 ft=1 fh=709cbdad0f5f569d vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Datensicherung Walter Mai 2014\Walter\Datensicherung Aldi-PC März 2012\Walter\Downloads\SoftonicDownloader_fuer_tipp10.exe"
sh=A9AB071E3C632340DEB6791BF83F8F1A5B3A09AA ft=1 fh=5456a0d68c2c20ed vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jonas *****\Downloads\StellarPhoenixWindowsDataRecovery-Home_PPCS.exe"
sh=871131E4D4C05C12F719373F3003CE208FF57A1A ft=1 fh=7f96aee7ff66d687 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jonas *****\Downloads\TrackMania Nations Forever - CHIP-Installer.exe"

deeprybka · 14.05.2015, 12:42

Keine Malware gefunden. Poste dann am Sonntag mal ein frisches FRST-Log bitte.

Patroklos91 · 18.05.2015, 11:37

Hi Jürgen,

hier die Logs des neuen FRST-Scans.

Gruß Patroklos

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-05-2015 02
Ran by Jonas ***** (administrator) on ZUKUNFT on 18-05-2015 12:04:37
Running from C:\ProgrammeJonas
Loaded Profiles: Jonas ***** &  (Available profiles: Jonas *****)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files\ownCloud\owncloud.exe
(Geek Software GmbH) C:\ProgrammeJonas\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(6 Wunderkinder GmbH) C:\Program Files\Wunderlist2\Wunderlist.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Daniel Manger Software) C:\Program Files\Kalenderchen6\Kalenderchen.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9288296 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-05-27] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [NUSB3MON] => C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-02] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [421736 2012-01-16] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ownCloud] => C:\Program Files\ownCloud\owncloud.exe [1253540 2013-04-22] ()
HKLM\...\Run: [PDFPrint] => C:\ProgrammeJonas\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001\...\Run: [Wunderlist] => C:\Program Files\Wunderlist2\Wunderlist.exe [13021792 2013-12-02] (6 Wunderkinder GmbH)
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Wunderlist] => C:\Program Files\Wunderlist2\Wunderlist.exe [13021792 2013-12-02] (6 Wunderkinder GmbH)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2011-03-25]
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk [2014-10-01]
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Jonas *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk [2010-11-28]
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope value is missing.
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2013-05-08] (Adobe Systems Incorporated)
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14] (Microsoft Corporation)
Toolbar: HKLM - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll [2011-06-24] (TerraTec Electronic GmbH)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2000-11-06] (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-31] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Jonas *****\AppData\Roaming\Mozilla\Firefox\Profiles\d240w4qq.default-1389057727826
FF NewTab:  www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [2010-08-18] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2011-11-14] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-04] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-04] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-17] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1471510115-2474919708-3564051268-1001: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Jonas *****\AppData\Roaming\Mozilla\Firefox\Profiles\d240w4qq.default-1389057727826\Extensions\2020Player_IKEA@2020Technologies.com [2014-03-21]
FF Extension: Adblock Plus - C:\Users\Jonas *****\AppData\Roaming\Mozilla\Firefox\Profiles\d240w4qq.default-1389057727826\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-08]
FF HKLM\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files\AmiExt\flashEnhancer\ff
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-04-11]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\42.0.2311.135\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\42.0.2311.135\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\42.0.2311.135\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows LiveÂ® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\Jonas *****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (No Name) - C:\Users\Jonas *****\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckjhoplcbnkhgnnahfbcdmganjhpcceg [2012-08-27]
CHR Extension: (Google Wallet) - C:\Users\Jonas *****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-26]
CHR HKLM\...\Chrome\Extension: [ckjhoplcbnkhgnnahfbcdmganjhpcceg] - C:\Users\JONASR~1\AppData\Local\Temp\ckjhoplcbnkhgnnahfbcdmganjhpcceg.crx [Not Found]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [851456 2015-04-27] (Microsoft Corporation)
S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [489408 2009-11-05] (ITETech                  )
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-29] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-03-12] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-05-18] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [64904 2010-04-27] (Renesas Electronics Corporation)
R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [146568 2010-04-27] (Renesas Electronics Corporation)
S3 RTL2832UBDA; C:\Windows\System32\drivers\RTL2832UBDA.sys [189184 2012-01-09] (REALTEK SEMICONDUCTOR Corp.)
S3 RTL2832UUSB; C:\Windows\System32\Drivers\RTL2832UUSB.sys [33536 2012-01-09] (REALTEK SEMICONDUCTOR Corp.)
S3 RTL2832U_IRHID; C:\Windows\System32\DRIVERS\RTL2832U_IRHID.sys [43392 2012-01-09] (Realtek)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-07] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\JONASR~1\AppData\Local\Temp\catchme.sys [X]
S3 Profos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\profos.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-13 23:51 - 2015-05-13 23:52 - 02347384 _____ (ESET) C:\Users\Jonas *****\Desktop\esetsmartinstaller_deu.exe
2015-05-13 03:16 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 00:21 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 00:21 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 00:21 - 2015-04-27 21:11 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 00:21 - 2015-04-27 21:11 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 00:21 - 2015-04-27 21:08 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00851456 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 00:21 - 2015-04-27 21:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 00:21 - 2015-04-27 21:04 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 00:21 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 00:21 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 00:21 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 00:21 - 2015-04-27 21:04 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 00:21 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 00:21 - 2015-04-27 21:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 00:21 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 00:21 - 2015-04-27 21:04 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 00:21 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 00:21 - 2015-04-27 21:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 00:21 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 00:21 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 00:21 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 00:21 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 00:21 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 00:21 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 00:21 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 00:21 - 2015-04-27 20:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 00:21 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 00:20 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 00:20 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 00:20 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 00:20 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 00:20 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 00:20 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 00:20 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 00:20 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 00:20 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 00:20 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 00:20 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 00:20 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 00:20 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 00:20 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 00:20 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 00:20 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 00:20 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 00:20 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 00:20 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 00:20 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 00:20 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 00:20 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 00:20 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 00:20 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 00:20 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 00:20 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 00:20 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 00:20 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 00:20 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 00:20 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 00:20 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 00:20 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 00:20 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 00:20 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 00:19 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 00:19 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 00:19 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 00:19 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 00:16 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 00:16 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 00:16 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 00:16 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 00:16 - 2015-03-04 06:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 00:16 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 00:16 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-12 00:10 - 2015-05-12 00:10 - 00014373 _____ () C:\Users\Jonas *****\Desktop\ComboFix.txt
2015-05-12 00:04 - 2015-05-12 00:04 - 00014368 _____ () C:\ComboFix.txt
2015-05-11 23:36 - 2015-05-12 00:04 - 00000000 ____D () C:\ComboFix
2015-05-11 23:36 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-11 23:36 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-11 23:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-11 23:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-11 23:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-11 23:36 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-11 23:36 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-11 23:36 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-11 23:34 - 2015-05-12 00:04 - 00000000 ____D () C:\Qoobox
2015-05-11 23:33 - 2015-05-12 00:02 - 00000000 ____D () C:\Windows\erdnt
2015-05-11 23:31 - 2015-05-11 23:31 - 05623215 ____R (Swearware) C:\Users\Jonas *****\Desktop\ComboFix.exe
2015-05-07 23:24 - 2015-05-07 23:25 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Jonas *****\Desktop\tdsskiller.exe
2015-05-07 21:29 - 2015-05-07 21:29 - 00003574 _____ () C:\Users\Jonas *****\Desktop\Gmer.txt
2015-05-07 21:01 - 2015-05-18 12:04 - 00000000 ____D () C:\FRST
2015-05-07 20:58 - 2015-05-07 20:58 - 00000000 _____ () C:\Users\Jonas *****\defogger_reenable
2015-05-07 18:56 - 2015-05-18 11:43 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-07 18:55 - 2015-05-07 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-07 18:55 - 2015-05-07 20:34 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-05-07 18:55 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-07 18:55 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-28 16:10 - 2015-04-28 16:10 - 00008862 _____ () C:\Users\Jonas *****\.recently-used.xbel

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-18 12:05 - 2013-05-08 14:16 - 00693248 ____H () C:\Users\Jonas *****\Documents\.csync_journal.db.ctmp
2015-05-18 12:05 - 2013-05-08 14:16 - 00693248 ____H () C:\Users\Jonas *****\Documents\.csync_journal.db
2015-05-18 12:04 - 2010-11-28 15:15 - 00000000 ____D () C:\ProgrammeJonas
2015-05-18 11:56 - 2012-08-06 19:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-18 11:48 - 2010-11-26 05:51 - 02034379 _____ () C:\Windows\WindowsUpdate.log
2015-05-18 11:18 - 2010-11-25 22:14 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-17 23:55 - 2009-07-14 06:34 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-17 23:55 - 2009-07-14 06:34 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-17 23:45 - 2010-11-25 22:14 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-17 23:44 - 2010-08-30 11:48 - 00827038 _____ () C:\Windows\PFRO.log
2015-05-17 23:44 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-17 23:44 - 2009-07-14 06:39 - 00130435 _____ () C:\Windows\setupact.log
2015-05-14 05:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-05-14 02:44 - 2010-11-25 22:14 - 00002125 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-13 17:13 - 2012-06-18 08:27 - 00000000 ____D () C:\Users\Jonas *****\Documents\EigenePDFs
2015-05-13 10:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-13 09:26 - 2010-08-28 02:49 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-13 03:45 - 2010-08-30 18:46 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-13 03:45 - 2009-07-14 06:33 - 00345272 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 03:43 - 2009-07-14 09:49 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 03:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-13 03:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 03:15 - 2013-07-21 03:01 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 03:08 - 2010-08-30 18:47 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 03:05 - 2010-08-30 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-12 00:37 - 2014-06-25 01:22 - 00000000 ____D () C:\Users\Jonas *****\Documents\Bilder
2015-05-12 00:04 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-05-11 23:57 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-11 22:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Help
2015-05-07 20:58 - 2010-11-25 22:19 - 00000000 ____D () C:\Users\Jonas *****
2015-05-07 20:34 - 2014-01-06 12:33 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-07 18:57 - 2015-01-15 23:11 - 00000000 ____D () C:\Users\Jonas *****\AppData\Local\Wunderlist
2015-05-07 18:55 - 2014-01-06 12:33 - 00000000 ____D () C:\Users\Jonas *****\AppData\Roaming\Malwarebytes
2015-05-07 18:55 - 2014-01-06 12:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-07 18:55 - 2014-01-06 12:33 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2015-05-07 18:52 - 2014-01-05 14:22 - 00000000 ____D () C:\ProgramData\Updater
2015-05-04 20:46 - 2014-04-03 10:19 - 00000000 ____D () C:\Users\Jonas *****\Desktop\Christina
2015-04-28 16:11 - 2011-12-14 11:53 - 00000000 ____D () C:\Users\Jonas *****\.gimp-2.6
2015-04-28 16:10 - 2010-12-07 22:31 - 00000000 ____D () C:\Users\Jonas *****\AppData\Roaming\gtk-2.0
2015-04-28 16:07 - 2015-04-11 21:32 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-28 16:07 - 2012-07-07 01:19 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-28 16:07 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-22 13:47 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-20 15:22 - 2011-01-10 00:59 - 00000000 ____D () C:\Users\Jonas *****\Documents\Studium

==================== Files in the root of some directories =======

2012-02-13 17:10 - 2012-02-13 17:10 - 0000085 ___SH () C:\ProgramData\.zreglib
2014-05-29 00:36 - 2014-09-18 01:22 - 0002097 _____ () C:\ProgramData\flcd_proxy.log
2011-12-13 14:19 - 2011-12-13 14:25 - 0000355 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Jonas *****\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-14 05:45

==================== End Of Log ============================

--- --- ---

[/CODE]

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-05-2015 02
Ran by Jonas ***** at 2015-05-18 12:05:49
Running from C:\ProgrammeJonas
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1471510115-2474919708-3564051268-500 - Administrator - Disabled)
Gast (S-1-5-21-1471510115-2474919708-3564051268-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1471510115-2474919708-3564051268-1002 - Limited - Enabled)
Jonas ***** (S-1-5-21-1471510115-2474919708-3564051268-1001 - Administrator - Enabled) => C:\Users\Jonas *****

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 15.0.0.249 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.8.612 - Adobe Systems, Inc.)
Anki (HKLM\...\Anki) (Version:  - )
Apple Application Support (HKLM\...\{343666E2-A059-48AC-AD67-230BF74E2DB2}) (Version: 2.1.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{8153ED9A-C94A-426E-9880-5E6775C08B62}) (Version: 4.0.0.97 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{BE4AE3A7-190D-BCB8-A953-A708C9E8E8AA}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Avira (HKLM\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
BlueJ 3.0.4 (HKLM\...\BlueJ_is1) (Version:  - La Trobe University)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
ccc-core-static (Version: 2010.0527.1242.20909 - ATI) Hidden
CdCreate AM Testversion (HKLM\...\{98667FC9-D57F-11DD-B64E-93631AE7A456}) (Version: 2.80.0000 - Galerie Fuchstal)
Cinergy T Stick RC V86.001.1129.2011 (HKLM\...\Cinergy T Stick RC) (Version: 86.001.1129.2011 - )
Cinergy T USB XXS V2.03.03.29 (HKLM\...\Cinergy T USB XXS) (Version: 2.03.03.29 - )
Cinergy T-Stick MKII V9.06.3.01 (HKLM\...\Cinergy T-Stick MKII) (Version: 9.06.3.01 - )
CorelDRAW Essentials 4 - Content (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Draw (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Filters (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - ICA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang BR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang DE (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang EN (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang ES (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang FR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang IT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang NL (Version: 4.0 - Uw bedrijfsnaam) Hidden
CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Windows Shell Extension (HKLM\...\_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1 - Corel Corporation) Hidden
CorelDRAW Essentials 4 (HKLM\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2515 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)
CyberLink PowerDVD Copy (HKLM\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DocProc (Version: 13.0.0.0 - Hewlett-Packard) Hidden
ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.3.14949 - Landesfinanzdirektion Thüringen)
FIFA 2003 (HKLM\...\{6A1DC8D4-9FA4-43C3-00B3-5993B4BBE7D4}) (Version:  - )
Funkyplot 1.1.0-pre1 (HKLM\...\Funkyplot_is1) (Version:  - LOGICIEL)
GIMP 2.6.11 (HKLM\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.05) (Version: 9.05 - Artifex Software Inc.)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Scanjet G4000 Series (HKLM\...\{10297E58-2DFE-478B-9A1D-4B14E4E79CDF}) (Version: 13.0 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
hpg4000 (Version: 13.0.0.0 - Ihr Firmenname) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
iTunes (HKLM\...\{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}) (Version: 10.5.3.3 - Apple Inc.)
Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Java DB 10.5.3.0 (HKLM\...\{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}) (Version: 10.5.3.0 - Sun Microsystems, Inc)
Java(TM) SE Development Kit 6 Update 23 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0160230}) (Version: 1.6.0.230 - Oracle)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Kalenderchen 6 (HKU\S-1-5-21-1471510115-2474919708-3564051268-1001\...\Kalenderchen 6) (Version:  - )
Kalenderchen 6 (HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Kalenderchen 6) (Version:  - )
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MATLAB R2009b (HKLM\...\MatlabR2009b) (Version: 7.9 - The MathWorks, Inc.)
Media Markt Fotoservice 4.4 (HKLM\...\Media Markt Fotoservice_is1) (Version:  - )
Medion Home Cinema (HKLM\...\InstallShield_{AB770FDE-8087-4C98-9A85-BD64262C104C}) (Version: 6.0.0000 - CyberLink Corp.) <==== ATTENTION
Medion Home Cinema (Version: 6.0.0000 - CyberLink Corp.) Hidden <==== ATTENTION
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office XP Developer - German (HKLM\...\Microsoft Office XP Developer - German) (Version:  - )
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.9 (HKU\S-1-5-21-1471510115-2474919708-3564051268-1001\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
MiKTeX 2.9 (HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
MOD 10.0 Baseline (English-x86-CD) (Version: 7.00.9177 - Microsoft) Hidden
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OpenOffice.org 3.2 (HKLM\...\{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}) (Version: 3.2.9502 - OpenOffice.org)
ownCloud (HKLM\...\ownCloud) (Version: 1.2.5 - ownCloud, Inc)
PDF24 Creator 6.9.2 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Project64 1.6 (HKLM\...\{9559F7CA-5E34-4237-A2D9-D856464AD727}) (Version: 1.6 - Project64)
R for Windows 3.1.1 (HKLM\...\R for Windows 3.1.1_is1) (Version: 3.1.1 - R Core Team)
Realtek Ethernet Controller Driver For Windows 7 (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6136 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.4.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.0.4.0 - Renesas Electronics Corporation) Hidden
RStudio (HKLM\...\RStudio) (Version: 0.98.983 - RStudio)
Scan (Version: 13.0.0.0 - Hewlett-Packard) Hidden
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Stellar Phoenix Windows Data Recovery-Home (HKLM\...\Stellar Phoenix Windows Data Recovery-Home_is1) (Version: 4.2.0.0 - Stellar Information Systems Ltd)
TerraTec Home Cinema (HKLM\...\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}) (Version: 6.25.6 - ) <==== ATTENTION
Texmaker (HKLM\...\Texmaker) (Version:  - )
TIPP10 Version 2.1.0 (HKLM\...\TIPP10_is1) (Version:  - (c) 2006-2011, Tom Thielicke IT Solutions)
TmNationsForever (HKLM\...\TmNationsForever_is1) (Version:  - Nadeo)
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
WinRAR 4.00 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
WISO Mein Geld 2011 Professional (HKLM\...\WISO Mein Geld 2011 Professional) (Version:  - Buhl Data Service GmbH)
WISO Mein Geld 2011 Professional (Version: 12.00.02.0024 - Buhl Data Service GmbH) Hidden
WISO Steuer-Sparbuch 2014 (HKLM\...\{F03AAE28-2598-4490-AB26-2B35A0E58828}) (Version: 21.08.8679 - Buhl Data Service GmbH)
Wunderlist (HKLM\...\{1ca68332-4ba1-4943-9010-eaa1aa45b492}) (Version: 2.3.0.31 - 6 Wunderkinder GmbH)
Wunderlist (Version: 2.3.0.31 - 6 Wunderkinder GmbH) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

11-05-2015 23:05:33 Windows Update
13-05-2015 03:00:36 Windows Update
17-05-2015 23:59:54 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2015-05-11 23:52 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {25841487-1C33-40BF-8120-5494E99B5656} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {3212333B-1F16-4C10-98F4-7C75FAA9E40A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {4FB622F1-A454-4F6B-BEB4-F71C1A08B1D9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {51216052-0F20-4386-B40C-C710038DBAD8} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {59D093B0-92DA-42A3-A9BF-2B349A2CB79F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {61F13637-483C-42D4-927C-F8099A17FB78} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {6F151318-12A0-4D00-8F09-2EC27733568C} - System32\Tasks\{422FC7C0-2347-4491-A45A-99E34858989B} => pcalua.exe -a C:\Windows\LargoWinchInst\SetupUbi.exe -c -uninstall Largo
Task: {8A6329B5-0F52-4A46-8FEF-B34930A60984} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {D0B8CBAD-B240-4E45-A1BD-7AFF085A8504} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D67732B8-E5A2-4676-A3D6-7F013BF6DAFC} - System32\Tasks\{B86A33F0-D926-4927-A51E-BF2C8D32A885} => pcalua.exe -a C:\WINDOWS\ISUN0407.EXE -c -f"c:\program files\Uninst.isu" -c"c:\program files\Uninst.dll"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2008-09-08 11:19 - 2008-09-08 11:19 - 00022723 _____ () C:\Windows\System32\cl31cl3.dll
2011-11-02 00:26 - 2011-11-02 00:26 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-11-02 00:26 - 2011-11-02 00:26 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2013-04-22 17:00 - 2013-04-22 17:00 - 01253540 _____ () C:\Program Files\ownCloud\owncloud.exe
2012-12-21 15:27 - 2012-12-21 15:27 - 00106700 _____ () C:\Program Files\ownCloud\zlib1.dll
2012-12-22 03:16 - 2012-12-22 03:16 - 00120916 _____ () C:\Program Files\ownCloud\libgcc_s_sjlj-1.dll
2012-12-22 03:16 - 2012-12-22 03:16 - 00864381 _____ () C:\Program Files\ownCloud\libstdc++-6.dll
2012-12-21 15:32 - 2012-12-21 15:32 - 00176680 _____ () C:\Program Files\ownCloud\libpng15-15.dll
2013-04-22 16:58 - 2013-04-22 16:58 - 00816147 _____ () C:\Program Files\ownCloud\libowncloudsync.dll
2013-02-21 16:59 - 2013-02-21 16:59 - 00074118 _____ () C:\Program Files\ownCloud\libqtkeychain.dll
2013-04-22 16:56 - 2013-04-22 16:56 - 00834505 _____ () C:\Program Files\ownCloud\libocsync.dll
2012-12-21 22:13 - 2012-12-21 22:13 - 00038291 _____ () C:\Program Files\ownCloud\libdl.dll
2013-02-04 23:07 - 2013-02-04 23:07 - 00044685 _____ () C:\Program Files\ownCloud\libiniparser.dll
2012-12-21 20:02 - 2012-12-21 20:02 - 00567611 _____ () C:\Program Files\ownCloud\libsqlite3-0.dll
2013-04-22 16:56 - 2013-04-22 16:56 - 00434214 _____ () C:\Program Files\ownCloud\modules\ocsync_owncloud.dll
2013-02-08 22:22 - 2013-02-08 22:22 - 00177844 _____ () C:\Program Files\ownCloud\libneon-27.dll
2012-12-22 07:10 - 2012-12-22 07:10 - 00186070 _____ () C:\Program Files\ownCloud\libproxy.dll
2012-12-22 06:34 - 2012-12-22 06:34 - 00065360 _____ () C:\Program Files\ownCloud\libmodman.dll
2012-12-21 15:36 - 2012-12-21 15:36 - 01161037 _____ () C:\Program Files\ownCloud\libxml2-2.dll
2015-01-09 12:24 - 2015-01-09 12:24 - 01166336 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ReactiveUI\1a96a8c1c19e0195d67a9950d1f4d527\ReactiveUI.ni.dll
2015-01-09 12:24 - 2015-01-09 12:24 - 00027136 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Wunderkinde6f42a4a9#\bcb87239e984b283cc128a55e9bc3aaf\Wunderkinder.Wunderlist.Data.Realtime.ni.dll
2015-01-09 12:24 - 2015-01-09 12:24 - 00376320 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Akavache.Portable\47d6f1dd3d6ffb3bc16647055208cdfb\Akavache.Portable.ni.dll
2015-01-09 12:24 - 2015-01-09 12:24 - 00039424 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Wunderkinded9c6edae#\af819191c1a5d188230c5ce0bfb68220\Wunderkinder.Wunderlist.Presentation.ni.dll
2010-05-27 21:40 - 2010-05-27 21:40 - 00270336 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-05-04 16:36 - 2010-05-04 16:36 - 00970752 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll
2010-03-24 22:51 - 2010-11-28 15:45 - 00166400 _____ () C:\Program Files\OpenOffice.org 3\program\libxslt.dll
2014-10-16 03:50 - 2014-10-16 03:50 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3d576cbc4ffc5ad06fd61510c5d8f326\IsdiInterop.ni.dll
2010-08-30 20:04 - 2010-03-04 05:08 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1471510115-2474919708-3564051268-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jonas *****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Jonas *****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [TCP Query User{DC794C29-32CC-4974-9400-D80C6A3F4F00}C:\programmejonas\taxi raser\taxi raser.exe] => (Block) C:\programmejonas\taxi raser\taxi raser.exe
FirewallRules: [UDP Query User{1A82D905-EDDA-463E-89AB-1F7EB5A51EEA}C:\programmejonas\taxi raser\taxi raser.exe] => (Block) C:\programmejonas\taxi raser\taxi raser.exe
FirewallRules: [TCP Query User{ED38330D-DEB7-453D-91AA-4ADF5A6425CD}C:\programmejonas\eclipse-sdk-3.6.2-win32\eclipse\eclipse.exe] => (Block) C:\programmejonas\eclipse-sdk-3.6.2-win32\eclipse\eclipse.exe
FirewallRules: [UDP Query User{84894ECA-9CB8-4F76-8845-B3B5AF85FC23}C:\programmejonas\eclipse-sdk-3.6.2-win32\eclipse\eclipse.exe] => (Block) C:\programmejonas\eclipse-sdk-3.6.2-win32\eclipse\eclipse.exe
FirewallRules: [{FF002A04-FA73-4000-A11C-3BEE45B6CE28}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{5231EEC6-9410-4F31-9391-6AF6F00D3A25}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{C2518630-9012-4A03-8418-6D8580618524}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{55FBD93D-AB58-449B-B772-578D8BC5EBCB}] => (Allow) C:\Program Files\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{3FDB65D5-AD0B-4628-9FDC-5CD0E939A126}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{ED88D7B2-7241-4E41-8DED-87E6BF922CE4}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{E9AEA340-D6A4-4EEB-838E-C3D45E8ACEF9}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{17F8A429-7A05-4077-A934-3D180CA8968C}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{30FF85D6-7CE6-4ED9-8099-FC43AE8A56F6}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{83DEC76E-9F83-4302-AEE7-96E03014CFE7}] => (Allow) C:\Program Files\HP\hp software update\hpwucli.exe
FirewallRules: [{5AEA1869-BACB-4F1F-815D-4C453A802D9E}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\CinergyDvr.exe
FirewallRules: [{B963AE06-7617-43F6-AAA9-9D6E092FDF78}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\CinergyDvr.exe
FirewallRules: [{F1D9C10F-7210-40A8-B8D5-AE7D4FA53A4C}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe
FirewallRules: [{826F9D84-EE9C-49CC-BF6D-5467E0572A2E}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe
FirewallRules: [{DC5B8CE3-C71D-491B-9C1B-BAAD08A5FBF8}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\InstTool.exe
FirewallRules: [{227EE136-2668-475D-AAFA-0E0C18E3A910}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\InstTool.exe
FirewallRules: [{5ADE8544-17EB-4B32-B973-F37F7FB9292F}] => (Allow) C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{B928DD33-32A6-4558-9B6C-1E6C138C5798}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{8822F8D9-2068-4F15-B96B-27337BB85C81}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{CB9381BD-BA39-4C0D-9201-806A3BD36C15}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{45F8B089-9F2A-4C01-8EAE-4346F8C007DA}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\InstTool.exe
FirewallRules: [{AAEE0B9D-1D90-4D0F-A441-2A5050AF960D}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\InstTool.exe
FirewallRules: [{4EB951AF-E1B3-4857-A07E-EA1B78E57990}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\CinergyDvr.exe
FirewallRules: [{6C1E7793-6B0E-4208-9D2B-BBAFC15BA223}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\CinergyDvr.exe
FirewallRules: [{A9F559C6-EA9A-4A99-9BBD-4FBCBC447E5B}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe
FirewallRules: [{2CABA8DC-F77E-4B3A-91C4-E4C3D671D6D4}] => (Allow) C:\Program Files\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe
FirewallRules: [TCP Query User{E1F4401C-95BD-402C-9DB4-9F80F23C836A}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe] => (Allow) C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe
FirewallRules: [UDP Query User{A919A04F-22E9-4F1C-B419-581BF64F03CA}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe] => (Allow) C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe
FirewallRules: [TCP Query User{B018C01A-B6F6-45E0-A11C-3B0811DA2F0C}C:\programmejonas\eclipse-sdk-3.6.2-win32\eclipse\eclipse.exe] => (Block) C:\programmejonas\eclipse-sdk-3.6.2-win32\eclipse\eclipse.exe
FirewallRules: [UDP Query User{7A80BBCD-6AE9-4145-80D3-60AF268FC900}C:\programmejonas\eclipse-sdk-3.6.2-win32\eclipse\eclipse.exe] => (Block) C:\programmejonas\eclipse-sdk-3.6.2-win32\eclipse\eclipse.exe
FirewallRules: [TCP Query User{BE522805-BD65-4391-A54F-89CA1E987E64}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe] => (Allow) C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe
FirewallRules: [UDP Query User{16FD6222-9F6C-43C5-907F-58406A0F91CE}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe] => (Allow) C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe
FirewallRules: [{E2A31A10-9C22-4670-8319-E3C537BD8719}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{C8B0BC7D-986C-40EF-8960-5DEAE2708BD1}C:\program files\tmnationsforever\tmforever.exe] => (Block) C:\program files\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{D840C2DE-7340-4F8B-ADED-9D4E8A1AB6F2}C:\program files\tmnationsforever\tmforever.exe] => (Block) C:\program files\tmnationsforever\tmforever.exe
FirewallRules: [{4A03E388-E847-4603-85B5-7A21F6E5B28C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{955432A8-C4B0-44C3-A0B0-2230049D6B4C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1F81D1E8-5D16-4DD7-8E17-410EB255B372}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{EFDBDE91-E0F8-470B-AA2F-750FACF6BFFC}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{C41E0464-480B-422F-BB9B-07B60BA16214}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/18/2015 03:35:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10047

Error: (05/18/2015 03:35:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10047

Error: (05/18/2015 03:35:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/18/2015 02:46:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15600

Error: (05/18/2015 02:46:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15600

Error: (05/18/2015 02:46:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/15/2015 09:38:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15647

Error: (05/15/2015 09:38:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15647

Error: (05/15/2015 09:38:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/15/2015 03:09:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9969


System errors:
=============
Error: (05/17/2015 11:45:30 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (05/15/2015 09:38:53 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{9A295CD5-A244-421C-A8EF-9E3A343737CB} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (05/13/2015 03:48:07 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: Fehler beim Starten des Assistenten für das Sprachpaket-Setup. Führen Sie einen Neustart des Systems aus, und führen Sie den Assistenten erneut aus.

Error: (05/13/2015 03:48:07 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1000) (User: NT-AUTORITÄT)
Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x80080005

Error: (05/13/2015 03:48:07 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}

Error: (05/13/2015 03:48:06 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 
%%16405

Error: (05/12/2015 11:50:00 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (05/12/2015 00:12:12 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (05/11/2015 11:53:46 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎11.‎05.‎2015 um 23:52:52 unerwartet heruntergefahren.

Error: (05/11/2015 11:45:20 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================
Error: (05/18/2015 03:35:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10047

Error: (05/18/2015 03:35:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10047

Error: (05/18/2015 03:35:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/18/2015 02:46:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15600

Error: (05/18/2015 02:46:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15600

Error: (05/18/2015 02:46:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/15/2015 09:38:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15647

Error: (05/15/2015 09:38:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15647

Error: (05/15/2015 09:38:02 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/15/2015 03:09:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9969


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU 550 @ 3.20GHz
Percentage of memory in use: 51%
Total physical RAM: 3063.11 MB
Available physical RAM: 1478.93 MB
Total Pagefile: 6124.54 MB
Available Pagefile: 3557.47 MB
Total Virtual: 2047.88 MB
Available Virtual: 1903.32 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:1356.17 GB) (Free:1101.07 GB) NTFS
Drive d: (Recover) (Fixed) (Total:40 GB) (Free:20.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1397.3 GB) (Disk ID: 2BD2C32A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1356.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================

deeprybka · 18.05.2015, 20:16

Hi,
sieht OK aus.

Schritt 1

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

Code:

ATTFilter

CloseProcesses:
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
FF Plugin HKU\S-1-5-21-1471510115-2474919708-3564051268-1001: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin HKU\S-1-5-21-1471510115-2474919708-3564051268-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @lightspark.github.com/

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

Starte FRST und drücke auf den Fix-Button.
Das Tool erstellt eine "Fixlog.txt" -Datei.
Das Log brauchst Du nicht posten!

Die alten Java-Versionen deinstallieren und bei Bedarf mit der aktuellen ersetzen.

>>clean<<
Wir haben es geschafft!

Die Logs sehen für mich im Moment sauber aus.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...

und/oder das Forum mit einer kleinen Spende unterstützen.

Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen.

Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte

DelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.

Meine Kauf-Empfehlung:

ESET Smart Security

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware scannen.

Optional:

NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie

.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Patroklos91 · 19.05.2015, 08:12

Hi deeprybka,

vielen, vielen Dank für deine überragende Hilfe! Du hast immer zeitnah geantwortet und genaue Anweisungen gegeben, wie es weitergehen soll. Das war perfekt!

Eine Frage zum Cleanup: Ich habe ja Combofix benutzt, aber der Aufruf "Combofix/Uninstall" führt stets zu einer Meldung, dass dieser Befehl nicht gefunden werden kann. Soll ich dann diesen Punkt überspringen und einfach mit dem nächsten Cleanup-Schritt weitermachen?

Beste Grüße,
Patroklos

deeprybka · 19.05.2015, 08:15

Hi, Du kannst die combofix.exe auch in uninstall.exe umbenennen und doppelklicken. Oder einfach weiter mit DelFix.

Patroklos91 · 20.05.2015, 13:37

Hi deeprybka,

jetzt habe ich deine Aufträge erfolgreich zu Ende gebracht. Vielen Dank nochmal für deine zuverlässige Unterstützung! Einfach großartig ...

Gruß und hoffentlich nicht "bis bald",
Patroklos

deeprybka · 20.05.2015, 18:34

Gerne. Alles Gute!

13.05.2015, 20:08	#16
deeprybka /// TB-Ausbilder /// Anleitungs-Guru	Windows 7: E-Mail vom falschen DHL-Absender samt Anhang geöffnet Ja, außer Du bist Dir sicher, dass da keine Malware drauf ist. __________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

14.05.2015, 12:42	#18
deeprybka /// TB-Ausbilder /// Anleitungs-Guru	Windows 7: E-Mail vom falschen DHL-Absender samt Anhang geöffnet Keine Malware gefunden. Poste dann am Sonntag mal ein frisches FRST-Log bitte. __________________ __________________

20.05.2015, 18:34	#24
deeprybka /// TB-Ausbilder /// Anleitungs-Guru	Windows 7: E-Mail vom falschen DHL-Absender samt Anhang geöffnet Gerne. Alles Gute! __________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Windows 7: E-Mail vom falschen DHL-Absender samt Anhang geöffnet

Log-Analyse und Auswertung: Windows 7: E-Mail vom falschen DHL-Absender samt Anhang geöffnet