gefälschten Link von Immobilienwebsite geöffnet, Malware oder Phising?Hilfe

schrauber · 16.07.2015, 07:48

Ok, dann schauen wir mal von aussen:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

timey89 · 16.07.2015, 08:12

Hey Schrauber,

vielen Dank für die Hilfe.

Können dabei Dateien verloren gehen, bzw. hat es etwas mit formatieren zu tun?

Wie gesagt, es ist nicht mein Rechner und ich habe keine CD o.ä. dazu und der Laptop hat auch kein Laufwerk (externes nicht vorhanden).

Wenn ich jetzt nochmals alle Daten sichere, sichere ich dann auch den Virus, Trojaner mit ab?

schrauber · 16.07.2015, 10:08

Da wird nix geöscht, wir machen ja nur einen Scan

. Nicht ausführbare Daten (Musik, Texte, Videos, Bilder) kannste auf jeden Fall sichern.

timey89 · 16.07.2015, 16:41

okay, habe ich durchlaufen lassen:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-07-2015
Ran by SYSTEM on MININT-JHK7ONF on 16-07-2015 17:20:54
Running from d:\
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-08-11] (Alcor Micro Corp.)
HKLM\...\Run: [ClientAppLogon] => C:\Program Files\TrueSuite\TrueSuite.ClientAppLogonExe.exe [420672 2010-11-12] (AuthenTec, Inc.)
HKLM\...\Run: [ClientAppLogon32] => C:\Program Files\TrueSuite\x86\TrueSuite.ClientAppLogonExe.exe [307520 2010-11-12] (AuthenTec, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2283816 2010-08-12] (Synaptics Incorporated)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [92456 2010-08-12] (Synaptics Incorporated)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-01] (NVIDIA Corporation)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [FLxHCIm] => C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [40448 2011-02-24] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Timm\...\Run: [Dropbox Update] => C:\Users\Timm\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-07-16] (Dropbox, Inc.)
Startup: C:\Users\Timm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-04-25]
ShortcutTarget: Dropbox.lnk -> C:\windows\system32\config\systemprofile\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
SSODL: EldosMountNotificator-cbfs4 - {A5A27988-B099-4629-AE34-58BE9E3E9311} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {A5A27988-B099-4629-AE34-58BE9E3E9311} -  No File

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-20] (Avira Operations GmbH & Co. KG)
S2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
S2 FPLService; C:\Program Files\TrueSuite\TrueSuite.Service.exe [290112 2010-11-12] (AuthenTec, Inc)
S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-01] (NVIDIA Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-01] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-01] (NVIDIA Corporation)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] ()
S2 ServiceControl_RTE23_3S_GmbH; C:\Program Files (x86)\3S Software\CoDeSys SP RTE\ServiceControl_RTE23.exe [188551 2014-04-09] (3S-Smart Software Solutions GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 athr; C:\Windows\system32\DRIVERS\athwnx.sys [3680256 2013-06-18] (Qualcomm Atheros Communications, Inc.)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-20] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132656 2015-06-20] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-08-15] (Avira Operations GmbH & Co. KG)
S2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
S1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 FLxHCIh; C:\Windows\System32\drivers\FLxHCIh.sys [81920 2011-02-24] (Fresco Logic)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-07-16] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-01] (NVIDIA Corporation)
S3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 vpnpbus; C:\Windows\System32\drivers\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S4 WinDivert1.1; C:\Program Files\KMSpico\WinDivert.sys [35376 2014-09-03] (Basil Projects)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-16 15:45 - 2015-07-16 15:45 - 02133504 _____ (Farbar) C:\Users\Timm\Downloads\FRST64 (3).exe
2015-07-16 15:35 - 2015-07-16 15:35 - 00001178 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1832302014-2846907121-421425406-1001Core.job
2015-07-16 15:35 - 2015-07-16 15:35 - 00000000 ____D C:\Users\\AppData\Local\Dropbox
2015-07-16 15:35 - 2015-07-16 15:35 - 00000000 ____D C:\ProgramData\Dropbox
2015-07-16 15:31 - 2015-07-16 15:31 - 00010472 _____ C:\Users\\Desktop\Gehalt.xlsx
2015-07-15 17:04 - 2015-07-15 17:04 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\\Downloads\tdsskiller (3).exe
2015-07-13 18:59 - 2015-07-13 18:59 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\\Downloads\tdsskiller (2).exe
2015-07-12 17:13 - 2015-07-12 17:13 - 02130944 _____ (Farbar) C:\Users\Downloads\FRST64 (2).exe
2015-07-12 17:12 - 2015-07-12 17:12 - 00001259 _____ C:\Users\\Desktop\JRT.txt
2015-07-12 17:07 - 2015-07-12 17:07 - 02130944 _____ (Farbar) C:\Users\\Downloads\FRST64 (1).exe
2015-07-12 16:59 - 2015-07-12 16:59 - 00000207 _____ C:\Windows\tweaking.com-regbackup--Windows-8.1-Pro-(64-bit).dat
2015-07-12 16:59 - 2015-07-12 16:59 - 00000000 ____D C:\RegBackup
2015-07-12 16:58 - 2015-07-12 16:58 - 03034102 _____ (Malwarebytes Corporation) C:\Users\\Downloads\JRT.exe
2015-07-12 16:49 - 2015-07-12 16:49 - 00001600 _____ C:\Users\\Desktop\AdwCleaner[S1].txt
2015-07-12 16:45 - 2015-07-12 16:45 - 00001541 _____ C:\Users\\Desktop\AdwCleaner[R1].txt
2015-07-12 16:41 - 2015-07-12 16:41 - 02248704 _____ C:\Users\\Downloads\AdwCleaner_4.208 (2).exe
2015-07-12 11:22 - 2015-07-12 11:53 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-07-12 11:05 - 2015-07-12 11:05 - 16502728 _____ (Malwarebytes Corp.) C:\Users\\Downloads\mbar-1.09.1.1004 (1).exe
2015-07-12 11:00 - 2015-07-12 11:53 - 00000000 ____D C:\Users\\Desktop\mbar
2015-07-12 10:59 - 2015-07-12 10:59 - 16502728 _____ (Malwarebytes Corp.) C:\Users\\Downloads\mbar-1.09.1.1004.exe
2015-07-12 09:11 - 2015-07-12 09:24 - 00000000 ____D C:\ProgramData\F-Secure
2015-07-12 09:11 - 2015-07-12 09:11 - 00816680 _____ (F-Secure Corporation) C:\Users\Timm\Downloads\F-SecureNetworkInstaller_AV-ESTORE-TRIAL-GLOBAL_.exe
2015-07-12 09:11 - 2015-07-12 09:11 - 00000000 ____D C:\Users\\AppData\Local\F-Secure
2015-07-12 09:01 - 2015-07-12 09:01 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Timm\Downloads\tdsskiller (1).exe
2015-07-12 08:58 - 2015-07-12 08:58 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Timm\Downloads\tdsskiller.exe
2015-07-12 07:54 - 2015-07-12 07:55 - 00031372 _____ C:\Users\\Downloads\Addition.txt
2015-07-12 07:52 - 2015-07-12 17:15 - 00038020 _____ C:\Users\\Downloads\FRST.txt
2015-07-12 07:52 - 2015-07-12 17:15 - 00000000 ____D C:\FRST
2015-07-12 07:52 - 2015-07-12 07:52 - 02130944 _____ (Farbar) C:\Users\\Downloads\FRST64.exe
2015-07-12 06:20 - 2015-07-12 06:20 - 00002885 _____ C:\Users\\Desktop\durchlauf20150712.txt
2015-07-11 21:19 - 2015-07-16 16:11 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2015-07-11 21:19 - 2015-07-12 11:05 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2015-07-11 21:19 - 2015-07-11 21:19 - 00001114 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-11 21:19 - 2015-07-11 21:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-11 21:19 - 2015-07-11 21:19 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-11 21:19 - 2015-04-14 08:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2015-07-11 21:19 - 2015-04-14 08:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2015-07-11 21:17 - 2015-07-11 21:17 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\\Downloads\mbam-setup-2.1.6.1022.exe
2015-07-11 21:04 - 2015-07-11 21:04 - 02314104 _____ C:\Users\\Downloads\avira10_pc_cleaner_de.exe
2015-07-11 21:04 - 2015-07-11 21:04 - 00002034 _____ C:\Users\\Desktop\Entfernen des Avira PC Cleaners.lnk
2015-07-11 21:04 - 2015-07-11 21:04 - 00001978 _____ C:\Users\\Desktop\Avira PC Cleaner.lnk
2015-07-11 20:56 - 2015-07-11 20:56 - 02248704 _____ C:\Users\\Downloads\adwcleaner_4.208 (1).exe
2015-07-11 20:51 - 2015-07-12 16:46 - 00000000 ____D C:\AdwCleaner
2015-07-11 20:51 - 2015-07-11 20:51 - 02248704 _____ C:\Users\\Downloads\adwcleaner_4.208.exe
2015-07-11 20:47 - 2015-07-11 20:47 - 00000000 ____D C:\ProgramData\TEMP
2015-07-11 20:47 - 2015-07-11 20:47 - 00000000 ____D C:\ProgramData\Licenses
2015-07-11 20:42 - 2015-07-11 20:42 - 35218576 _____ (Simply Super Software ) C:\Users\\Downloads\trjsetup692.exe
2015-06-28 14:15 - 2015-06-28 14:15 - 00262144 _____ C:\Windows\Minidump\062815-20296-01.dmp
2015-06-26 18:23 - 2015-06-26 18:23 - 00262144 _____ C:\Windows\Minidump\062615-34875-01.dmp
2015-06-21 07:37 - 2015-06-21 07:37 - 00000000 ____D C:\Users\\AppData\Local\PDF24
2015-06-21 07:28 - 2015-06-21 07:28 - 00001091 _____ C:\Users\Public\Desktop\PDF24 Creator.lnk
2015-06-21 07:28 - 2015-06-21 07:28 - 00000000 ____D C:\Program Files (x86)\PDF24
2015-06-21 07:26 - 2015-06-21 07:26 - 01198368 _____ C:\Users\\Downloads\PDF24 Creator - CHIP-Installer.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-16 16:16 - 2014-09-03 18:37 - 01948559 _____ C:\Windows\WindowsUpdate.log
2015-07-16 16:16 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-16 16:13 - 2015-04-08 18:15 - 00005100 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for 
2015-07-16 16:13 - 2014-09-04 08:23 - 00000000 ____D C:\ProgramData\Kodak
2015-07-16 16:13 - 2014-09-03 19:02 - 00000000 ____D C:\ProgramData\NVIDIA
2015-07-16 16:13 - 2013-08-22 15:46 - 00063713 _____ C:\Windows\setupact.log
2015-07-16 16:12 - 2014-09-04 17:09 - 00000000 ___RD C:\Users\\Dropbox
2015-07-16 16:12 - 2014-09-04 16:58 - 00000000 ____D C:\Users\\AppData\Roaming\Dropbox
2015-07-16 15:52 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\System32\config\BBI
2015-07-16 15:45 - 2014-09-03 18:41 - 01776918 _____ C:\Windows\System32\PerfStringBackup.INI
2015-07-16 15:45 - 2013-09-30 04:58 - 00765582 _____ C:\Windows\System32\perfh007.dat
2015-07-16 15:45 - 2013-09-30 04:58 - 00159366 _____ C:\Windows\System32\perfc007.dat
2015-07-16 15:41 - 2014-09-03 18:57 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1832302014-2846907121-421425406-1001
2015-07-16 15:02 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\System32\sru
2015-07-16 10:43 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-16 06:32 - 2014-09-03 20:58 - 00004100 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 06:32 - 2014-09-03 20:58 - 00003864 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 06:32 - 2014-09-03 20:58 - 00001128 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-16 06:32 - 2014-09-03 20:58 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-15 17:20 - 2015-05-24 07:53 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-15 17:20 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-14 21:05 - 2014-09-03 18:51 - 00000000 ____D C:\users\
2015-07-13 19:57 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\rescache
2015-07-12 16:53 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\System32\FxsTmp
2015-07-12 09:26 - 2014-09-03 19:25 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-07-12 09:25 - 2014-10-30 07:41 - 00000000 ____D C:\Program Files (x86)\3S Software
2015-07-12 07:42 - 2013-08-22 15:44 - 00410008 _____ C:\Windows\System32\FNTCACHE.DAT
2015-07-12 07:39 - 2013-09-29 20:05 - 00367544 _____ C:\Windows\PFRO.log
2015-07-12 07:37 - 2013-08-22 16:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-12 07:37 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-12 07:30 - 2014-09-03 19:48 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-12 07:18 - 2014-09-05 08:28 - 00000000 ____D C:\Windows\System32\MRT
2015-07-12 07:08 - 2014-09-05 08:28 - 140135120 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-07-12 06:13 - 2015-06-14 10:41 - 00000000 ____D C:\Windows\Minidump
2015-07-08 18:54 - 2014-10-04 09:05 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-08 18:54 - 2014-10-04 07:58 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-06 22:24 - 2013-08-22 16:38 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-06 22:24 - 2013-08-22 16:38 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-03 18:24 - 2014-09-03 18:51 - 00000000 ____D C:\Users\\AppData\Local\Packages
2015-06-28 14:15 - 2015-06-14 10:41 - 452651512 _____ C:\Windows\MEMORY.DMP
2015-06-20 05:37 - 2014-10-04 07:58 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2015-06-20 05:37 - 2014-10-04 07:58 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys

Some files in TEMP:
====================
C:\Users\\AppData\Local\Temp\avgnt.exe
C:\Users\\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6cuqvc.dll
C:\Users\\AppData\Local\Temp\nvStInst.exe
C:\Users\\AppData\Local\Temp\ose00000.exe
C:\Users\\AppData\Local\Temp\Quarantine.exe
C:\Users\\AppData\Local\Temp\sqlite3.dll
C:\Users\\AppData\Local\Temp\vpnclient_setup.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe
[2015-03-14 11:59] - [2015-01-28 00:47] - 2501368 ____A (Microsoft Corporation) C10A66189DC8C090E7C84873EDCEBC88

C:\Windows\SysWOW64\explorer.exe
[2015-03-14 11:59] - [2015-01-28 00:41] - 2207488 ____A (Microsoft Corporation) 91E24273FCA076EA9E65DAFA98901225

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points =========================

Restore point made on: 2015-06-29 19:24:43
Restore point made on: 2015-07-10 07:08:24
Restore point made on: 2015-07-12 09:23:39

==================== Memory info =========================== 

Percentage of memory in use: 19%
Total physical RAM: 3884.28 MB
Available physical RAM: 3142.31 MB
Total Virtual: 3884.28 MB
Available Virtual: 3163.38 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:194.97 GB) (Free:131.05 GB) NTFS
Drive d: () (Removable) (Total:0.95 GB) (Free:0.95 GB) FAT32
Drive f: (Volume) (Fixed) (Total:270.45 GB) (Free:258.59 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.5 GB) (Free:0.49 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.34 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E3102A4B)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=270.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 976.3 MB) (Disk ID: 9A1DFB0A)
Partition 1: (Active) - (Size=976 MB) - (Type=0B)


LastRegBack: 2015-07-13 19:22

==================== End of log ============================

schrauber · 17.07.2015, 10:43

passt, sieht gut aus.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

timey89 · 18.07.2015, 12:27

Hallo Schrauber,

hier der ESET:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# end=init
# utc_time=2015-07-18 05:26:25
# local_time=2015-07-18 07:26:25 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 24860
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# end=updated
# utc_time=2015-07-18 05:30:51
# local_time=2015-07-18 07:30:51 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# engine=24860
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-18 05:39:14
# local_time=2015-07-18 07:39:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 9892042 62079247 0 0
# scanned=2642
# found=0
# cleaned=0
# scan_time=502
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# end=init
# utc_time=2015-07-18 05:39:58
# local_time=2015-07-18 07:39:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
esets_scanner_update returned -1 esets_gle=53251
Update Finalize
Updated modules version: 24860
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# end=updated
# utc_time=2015-07-18 05:40:53
# local_time=2015-07-18 07:40:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# engine=24860
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-18 08:00:14
# local_time=2015-07-18 10:00:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 9896902 62087707 0 0
# scanned=161648
# found=3
# cleaned=0
# scan_time=8360
sh=4E5E8B54DDA603D7E83F3EDE2BCDD8064D4EDF22 ft=1 fh=895bb0fee970ac49 vn="Variante von Win32/DownloadSponsor.C evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Timm\AppData\Local\Temp\DMR\dmr_72.exe"
sh=2E0235CDA05AD4DFE28CB284E1A82EE74F46B62B ft=1 fh=1fdb46a57e2ca458 vn="Variante von Win32/DownloadSponsor.C evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Timm\Downloads\PDF24 Creator - CHIP-Installer.exe"
sh=E1FA81D9721495C2F653C1C29A8E1B386CDA0AAF ft=1 fh=8f72d4076bafd886 vn="Variante von Win32/DownloadSponsor.C evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Timm\Downloads\Vereinfachte_EST-Erklaerung_2014 - CHIP-Installer.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# end=init
# utc_time=2015-07-18 08:01:21
# local_time=2015-07-18 10:01:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 24863
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# end=updated
# utc_time=2015-07-18 08:02:15
# local_time=2015-07-18 10:02:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=be41b1d327ed15419e7f1f32fbf81000
# engine=24863
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-18 09:52:41
# local_time=2015-07-18 11:52:41 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 9903649 62094454 0 0
# scanned=223828
# found=3
# cleaned=0
# scan_time=6626
sh=4E5E8B54DDA603D7E83F3EDE2BCDD8064D4EDF22 ft=1 fh=895bb0fee970ac49 vn="Variante von Win32/DownloadSponsor.C evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Timm\AppData\Local\Temp\DMR\dmr_72.exe"
sh=2E0235CDA05AD4DFE28CB284E1A82EE74F46B62B ft=1 fh=1fdb46a57e2ca458 vn="Variante von Win32/DownloadSponsor.C evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Timm\Downloads\PDF24 Creator - CHIP-Installer.exe"
sh=E1FA81D9721495C2F653C1C29A8E1B386CDA0AAF ft=1 fh=8f72d4076bafd886 vn="Variante von Win32/DownloadSponsor.C evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Timm\Downloads\Vereinfachte_EST-Erklaerung_2014 - CHIP-Installer.exe"

Es wurden drei Dinge gefunden!

Der Security Check:

Code:

ATTFilter

 Results of screen317's Security Check version 1.004  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Antivirus    
Windows Defender   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Mozilla Thunderbird (31.7.0) 
 Google Chrome (43.0.2357.132) 
 Google Chrome (43.0.2357.134) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

und das frische FRST:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-07-2015
Ran by  (administrator) on  on 18-07-2015 13:18:17
Running from C:\Users\\Downloads
Loaded Profiles: (Available Profiles: )
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AuthenTec, Inc) C:\Program Files\TrueSuite\TrueSuite.Service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(3S-Smart Software Solutions GmbH) C:\Program Files (x86)\3S Software\CoDeSys SP RTE\ServiceControl_RTE23.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(AuthenTec, Inc.) C:\Program Files\TrueSuite\TrueSuite.ClientAppLogonExe.exe
(AuthenTec, Inc.) C:\Program Files\TrueSuite\x86\TrueSuite.ClientAppLogonExe.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Windows (R) Win 7 DDK provider) C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Dropbox, Inc.) C:\Users\Timm\AppData\Local\Dropbox\Update\DropboxUpdate.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\POWERPNT.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(AuthenTec Inc.) C:\Program Files\TrueSuite\TrueSuite.TouchControl.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Timm\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-08-11] (Alcor Micro Corp.)
HKLM\...\Run: [ClientAppLogon] => C:\Program Files\TrueSuite\TrueSuite.ClientAppLogonExe.exe [420672 2010-11-12] (AuthenTec, Inc.)
HKLM\...\Run: [ClientAppLogon32] => C:\Program Files\TrueSuite\x86\TrueSuite.ClientAppLogonExe.exe [307520 2010-11-12] (AuthenTec, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2283816 2010-08-12] (Synaptics Incorporated)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [92456 2010-08-12] (Synaptics Incorporated)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-01] (NVIDIA Corporation)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [FLxHCIm] => C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [40448 2011-02-24] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1832302014-2846907121-421425406-1001\...\Run: [Dropbox Update] => C:\Users\Timm\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-07-16] (Dropbox, Inc.)
Startup: C:\Users\Timm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-04-25]
ShortcutTarget: Dropbox.lnk -> C:\Users\Timm\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
SSODL: EldosMountNotificator-cbfs4 - {A5A27988-B099-4629-AE34-58BE9E3E9311} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {A5A27988-B099-4629-AE34-58BE9E3E9311} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs4] -> {128C726C-3F36-42A9-8854-BE45D7A01B17} => C:\Windows\system32\cbfsMntNtf4.dll [2013-11-15] (EldoS Corporation)
ShellIconOverlayIdentifiers: [TSFPLOlayIcon] -> {F4DD9208-8229-492D-BCBF-2955F7AC38F4} => C:\Program Files\TrueSuite\TrueSuite.FPLOlayIcon.dll [2010-11-12] (AuthenTec, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs4] -> {128C726C-3F36-42A9-8854-BE45D7A01B17} => C:\Windows\SysWOW64\cbfsMntNtf4.dll [2013-11-15] (EldoS Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1832302014-2846907121-421425406-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files\TrueSuite\TrueSuite.IEBHO.dll [2010-11-12] (AuthenTec Inc.)
BHO-x32: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files\TrueSuite\x86\TrueSuite.IEBHO.dll [2010-11-12] (AuthenTec Inc.)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-13] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-04-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{4A31F548-22B1-4BD7-BB49-C554F59F4102}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{B05D6910-55E0-44BF-BA51-AB110E476792}: [DhcpNameServer] 141.71.32.20 141.71.1.21

FireFox:
========
FF ProfilePath: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\lz0954eh.default
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-11-11] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-11-11] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-07-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF Extension: Download Status Bar - C:\Users\Timm\AppData\Roaming\Mozilla\Firefox\Profiles\lz0954eh.default\Extensions\{6c28e999-e900-4635-a39d-b1ec90ba0c0f}.xpi [2014-09-03]
FF Extension: Adblock Plus - C:\Users\Timm\AppData\Roaming\Mozilla\Firefox\Profiles\lz0954eh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-03]
FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [not found]
FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [not found]
FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [not found]
FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [not found]
FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [not found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]

Chrome: 
=======
CHR Profile: C:\Users\\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-03]
CHR Extension: (YouTube) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-03]
CHR Extension: (Adblock Plus) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-09-03]
CHR Extension: (Pushbullet) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\chlffgpmiacpedhhbkiomidkjlcfhogd [2014-09-04]
CHR Extension: (Google Search) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-03]
CHR Extension: (Google Calendar) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2014-09-04]
CHR Extension: (hxxp://translate.google.de/) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekoegieboinnegkaeedfajabaobgfffl [2014-09-04]
CHR Extension: (Avira Browser Safety) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-04]
CHR Extension: (Google Keep - notes and lists) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2014-09-04]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15]
CHR Extension: (AVG Secure Search) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof [2015-07-12]
CHR Extension: (Google Wallet) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-03]
CHR Extension: (Gmail) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-03]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oiokdoppleiafjmfmggefbkghfblaplo] - C:\Program Files\TrueSuite\x86\tschrome.crx [2010-10-21]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-20] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
R2 FPLService; C:\Program Files\TrueSuite\TrueSuite.Service.exe [290112 2010-11-12] (AuthenTec, Inc)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-01] (NVIDIA Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-01] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-01] (NVIDIA Corporation)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] () [File not signed]
R2 ServiceControl_RTE23_3S_GmbH; C:\Program Files (x86)\3S Software\CoDeSys SP RTE\ServiceControl_RTE23.exe [188551 2014-04-09] (3S-Smart Software Solutions GmbH) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwnx.sys [3680256 2013-06-18] (Qualcomm Atheros Communications, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132656 2015-06-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
R3 FLxHCIh; C:\Windows\System32\drivers\FLxHCIh.sys [81920 2011-02-24] (Fresco Logic)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-01] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 vpnpbus; C:\Windows\System32\drivers\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S4 WinDivert1.1; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-18 13:18 - 2015-07-18 13:18 - 00000000 ____D C:\Users\\Downloads\FRST-OlderVersion
2015-07-18 12:58 - 2015-07-18 12:58 - 00852662 _____ C:\Users\\Downloads\SecurityCheck.exe
2015-07-18 07:26 - 2015-07-18 07:26 - 00000000 ____D C:\Program Files (x86)\ESET
2015-07-18 07:25 - 2015-07-18 07:25 - 02870984 _____ (ESET) C:\Users\\Downloads\esetsmartinstaller_deu.exe
2015-07-18 07:16 - 2015-07-18 07:16 - 00001178 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1832302014-2846907121-421425406-1001Core1d0c118dd7e5307.job
2015-07-17 09:00 - 2015-07-17 09:00 - 00000000 ____D C:\Users\\AppData\Local\CEF
2015-07-16 16:36 - 2015-07-16 16:36 - 00000000 ____D C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-16 16:35 - 2015-07-16 16:35 - 00000000 ____D C:\Users\\AppData\Local\Dropbox
2015-07-16 16:35 - 2015-07-16 16:35 - 00000000 ____D C:\ProgramData\Dropbox
2015-07-16 16:31 - 2015-07-16 16:31 - 00010472 _____ C:\Users\\Desktop\Gehalt.xlsx
2015-07-15 18:04 - 2015-07-15 18:04 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\\Downloads\tdsskiller (3).exe
2015-07-13 19:59 - 2015-07-13 19:59 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\\Downloads\tdsskiller (2).exe
2015-07-12 18:12 - 2015-07-12 18:12 - 00001259 _____ C:\Users\\Desktop\JRT.txt
2015-07-12 17:59 - 2015-07-12 17:59 - 00000207 _____ C:\Windows\tweaking.com-regbackup-TIMM-Windows-8.1-Pro-(64-bit).dat
2015-07-12 17:59 - 2015-07-12 17:59 - 00000000 ____D C:\RegBackup
2015-07-12 17:58 - 2015-07-12 17:58 - 03034102 _____ (Malwarebytes Corporation) C:\Users\Timm\Downloads\JRT.exe
2015-07-12 17:49 - 2015-07-12 17:49 - 00001600 _____ C:\Users\\Desktop\AdwCleaner[S1].txt
2015-07-12 17:45 - 2015-07-12 17:45 - 00001541 _____ C:\Users\\Desktop\AdwCleaner[R1].txt
2015-07-12 17:41 - 2015-07-12 17:41 - 02248704 _____ C:\Users\\Downloads\AdwCleaner_4.208 (2).exe
2015-07-12 12:22 - 2015-07-12 12:53 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-07-12 12:05 - 2015-07-12 12:05 - 16502728 _____ (Malwarebytes Corp.) C:\Users\\Downloads\mbar-1.09.1.1004 (1).exe
2015-07-12 12:00 - 2015-07-12 12:53 - 00000000 ____D C:\Users\\Desktop\mbar
2015-07-12 11:59 - 2015-07-12 11:59 - 16502728 _____ (Malwarebytes Corp.) C:\Users\\Downloads\mbar-1.09.1.1004.exe
2015-07-12 10:11 - 2015-07-12 10:24 - 00000000 ____D C:\ProgramData\F-Secure
2015-07-12 10:11 - 2015-07-12 10:11 - 00816680 _____ (F-Secure Corporation) C:\Users\\Downloads\F-SecureNetworkInstaller_AV-ESTORE-TRIAL-GLOBAL_.exe
2015-07-12 10:11 - 2015-07-12 10:11 - 00000000 ____D C:\Users\\AppData\Local\F-Secure
2015-07-12 10:01 - 2015-07-12 10:01 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\\Downloads\tdsskiller (1).exe
2015-07-12 09:58 - 2015-07-12 09:58 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\\Downloads\tdsskiller.exe
2015-07-12 08:54 - 2015-07-12 08:55 - 00031372 _____ C:\Users\\Downloads\Addition.txt
2015-07-12 08:52 - 2015-07-18 13:18 - 02134016 _____ (Farbar) C:\Users\\Downloads\FRST64.exe
2015-07-12 08:52 - 2015-07-18 13:18 - 00023145 _____ C:\Users\\Downloads\FRST.txt
2015-07-12 08:52 - 2015-07-18 13:18 - 00000000 ____D C:\FRST
2015-07-12 07:20 - 2015-07-12 07:20 - 00002885 _____ C:\Users\\Desktop\durchlauf20150712.txt
2015-07-11 22:19 - 2015-07-18 07:15 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-11 22:19 - 2015-07-12 12:05 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-11 22:19 - 2015-07-11 22:19 - 00001114 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-11 22:19 - 2015-07-11 22:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-07-11 22:19 - 2015-07-11 22:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-11 22:19 - 2015-07-11 22:19 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-11 22:19 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-11 22:19 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-11 22:17 - 2015-07-11 22:17 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Timm\Downloads\mbam-setup-2.1.6.1022.exe
2015-07-11 22:04 - 2015-07-11 22:04 - 02314104 _____ C:\Users\\Downloads\avira10_pc_cleaner_de.exe
2015-07-11 22:04 - 2015-07-11 22:04 - 00002034 _____ C:\Users\\Desktop\Entfernen des Avira PC Cleaners.lnk
2015-07-11 22:04 - 2015-07-11 22:04 - 00001978 _____ C:\Users\\Desktop\Avira PC Cleaner.lnk
2015-07-11 21:56 - 2015-07-11 21:56 - 02248704 _____ C:\Users\\Downloads\adwcleaner_4.208 (1).exe
2015-07-11 21:51 - 2015-07-12 17:46 - 00000000 ____D C:\AdwCleaner
2015-07-11 21:51 - 2015-07-11 21:51 - 02248704 _____ C:\Users\\Downloads\adwcleaner_4.208.exe
2015-07-11 21:47 - 2015-07-11 21:47 - 00000000 ____D C:\ProgramData\TEMP
2015-07-11 21:47 - 2015-07-11 21:47 - 00000000 ____D C:\ProgramData\Licenses
2015-07-11 21:42 - 2015-07-11 21:42 - 35218576 _____ (Simply Super Software ) C:\Users\\Downloads\trjsetup692.exe
2015-06-28 15:15 - 2015-06-28 15:15 - 00262144 _____ C:\Windows\Minidump\062815-20296-01.dmp
2015-06-26 19:23 - 2015-06-26 19:23 - 00262144 _____ C:\Windows\Minidump\062615-34875-01.dmp
2015-06-21 08:37 - 2015-06-21 08:37 - 00000000 ____D C:\Users\\AppData\Local\PDF24
2015-06-21 08:28 - 2015-06-21 08:28 - 00001091 _____ C:\Users\Public\Desktop\PDF24 Creator.lnk
2015-06-21 08:28 - 2015-06-21 08:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2015-06-21 08:28 - 2015-06-21 08:28 - 00000000 ____D C:\Program Files (x86)\PDF24
2015-06-21 08:26 - 2015-06-21 08:26 - 01198368 _____ C:\Users\\Downloads\PDF24 Creator - CHIP-Installer.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-18 13:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-07-18 10:20 - 2014-09-03 19:37 - 01189165 _____ C:\Windows\WindowsUpdate.log
2015-07-18 07:58 - 2014-09-04 09:23 - 00000000 ____D C:\ProgramData\Kodak
2015-07-18 07:29 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-18 07:26 - 2015-04-08 19:15 - 00005100 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for TIMM-Timm Timm
2015-07-16 18:05 - 2014-09-03 19:57 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1832302014-2846907121-421425406-1001
2015-07-16 17:34 - 2014-09-04 18:09 - 00000000 ___RD C:\Users\\Dropbox
2015-07-16 17:34 - 2014-09-04 17:58 - 00000000 ____D C:\Users\\AppData\Roaming\Dropbox
2015-07-16 17:32 - 2013-08-22 16:46 - 00064409 _____ C:\Windows\setupact.log
2015-07-16 17:31 - 2014-09-03 20:02 - 00000000 ____D C:\ProgramData\NVIDIA
2015-07-16 17:31 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-16 16:52 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-16 16:45 - 2014-09-03 19:41 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-16 16:45 - 2013-09-30 05:58 - 00765582 _____ C:\Windows\system32\perfh007.dat
2015-07-16 16:45 - 2013-09-30 05:58 - 00159366 _____ C:\Windows\system32\perfc007.dat
2015-07-16 07:32 - 2014-09-03 21:58 - 00004100 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 07:32 - 2014-09-03 21:58 - 00003864 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 07:32 - 2014-09-03 21:58 - 00001128 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-16 07:32 - 2014-09-03 21:58 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-15 18:54 - 2015-05-24 08:52 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-07-15 18:20 - 2015-05-24 08:53 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-15 18:20 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-14 22:05 - 2014-09-03 19:51 - 00000000 ____D C:\Users\
2015-07-13 20:57 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2015-07-12 17:53 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-07-12 10:26 - 2014-09-03 20:25 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-07-12 10:25 - 2014-10-30 08:41 - 00000000 ____D C:\Program Files (x86)\3S Software
2015-07-12 10:17 - 2015-02-10 20:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-12 08:42 - 2013-08-22 16:44 - 00410008 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-12 08:39 - 2013-09-29 21:05 - 00367544 _____ C:\Windows\PFRO.log
2015-07-12 08:37 - 2013-08-22 17:36 - 00000000 ___RD C:\Windows\ToastData
2015-07-12 08:37 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-12 08:30 - 2014-09-03 20:48 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-12 08:28 - 2014-09-03 20:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-07-12 08:18 - 2014-09-05 09:28 - 00000000 ____D C:\Windows\system32\MRT
2015-07-12 08:08 - 2014-09-05 09:28 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-07-12 07:13 - 2015-06-14 11:41 - 00000000 ____D C:\Windows\Minidump
2015-07-08 19:54 - 2014-10-04 10:05 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-08 19:54 - 2014-10-04 08:58 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-06 23:24 - 2013-08-22 17:38 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-06 23:24 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-03 19:24 - 2014-09-03 19:51 - 00000000 ____D C:\Users\Timm\AppData\Local\Packages
2015-06-28 15:15 - 2015-06-14 11:41 - 452651512 _____ C:\Windows\MEMORY.DMP
2015-06-20 06:37 - 2014-10-04 08:58 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-06-20 06:37 - 2014-10-04 08:58 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

==================== Files in the root of some directories =======

2014-09-04 09:36 - 2014-09-04 09:36 - 0000236 _____ () C:\Users\Timm\AppData\Local\LaunchHomeCenter.log

Some files in TEMP:
====================
C:\Users\\AppData\Local\Temp\avgnt.exe
C:\Users\\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp9pkvjw.dll
C:\Users\\AppData\Local\Temp\nvStInst.exe
C:\Users\AppData\Local\Temp\ose00000.exe
C:\Users\\AppData\Local\Temp\Quarantine.exe
C:\Users\\AppData\Local\Temp\sqlite3.dll
C:\Users\\AppData\Local\Temp\vpnclient_setup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-13 20:22

==================== End of log ============================

schönen Samstag noch

schrauber · 19.07.2015, 05:49

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\Timm\AppData\Local\Temp\DMR\dmr_72.exe

C:\Users\Timm\Downloads\PDF24 Creator - CHIP-Installer.exe

C:\Users\Timm\Downloads\Vereinfachte_EST-Erklaerung_2014 - CHIP-Installer.exe
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Downloadverhalten überdenken:
CHIP-Installer - was ist das? - Anleitungen

Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte

DelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...

und/oder das Forum mit einer kleinen Spende unterstützen.

Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:

NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie

.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

timey89 · 20.07.2015, 19:08

einmal der fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x64) Version:20-07-2015
Ran by Timm at 2015-07-20 19:56:58 Run:1
Running from C:\Users\Timm\Downloads
Loaded Profiles: Timm (Available Profiles: Timm)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\Users\Timm\AppData\Local\Temp\DMR\dmr_72.exe

C:\Users\Timm\Downloads\PDF24 Creator - CHIP-Installer.exe

C:\Users\Timm\Downloads\Vereinfachte_EST-Erklaerung_2014 - CHIP-Installer.exe
Emptytemp:
*****************

C:\Users\Timm\AppData\Local\Temp\DMR\dmr_72.exe => moved successfully.
C:\Users\Timm\Downloads\PDF24 Creator - CHIP-Installer.exe => moved successfully.
C:\Users\Timm\Downloads\Vereinfachte_EST-Erklaerung_2014 - CHIP-Installer.exe => moved successfully.
EmptyTemp: => 3.9 GB temporary data Removed.


The system needed a reboot.. 

==== End of Fixlog 19:58:00 ====

ist der Rechner jetzt wieder in Ordnung soweit?

schrauber · 21.07.2015, 07:04

ja

16.07.2015, 10:08	#18
schrauber /// the machine /// TB-Ausbilder	gefälschten Link von Immobilienwebsite geöffnet, Malware oder Phising?Hilfe Da wird nix geöscht, wir machen ja nur einen Scan . Nicht ausführbare Daten (Musik, Texte, Videos, Bilder) kannste auf jeden Fall sichern. __________________ __________________

21.07.2015, 07:04	#24
schrauber /// the machine /// TB-Ausbilder	gefälschten Link von Immobilienwebsite geöffnet, Malware oder Phising?Hilfe ja __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

gefälschten Link von Immobilienwebsite geöffnet, Malware oder Phising?Hilfe

Log-Analyse und Auswertung: gefälschten Link von Immobilienwebsite geöffnet, Malware oder Phising?Hilfe