Trojaner-Board - Windows 8.1: GVU-Trojaner mit Systemwiederherstellung beseitigt?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 8.1: GVU-Trojaner mit Systemwiederherstellung beseitigt? (https://www.trojaner-board.de/149229-windows-8-1-gvu-trojaner-systemwiederherstellung-beseitigt.html)

Windows 8.1: GVU-Trojaner mit Systemwiederherstellung beseitigt?

Hallo .... ich hoffe ihr könnt mir helfen.

Hatte mir Anfang des Jahres den GVU-Trojaner mit weißem Bildschirm und laufender integrierter Laptopkamera zugezogen ( wobei der weiße bildschirm nur kam, wenn mein Laptop nicht mit dem Internet verbunden war, hatte er wifizugang kam die BSI / GVU - Seite mit der Aufforderung zur Zahlung von 100,-€ per Paysafecard).

Hatte mich nun durch das Forum gewuselt, um herrauszufinden, wie ich bei windows 8 in den abgesicherten modus bzw. zur systemwiederherstellung komme.

Habe nun Shift + Neustarten gemacht und mein System auf letztes Jahr 23.12.13 20:06 Uhr zurückgesetzt und danach den FRST 64bit Scan durchgeführt.

Nun meine Frage : Habe ich nun damit den Trojaner beseitigt ?

Zur Eurer Hilfe poste ich Euch die LOG-Files von FRST hier :

FRST.txt :

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014

Ran by Björn (administrator) on BJÖRNS-LAPTOP on 04-02-2014 15:39:27

Running from C:\Users\Björn\Downloads

Windows 8.1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

The only official download link for FRST:

Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 

Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BBSvc.EXE

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Reputation\fsorsp.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\fsgk32.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSMA32.EXE

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\fssm32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSHDLL64.EXE

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSM32.EXE

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9600.16422_x64__8wekyb3d8bbwe\glcnd.exe

(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.16384_none_fa1dc1539b4180d8\TiWorker.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [Ocs_SM] - C:\Users\Björn\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2013-05-14] (OCS)

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM-x32\...\Run: [F-Secure Manager] - C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSM32.EXE [311432 2013-01-03] (F-Secure Corporation)

HKLM-x32\...\Run: [F-Secure Hoster (44553)] - C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe [188400 2013-01-18] (F-Secure Corporation)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Spotify Web Helper] - C:\Users\Björn\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-14] (Spotify Ltd)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Facebook Update] - C:\Users\Björn\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-02-04] (Facebook Inc.)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Java Updater] - C:\Users\Björn\AppData\lsass.exe [0 2013-07-07] ()

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=FCB26A9423517E69

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com

URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

SearchScopes: HKLM - DefaultScope {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - DefaultScope {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - DefaultScope {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = 

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=FCB26A9423517E69

SearchScopes: HKCU - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = 

SearchScopes: HKCU - {277E973A-7F75-4506-8A1C-CC124520D647} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {3DF46539-9B48-4105-BC63-9477816BD4AD} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {45EE8D7D-3563-42ED-97A2-2B4F517FF55F} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {7EFDB757-2B59-4D06-968A-CEFCE975E107} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=1337138F-CF12-4B9A-B591-B8C148C34104&apn_sauid=1D734857-BE82-4A47-9DCB-55AEED6C83A9

SearchScopes: HKCU - {8AB6BABA-0B8D-4E67-A74C-B876FF9E6C8F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {D4C4F1A6-54E7-40ED-8E26-45CD8E94499E} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {DF18B157-E712-431A-950B-77289688838E} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)

BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)

Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

Chrome: 

=======

CHR HomePage: hxxp://www1.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=FCB26A9423517E69

CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=FCB26A9423517E69"

CHR DefaultSearchKeyword: delta-search.com

CHR DefaultSearchProvider: Delta Search

CHR DefaultSearchURL: hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=FCB26A9423517E69

CHR DefaultNewTabURL: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Bj\u00F6rn\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.2_0\McChPlg.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Ask Toolbar) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo [2013-01-19]

CHR Extension: (Google Docs) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-19]

CHR Extension: (Google Drive) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-19]

CHR Extension: (YouTube) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-19]

CHR Extension: (Google-Suche) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-19]

CHR Extension: (Google Wallet) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30]

CHR Extension: (Google Mail) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-19]

CHR HKLM-x32\...\Chrome\Extension: [aaaaojmikegpiepcfdkkjaplodkpfmlo] - C:\Users\Björn\AppData\Local\APN\GoogleCRXs\apnorjtoolbar.crx [2012-12-10]
 

==================== Services (Whitelisted) =================
 

R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

R2 fshoster; C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe [188400 2013-01-18] (F-Secure Corporation)

R3 FSMA; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSMA32.EXE [209032 2013-01-03] (F-Secure Corporation)

R2 FSORSPClient; C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Reputation\fsorsp.exe [60352 2013-06-25] (F-Secure Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-10] (Dritek System INC.)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)

R3 F-Secure Gatekeeper; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [203304 2013-12-11] (F-Secure Corporation)

R1 F-Secure HIPS; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\HIPS\drivers\fshs.sys [69296 2013-10-16] (F-Secure Corporation)

R0 fsbts; C:\Windows\System32\Drivers\fsbts.sys [56016 2013-04-11] ()

R0 fsbts; C:\Windows\SysWOW64\Drivers\fsbts.sys [42248 2013-04-11] ()

R3 fsni; C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Scanning\fsni64.sys [80832 2013-04-25] (F-Secure Corporation)

R1 fsvista; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [14472 2013-01-03] ()

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-10] (Dritek System Inc.)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-04 15:39 - 2014-02-04 15:39 - 00016897 _____ () C:\Users\Björn\Downloads\FRST.txt

2014-02-04 15:39 - 2014-02-04 15:39 - 00000000 ____D () C:\FRST

2014-02-04 15:36 - 2014-02-04 15:36 - 02080256 _____ (Farbar) C:\Users\Björn\Downloads\FRST64.exe
 

==================== One Month Modified Files and Folders =======
 

2014-02-04 15:39 - 2014-02-04 15:39 - 00016897 _____ () C:\Users\Björn\Downloads\FRST.txt

2014-02-04 15:39 - 2014-02-04 15:39 - 00000000 ____D () C:\FRST

2014-02-04 15:37 - 2013-11-18 01:09 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D60094E3-77E5-48EC-AA70-CB6C017F466A}

2014-02-04 15:37 - 2013-10-29 08:45 - 01526099 _____ () C:\WINDOWS\WindowsUpdate.log

2014-02-04 15:37 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-02-04 15:36 - 2014-02-04 15:36 - 02080256 _____ (Farbar) C:\Users\Björn\Downloads\FRST64.exe

2014-02-04 15:36 - 2013-01-16 18:28 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2268705684-3369493718-70437878-1002

2014-02-04 15:32 - 2013-01-19 08:08 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-04 15:31 - 2013-10-29 08:51 - 00000000 ____D () C:\Users\Björn

2014-02-04 15:31 - 2013-05-14 08:33 - 00000440 _____ () C:\WINDOWS\Tasks\Lyrics Finder Update.job

2014-02-04 15:31 - 2013-01-19 08:08 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-04 15:30 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-02-04 15:21 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-02-04 15:21 - 2013-08-15 17:58 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\vlc

2014-02-04 15:21 - 2013-04-01 16:26 - 00000000 ____D () C:\Program Files (x86)\Kabel Deutschland

2014-02-04 15:21 - 2013-02-22 09:06 - 00000000 ____D () C:\Users\Björn\AppData\Local\Bandizip

2014-02-04 15:13 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\registration

2014-02-04 15:13 - 2013-07-05 07:05 - 00000000 ____D () C:\Users\Björn\Documents\UseNeXT
 

Files to move or delete:

====================

C:\Users\Björn\MAESTIA_SETUP.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-12-27 21:10
 

==================== End Of Log ============================

Addition.txt :

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014

Ran by Björn (administrator) on BJÖRNS-LAPTOP on 04-02-2014 15:39:27

Running from C:\Users\Björn\Downloads

Windows 8.1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

The only official download link for FRST:

Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 

Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BBSvc.EXE

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Reputation\fsorsp.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\fsgk32.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSMA32.EXE

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\fssm32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSHDLL64.EXE

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSM32.EXE

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9600.16422_x64__8wekyb3d8bbwe\glcnd.exe

(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.16384_none_fa1dc1539b4180d8\TiWorker.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [Ocs_SM] - C:\Users\Björn\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2013-05-14] (OCS)

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM-x32\...\Run: [F-Secure Manager] - C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSM32.EXE [311432 2013-01-03] (F-Secure Corporation)

HKLM-x32\...\Run: [F-Secure Hoster (44553)] - C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe [188400 2013-01-18] (F-Secure Corporation)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Spotify Web Helper] - C:\Users\Björn\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-14] (Spotify Ltd)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Facebook Update] - C:\Users\Björn\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-02-04] (Facebook Inc.)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Java Updater] - C:\Users\Björn\AppData\lsass.exe [0 2013-07-07] ()

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=FCB26A9423517E69

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com

URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

SearchScopes: HKLM - DefaultScope {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - DefaultScope {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - DefaultScope {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = 

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=FCB26A9423517E69

SearchScopes: HKCU - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = 

SearchScopes: HKCU - {277E973A-7F75-4506-8A1C-CC124520D647} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {3DF46539-9B48-4105-BC63-9477816BD4AD} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {45EE8D7D-3563-42ED-97A2-2B4F517FF55F} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {7EFDB757-2B59-4D06-968A-CEFCE975E107} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=1337138F-CF12-4B9A-B591-B8C148C34104&apn_sauid=1D734857-BE82-4A47-9DCB-55AEED6C83A9

SearchScopes: HKCU - {8AB6BABA-0B8D-4E67-A74C-B876FF9E6C8F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {D4C4F1A6-54E7-40ED-8E26-45CD8E94499E} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {DF18B157-E712-431A-950B-77289688838E} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)

BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)

Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

Chrome: 

=======

CHR HomePage: hxxp://www1.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=FCB26A9423517E69

CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=FCB26A9423517E69"

CHR DefaultSearchKeyword: delta-search.com

CHR DefaultSearchProvider: Delta Search

CHR DefaultSearchURL: hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=FCB26A9423517E69

CHR DefaultNewTabURL: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Bj\u00F6rn\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.2_0\McChPlg.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Ask Toolbar) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo [2013-01-19]

CHR Extension: (Google Docs) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-19]

CHR Extension: (Google Drive) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-19]

CHR Extension: (YouTube) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-19]

CHR Extension: (Google-Suche) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-19]

CHR Extension: (Google Wallet) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30]

CHR Extension: (Google Mail) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-19]

CHR HKLM-x32\...\Chrome\Extension: [aaaaojmikegpiepcfdkkjaplodkpfmlo] - C:\Users\Björn\AppData\Local\APN\GoogleCRXs\apnorjtoolbar.crx [2012-12-10]
 

==================== Services (Whitelisted) =================
 

R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

R2 fshoster; C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe [188400 2013-01-18] (F-Secure Corporation)

R3 FSMA; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSMA32.EXE [209032 2013-01-03] (F-Secure Corporation)

R2 FSORSPClient; C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Reputation\fsorsp.exe [60352 2013-06-25] (F-Secure Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-10] (Dritek System INC.)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)

R3 F-Secure Gatekeeper; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [203304 2013-12-11] (F-Secure Corporation)

R1 F-Secure HIPS; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\HIPS\drivers\fshs.sys [69296 2013-10-16] (F-Secure Corporation)

R0 fsbts; C:\Windows\System32\Drivers\fsbts.sys [56016 2013-04-11] ()

R0 fsbts; C:\Windows\SysWOW64\Drivers\fsbts.sys [42248 2013-04-11] ()

R3 fsni; C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Scanning\fsni64.sys [80832 2013-04-25] (F-Secure Corporation)

R1 fsvista; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [14472 2013-01-03] ()

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-10] (Dritek System Inc.)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-04 15:39 - 2014-02-04 15:39 - 00016897 _____ () C:\Users\Björn\Downloads\FRST.txt

2014-02-04 15:39 - 2014-02-04 15:39 - 00000000 ____D () C:\FRST

2014-02-04 15:36 - 2014-02-04 15:36 - 02080256 _____ (Farbar) C:\Users\Björn\Downloads\FRST64.exe
 

==================== One Month Modified Files and Folders =======
 

2014-02-04 15:39 - 2014-02-04 15:39 - 00016897 _____ () C:\Users\Björn\Downloads\FRST.txt

2014-02-04 15:39 - 2014-02-04 15:39 - 00000000 ____D () C:\FRST

2014-02-04 15:37 - 2013-11-18 01:09 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D60094E3-77E5-48EC-AA70-CB6C017F466A}

2014-02-04 15:37 - 2013-10-29 08:45 - 01526099 _____ () C:\WINDOWS\WindowsUpdate.log

2014-02-04 15:37 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-02-04 15:36 - 2014-02-04 15:36 - 02080256 _____ (Farbar) C:\Users\Björn\Downloads\FRST64.exe

2014-02-04 15:36 - 2013-01-16 18:28 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2268705684-3369493718-70437878-1002

2014-02-04 15:32 - 2013-01-19 08:08 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-04 15:31 - 2013-10-29 08:51 - 00000000 ____D () C:\Users\Björn

2014-02-04 15:31 - 2013-05-14 08:33 - 00000440 _____ () C:\WINDOWS\Tasks\Lyrics Finder Update.job

2014-02-04 15:31 - 2013-01-19 08:08 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-04 15:30 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-02-04 15:21 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-02-04 15:21 - 2013-08-15 17:58 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\vlc

2014-02-04 15:21 - 2013-04-01 16:26 - 00000000 ____D () C:\Program Files (x86)\Kabel Deutschland

2014-02-04 15:21 - 2013-02-22 09:06 - 00000000 ____D () C:\Users\Björn\AppData\Local\Bandizip

2014-02-04 15:13 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\registration

2014-02-04 15:13 - 2013-07-05 07:05 - 00000000 ____D () C:\Users\Björn\Documents\UseNeXT
 

Files to move or delete:

====================

C:\Users\Björn\MAESTIA_SETUP.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-12-27 21:10
 

==================== End Of Log ============================

Ich sage schon mal im Vorraus "Danke schön"

Sieht gut aus, aber Adware ist noch drauf.

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Log von Mailware :

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2014.02.04.08
 

Windows 8 x64 NTFS

Internet Explorer 11.0.9600.16476

Björn :: BJÖRNS-LAPTOP [Administrator]
 

04.02.2014 16:23:44

mbam-log-2014-02-04 (16-23-44).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 248895

Laufzeit: 5 Minute(n), 36 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 4

HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\BabylonToolbar (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 2

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Java Updater (Trojan.Agent) -> Daten: C:\Users\Björn\AppData\lsass.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0B1R1N1K2T2Y1K -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 1

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.StartPage) -> Bösartig: (hxxp://www1.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=FCB26A9423517E69) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
 

Infizierte Verzeichnisse: 2

C:\Users\Björn\AppData\Roaming\DealPly (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Björn\AppData\Roaming\DealPly\UpdateProc (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 3

C:\Windows\Tasks\Lyrics Finder Update.job (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Björn\AppData\lsass.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Björn\AppData\Roaming\DealPly\UpdateProc\config.dat (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Log von AdwCleaner :

Code:

# AdwCleaner v3.018 - Bericht erstellt am 04/02/2014 um 16:41:51

# Updated 28/01/2014 von Xplode

# Betriebssystem : Windows 8.1  (64 bits)

# Benutzername : Björn - BJÖRNS-LAPTOP

# Gestartet von : C:\Users\Björn\Downloads\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Ask

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\ProgramData\Tarma Installer

Ordner Gelöscht : C:\Program Files (x86)\Ask.com

Ordner Gelöscht : C:\WINDOWS\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}

Ordner Gelöscht : C:\Users\Björn\AppData\Local\apn

Ordner Gelöscht : C:\Users\Björn\AppData\LocalLow\AskToolbar

Ordner Gelöscht : C:\Users\Björn\AppData\Roaming\Babylon

Ordner Gelöscht : C:\Users\Björn\AppData\Roaming\DesktopIconForAmazon

Ordner Gelöscht : C:\Users\Björn\AppData\Roaming\DSite

Ordner Gelöscht : C:\Users\Björn\AppData\Roaming\OCS

Ordner Gelöscht : C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo

Datei Gelöscht : C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www1.delta-search.com_0.localstorage

Datei Gelöscht : C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www1.delta-search.com_0.localstorage-journal

Datei Gelöscht : C:\WINDOWS\System32\Tasks\Dealply
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\aiennapmieppnpfhhogglccgepbdajan

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Schlüssel Gelöscht : HKCU\Software\APN

Schlüssel Gelöscht : HKCU\Software\Ask.com

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\dsiteproducts

Schlüssel Gelöscht : HKCU\Software\FoxyDeal

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\AppDataLow\FoxyDeal

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\LyricsFinder

Schlüssel Gelöscht : HKLM\Software\APN

Schlüssel Gelöscht : HKLM\Software\AskToolbar

Schlüssel Gelöscht : HKLM\Software\Babylon

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\Software\DataMngr

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16384
 
 

-\\ Google Chrome v31.0.1650.63
 

[ Datei : C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht : homepage

Gelöscht : icon_url

Gelöscht : search_url

Gelöscht : keyword

Gelöscht : urls_to_restore_on_startup
 

*************************
 

AdwCleaner[R0].txt - [6173 octets] - [04/02/2014 16:40:24]

AdwCleaner[S0].txt - [5624 octets] - [04/02/2014 16:41:51]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5684 octets] ##########

Log von Junkware :

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.1 (02.04.2014:1)

OS: Windows 8.1 x64

Ran by Bj”rn on 04.02.2014 at 16:53:36,32

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2268705684-3369493718-70437878-1002\Software\sweetim

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{7EFDB757-2B59-4D06-968A-CEFCE975E107}

Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"

Failed to delete: [Registry Key] "hkey_local_machine\software\classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9"
 
 
 

~~~ Files
 

Successfully deleted: [File] "C:\Users\Bj”rn\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\Users\Bj”rn\appdata\local\software"

Successfully deleted: [Folder] "C:\Users\Bj”rn\music\qtrax media library"
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 04.02.2014 at 17:03:31,32

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Und das frische Log von FRST :

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014

Ran by Björn (administrator) on BJÖRNS-LAPTOP on 04-02-2014 17:07:09

Running from C:\Users\Björn\Downloads

Windows 8.1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\fsgk32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Reputation\fsorsp.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSMA32.EXE

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\fssm32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSHDLL64.EXE

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSM32.EXE

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9600.16422_x64__8wekyb3d8bbwe\glcnd.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\SeaPort.EXE
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [Ocs_SM] - C:\Users\Björn\AppData\Roaming\OCS\SM\SearchAnonymizer.exe

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM-x32\...\Run: [F-Secure Manager] - C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSM32.EXE [311432 2013-01-03] (F-Secure Corporation)

HKLM-x32\...\Run: [F-Secure Hoster (44553)] - C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe [188400 2013-01-18] (F-Secure Corporation)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Spotify Web Helper] - C:\Users\Björn\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-14] (Spotify Ltd)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Facebook Update] - C:\Users\Björn\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-02-04] (Facebook Inc.)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com

SearchScopes: HKLM - DefaultScope {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = 

SearchScopes: HKCU - {277E973A-7F75-4506-8A1C-CC124520D647} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {3DF46539-9B48-4105-BC63-9477816BD4AD} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {45EE8D7D-3563-42ED-97A2-2B4F517FF55F} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {8AB6BABA-0B8D-4E67-A74C-B876FF9E6C8F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {D4C4F1A6-54E7-40ED-8E26-45CD8E94499E} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {DF18B157-E712-431A-950B-77289688838E} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchKeyword: delta-search.com

CHR DefaultSearchProvider: Delta Search

CHR DefaultSearchURL: hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=FCB26A9423517E69

CHR DefaultNewTabURL: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Bj\u00F6rn\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.2_0\McChPlg.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Docs) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-19]

CHR Extension: (Google Drive) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-19]

CHR Extension: (YouTube) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-19]

CHR Extension: (Google-Suche) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-19]

CHR Extension: (Google Wallet) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30]

CHR Extension: (Google Mail) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-19]
 

==================== Services (Whitelisted) =================
 

R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

R2 fshoster; C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe [188400 2013-01-18] (F-Secure Corporation)

R3 FSMA; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSMA32.EXE [209032 2013-01-03] (F-Secure Corporation)

R2 FSORSPClient; C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Reputation\fsorsp.exe [60352 2013-06-25] (F-Secure Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-10] (Dritek System INC.)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)

R3 F-Secure Gatekeeper; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [203304 2013-12-11] (F-Secure Corporation)

R1 F-Secure HIPS; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\HIPS\drivers\fshs.sys [69296 2013-10-16] (F-Secure Corporation)

R0 fsbts; C:\Windows\System32\Drivers\fsbts.sys [56016 2013-04-11] ()

R0 fsbts; C:\Windows\SysWOW64\Drivers\fsbts.sys [42248 2013-04-11] ()

R3 fsni; C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Scanning\fsni64.sys [80832 2013-04-25] (F-Secure Corporation)

R1 fsvista; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [14472 2013-01-03] ()

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-10] (Dritek System Inc.)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-04 17:03 - 2014-02-04 17:03 - 00001736 _____ () C:\Users\Björn\Desktop\JRT.txt

2014-02-04 16:53 - 2014-02-04 16:53 - 01037530 _____ (Thisisu) C:\Users\Björn\Downloads\JRT.exe

2014-02-04 16:53 - 2014-02-04 16:53 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-02-04 16:39 - 2014-02-04 16:41 - 00000000 ____D () C:\AdwCleaner

2014-02-04 16:39 - 2014-02-04 16:39 - 01166132 _____ () C:\Users\Björn\Downloads\adwcleaner.exe

2014-02-04 16:32 - 2014-02-04 16:32 - 00001244 _____ () C:\WINDOWS\PFRO.log

2014-02-04 16:22 - 2014-02-04 16:22 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Malwarebytes

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-04 16:22 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2014-02-04 16:21 - 2014-02-04 16:21 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Björn\Downloads\mbam-setup-1.75.0.1300.exe

2014-02-04 15:40 - 2014-02-04 15:41 - 00028713 _____ () C:\Users\Björn\Downloads\Addition.txt

2014-02-04 15:39 - 2014-02-04 17:07 - 00014490 _____ () C:\Users\Björn\Downloads\FRST.txt

2014-02-04 15:39 - 2014-02-04 17:07 - 00000000 ____D () C:\FRST

2014-02-04 15:36 - 2014-02-04 15:36 - 02080256 _____ (Farbar) C:\Users\Björn\Downloads\FRST64.exe
 

==================== One Month Modified Files and Folders =======
 

2014-02-04 17:07 - 2014-02-04 15:39 - 00014490 _____ () C:\Users\Björn\Downloads\FRST.txt

2014-02-04 17:07 - 2014-02-04 15:39 - 00000000 ____D () C:\FRST

2014-02-04 17:06 - 2013-10-29 08:45 - 01923296 _____ () C:\WINDOWS\WindowsUpdate.log

2014-02-04 17:03 - 2014-02-04 17:03 - 00001736 _____ () C:\Users\Björn\Desktop\JRT.txt

2014-02-04 17:03 - 2013-01-16 18:28 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2268705684-3369493718-70437878-1002

2014-02-04 17:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-02-04 16:55 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-02-04 16:53 - 2014-02-04 16:53 - 01037530 _____ (Thisisu) C:\Users\Björn\Downloads\JRT.exe

2014-02-04 16:53 - 2014-02-04 16:53 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-02-04 16:45 - 2013-01-19 08:08 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-04 16:45 - 2013-01-19 08:08 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-04 16:45 - 2013-01-19 08:08 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-04 16:43 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-02-04 16:41 - 2014-02-04 16:39 - 00000000 ____D () C:\AdwCleaner

2014-02-04 16:39 - 2014-02-04 16:39 - 01166132 _____ () C:\Users\Björn\Downloads\adwcleaner.exe

2014-02-04 16:32 - 2014-02-04 16:32 - 00001244 _____ () C:\WINDOWS\PFRO.log

2014-02-04 16:32 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI

2014-02-04 16:24 - 2013-11-18 01:09 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D60094E3-77E5-48EC-AA70-CB6C017F466A}

2014-02-04 16:22 - 2014-02-04 16:22 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Malwarebytes

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-04 16:21 - 2014-02-04 16:21 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Björn\Downloads\mbam-setup-1.75.0.1300.exe

2014-02-04 15:41 - 2014-02-04 15:40 - 00028713 _____ () C:\Users\Björn\Downloads\Addition.txt

2014-02-04 15:36 - 2014-02-04 15:36 - 02080256 _____ (Farbar) C:\Users\Björn\Downloads\FRST64.exe

2014-02-04 15:31 - 2013-10-29 08:51 - 00000000 ____D () C:\Users\Björn

2014-02-04 15:21 - 2013-08-15 17:58 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\vlc

2014-02-04 15:21 - 2013-04-01 16:26 - 00000000 ____D () C:\Program Files (x86)\Kabel Deutschland

2014-02-04 15:21 - 2013-02-22 09:06 - 00000000 ____D () C:\Users\Björn\AppData\Local\Bandizip

2014-02-04 15:13 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\registration

2014-02-04 15:13 - 2013-07-05 07:05 - 00000000 ____D () C:\Users\Björn\Documents\UseNeXT
 

Files to move or delete:

====================

C:\Users\Björn\MAESTIA_SETUP.exe
 
 

Some content of TEMP:

====================

C:\Users\Björn\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-02-04 17:03
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=2cc4fe6cfe04e44eaacd770e03af5b33

# engine=16976

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-02-07 08:00:42

# local_time=2014-02-07 09:00:42 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.2.9200 NT 

# compatibility_mode=2559 16777215 0 0 0 0 0 0

# compatibility_mode=5893 16776574 100 94 11245440 16641335 0 0

# scanned=245613

# found=3

# cleaned=0

# scan_time=4447

sh=410B32FD3FE4642644AD91AC60C69B86EC2762DD ft=1 fh=0e378a435beab91a vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir"

sh=C9D1E3003883B6CCEA2A6E0A294FE337E03766E9 ft=0 fh=0000000000000000 vn="a variant of MSIL/Injector.BOL trojan" ac=I fn="C:\Users\Björn\Documents\UseNeXT\Xilisoft MKV Converter v7.0.1 (CRACKED + SERIAL).rar"

sh=A074035981BA155E10DCCE09CE77F2E5644583A8 ft=0 fh=0000000000000000 vn="a variant of MSIL/Kryptik.KQ trojan" ac=I fn="C:\Users\Björn\Documents\UseNeXT\wizard\Adobe Photoshop Lightroom v5 Multilingua (Adobe.Ph\keygen.rar"

sry, daß ch mich erst jetzt melde ..... aber nachtschicht bedingt
das war eset
das löschen mach ich wenn ich geschlafen hab, weil windows 8 läßt mich nicht so einfach in die systemsteuerung bzw. ich weiß es noch net mal
da selbst die alles andere unter XP - mit dem ich bisher gearbeitet hbe einfacher war .... aber ich bekomm es raus

log security-check :

Code:

 Results of screen317's Security Check version 0.99.79  

   x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Computer Sicherheit   

Windows Defender      

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Java 7 Update 45  

 Java version out of Date! 

 Google Chrome 31.0.1650.63  

 Google Chrome 32.0.1700.107  
 ````````Process Check: objlist.exe by Laurent````````  

 Kabel Deutschland apps ComputerSecurity Anti-Virus\FSGK32.EXE 

 Kabel Deutschland apps ComputerSecurity Anti-Virus\fssm32.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 
 ````````````````````End of Log``````````````````````

das zweite ging schneller als ich dachte

log frischer FRST :

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2014

Ran by Björn (administrator) on BJÖRNS-LAPTOP on 07-02-2014 09:34:56

Running from C:\Users\Björn\Downloads

Windows 8.1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\fsgk32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Reputation\fsorsp.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(Tlapia) C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSMA32.EXE

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\fssm32.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSHDLL64.EXE

(Tlapia) C:\Program Files (x86)\sysTPL\sysTPLService.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSM32.EXE

(F-Secure Corporation) C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe

(Tlapia) C:\Program Files (x86)\sysTPL\sysTPL.exe

() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\OverwolfHelper.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\OverwolfHelper.exe

(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\OverwolfHelper64.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9600.16422_x64__8wekyb3d8bbwe\glcnd.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\SeaPort.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Users\Björn\Downloads\SecurityCheck.exe

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [Ocs_SM] - C:\Users\Björn\AppData\Roaming\OCS\SM\SearchAnonymizer.exe

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM-x32\...\Run: [F-Secure Manager] - C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSM32.EXE [311432 2013-01-03] (F-Secure Corporation)

HKLM-x32\...\Run: [F-Secure Hoster (44553)] - C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe [188400 2013-01-18] (F-Secure Corporation)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [sysTPL] - C:\Program Files (x86)\sysTPL\sysTPL.exe [1244440 2014-01-24] (Tlapia)

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [775872 2014-02-04] ()

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Spotify Web Helper] - C:\Users\Björn\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-14] (Spotify Ltd)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Facebook Update] - C:\Users\Björn\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-02-04] (Facebook Inc.)

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [NextLive] - C:\WINDOWS\SysWOW64\rundll32.exe "C:\Users\Björn\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l

HKU\S-1-5-21-2268705684-3369493718-70437878-1002\...\Run: [Overwolf] - C:\Program Files (x86)\Overwolf\Overwolf.exe [37632 2014-01-30] (Overwolf LTD)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
 

==================== Internet (Whitelisted) ====================
 

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:8877

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com

SearchScopes: HKLM - DefaultScope {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - {21AF0F3B-257E-46AB-AF89-97EBF582147D} URL = 

SearchScopes: HKCU - {277E973A-7F75-4506-8A1C-CC124520D647} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {3DF46539-9B48-4105-BC63-9477816BD4AD} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {45EE8D7D-3563-42ED-97A2-2B4F517FF55F} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {8AB6BABA-0B8D-4E67-A74C-B876FF9E6C8F} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {D4C4F1A6-54E7-40ED-8E26-45CD8E94499E} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

SearchScopes: HKCU - {DF18B157-E712-431A-950B-77289688838E} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=498964fd-e9e3-4c2e-9c63-2a5da7eff274&pid=ccleanerde&mode=bounce&k=0

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR DefaultSearchKeyword: delta-search.com

CHR DefaultSearchProvider: Delta Search

CHR DefaultSearchURL: hxxp://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=FCB26A9423517E69

CHR DefaultNewTabURL: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll ()

CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Bj\u00F6rn\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.2_0\McChPlg.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Docs) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-19]

CHR Extension: (Google Drive) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-19]

CHR Extension: (YouTube) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-19]

CHR Extension: (Google-Suche) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-19]

CHR Extension: (Google Wallet) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30]

CHR Extension: (Google Mail) - C:\Users\Björn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-19]
 

==================== Services (Whitelisted) =================
 

R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

R2 fshoster; C:\Program Files (x86)\Kabel Deutschland\fshoster32.exe [188400 2013-01-18] (F-Secure Corporation)

R3 FSMA; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Common\FSMA32.EXE [209032 2013-01-03] (F-Secure Corporation)

R2 FSORSPClient; C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Reputation\fsorsp.exe [60352 2013-06-25] (F-Secure Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [98560 2014-01-30] (Overwolf LTD)

R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-10] (Dritek System INC.)

R2 sysTPLMonitor.exe; C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe [399640 2014-01-24] (Tlapia)

R2 sysTPLService.exe; C:\Program Files (x86)\sysTPL\sysTPLService.exe [400664 2014-01-24] (Tlapia)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)

R3 F-Secure Gatekeeper; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [203304 2013-12-11] (F-Secure Corporation)

R1 F-Secure HIPS; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\HIPS\drivers\fshs.sys [69296 2013-10-16] (F-Secure Corporation)

R0 fsbts; C:\Windows\System32\Drivers\fsbts.sys [56016 2013-04-11] ()

R0 fsbts; C:\Windows\SysWOW64\Drivers\fsbts.sys [42248 2013-04-11] ()

R3 fsni; C:\Program Files (x86)\Kabel Deutschland\apps\CCF_Scanning\fsni64.sys [80832 2013-04-25] (F-Secure Corporation)

R1 fsvista; C:\Program Files (x86)\Kabel Deutschland\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [14472 2013-01-03] ()

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-10] (Dritek System Inc.)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)

S3 X6va015; \??\C:\WINDOWS\SysWOW64\Drivers\X6va015 [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-07 09:33 - 2014-02-07 09:33 - 00000000 ____D () C:\Users\Björn\Downloads\FRST-OlderVersion

2014-02-07 09:28 - 2014-02-07 09:28 - 00987425 _____ () C:\Users\Björn\Downloads\SecurityCheck.exe

2014-02-07 07:44 - 2014-02-07 07:44 - 02347384 _____ (ESET) C:\Users\Björn\Downloads\esetsmartinstaller_enu.exe

2014-02-07 07:44 - 2014-02-07 07:44 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-05 00:41 - 2014-02-05 00:41 - 00309972 _____ () C:\Users\Björn\Documents\ts3_clientui-win64-1382530211-2014-02-05 00_41_15.869024.dmp

2014-02-05 00:07 - 2014-02-05 00:07 - 00001182 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk

2014-02-05 00:07 - 2014-02-05 00:07 - 00000000 ____D () C:\Program Files (x86)\TeamViewer

2014-02-05 00:06 - 2014-02-05 00:06 - 05852000 _____ (TeamViewer GmbH) C:\Users\Björn\Downloads\TeamViewer_Setup_de-ckc.exe

2014-02-04 23:42 - 2014-02-04 23:42 - 00001985 _____ () C:\Users\Public\Desktop\Overwolf.lnk

2014-02-04 23:42 - 2014-02-04 23:42 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf

2014-02-04 23:42 - 2014-02-04 23:42 - 00000000 ____D () C:\Program Files (x86)\Overwolf

2014-02-04 23:41 - 2014-02-07 07:40 - 00000000 ____D () C:\Users\Björn\AppData\Local\Overwolf

2014-02-04 23:41 - 2014-02-05 01:13 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\TS3Client

2014-02-04 23:41 - 2014-02-04 23:41 - 00001262 _____ () C:\Users\Björn\Desktop\TeamSpeak 3 Client.lnk

2014-02-04 23:41 - 2014-02-04 23:41 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-02-04 23:41 - 2014-02-04 23:41 - 00000000 ____D () C:\Users\Björn\AppData\Local\TeamSpeak 3 Client

2014-02-04 23:40 - 2014-02-04 23:40 - 32520760 _____ (TeamSpeak Systems GmbH) C:\Users\Björn\Downloads\TeamSpeak3-Client-win64-3.0.13.1.exe

2014-02-04 22:22 - 2014-02-07 07:40 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\newnext.me

2014-02-04 22:22 - 2014-02-05 00:49 - 00000000 ____D () C:\Users\Björn\AppData\Local\Mobogenie

2014-02-04 22:22 - 2014-02-04 22:23 - 00000000 ____D () C:\Users\Björn\AppData\Local\cache

2014-02-04 22:22 - 2014-02-04 22:23 - 00000000 ____D () C:\Program Files (x86)\Mobogenie

2014-02-04 22:22 - 2014-02-04 22:22 - 00001035 _____ () C:\Users\Björn\Desktop\Mobogenie.lnk

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\Documents\Mobogenie

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\AppData\Local\genienext

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\.android

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 _____ () C:\Users\Björn\daemonprocess.txt

2014-02-04 22:21 - 2014-02-04 22:21 - 00001577 _____ () C:\Users\Public\Desktop\LastChaosGER.lnk

2014-02-04 22:15 - 2014-02-04 22:15 - 00000118 _____ () C:\Users\Public\Desktop\LastChaos Homepage.url

2014-02-04 22:05 - 2014-02-04 22:14 - 729699846 _____ (InstallShield Software Corporation) C:\Users\Björn\Desktop\LcInstallGER_090903.exe

2014-02-04 22:04 - 2014-02-04 22:04 - 00401752 _____ (Softonic ) C:\Users\Björn\Downloads\SoftonicDownloader_fuer_last-chaos.exe

2014-02-04 22:01 - 2014-02-05 15:08 - 00000000 ____D () C:\Program Files (x86)\sysTPL

2014-02-04 22:01 - 2014-02-04 22:01 - 00000000 __SHD () C:\WINDOWS\SysWOW64\AI_RecycleBin

2014-02-04 22:00 - 2014-02-04 22:00 - 01898464 _____ (Tlapia ) C:\Users\Björn\Downloads\last-chaos.exe

2014-02-04 21:23 - 2014-02-04 21:35 - 991146019 _____ (InstallShield Software Corporation) C:\Users\Björn\Downloads\LastChaos_DE_Setup.exe

2014-02-04 19:35 - 2014-02-04 19:40 - 00091571 _____ () C:\Users\Björn\Documents\ESt2013_Brandstäter_Björn.elfo

2014-02-04 17:03 - 2014-02-04 17:03 - 00001736 _____ () C:\Users\Björn\Desktop\JRT.txt

2014-02-04 16:53 - 2014-02-04 16:53 - 01037530 _____ (Thisisu) C:\Users\Björn\Downloads\JRT.exe

2014-02-04 16:53 - 2014-02-04 16:53 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-02-04 16:48 - 2013-12-09 01:15 - 00787968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll

2014-02-04 16:48 - 2013-11-27 16:36 - 03395920 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll

2014-02-04 16:48 - 2013-11-27 12:41 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe

2014-02-04 16:48 - 2013-11-27 11:34 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll

2014-02-04 16:48 - 2013-11-27 10:54 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll

2014-02-04 16:48 - 2013-11-27 09:48 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-02-04 16:48 - 2013-11-27 09:45 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2014-02-04 16:48 - 2013-11-27 09:40 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-02-04 16:48 - 2013-11-27 09:38 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2014-02-04 16:48 - 2013-11-27 09:17 - 00695808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

2014-02-04 16:48 - 2013-11-27 09:12 - 00848384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

2014-02-04 16:39 - 2014-02-04 16:41 - 00000000 ____D () C:\AdwCleaner

2014-02-04 16:39 - 2014-02-04 16:39 - 01166132 _____ () C:\Users\Björn\Downloads\adwcleaner.exe

2014-02-04 16:32 - 2014-02-04 18:33 - 00003852 _____ () C:\WINDOWS\PFRO.log

2014-02-04 16:22 - 2014-02-04 16:22 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Malwarebytes

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-04 16:22 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2014-02-04 16:21 - 2014-02-04 16:21 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Björn\Downloads\mbam-setup-1.75.0.1300.exe

2014-02-04 15:40 - 2014-02-04 15:41 - 00028713 _____ () C:\Users\Björn\Downloads\Addition.txt

2014-02-04 15:39 - 2014-02-07 09:34 - 00016550 _____ () C:\Users\Björn\Downloads\FRST.txt

2014-02-04 15:39 - 2014-02-07 09:33 - 00000000 ____D () C:\FRST

2014-02-04 15:36 - 2014-02-07 09:33 - 02079744 _____ (Farbar) C:\Users\Björn\Downloads\FRST64.exe
 

==================== One Month Modified Files and Folders =======
 

2014-02-07 09:35 - 2014-02-04 15:39 - 00016550 _____ () C:\Users\Björn\Downloads\FRST.txt

2014-02-07 09:34 - 2014-02-04 15:39 - 00000000 ____D () C:\FRST

2014-02-07 09:33 - 2014-02-07 09:33 - 00000000 ____D () C:\Users\Björn\Downloads\FRST-OlderVersion

2014-02-07 09:33 - 2014-02-04 15:36 - 02079744 _____ (Farbar) C:\Users\Björn\Downloads\FRST64.exe

2014-02-07 09:28 - 2014-02-07 09:28 - 00987425 _____ () C:\Users\Björn\Downloads\SecurityCheck.exe

2014-02-07 09:20 - 2013-10-29 08:45 - 01104169 _____ () C:\WINDOWS\WindowsUpdate.log

2014-02-07 09:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-02-07 08:45 - 2013-01-19 08:08 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-07 08:12 - 2013-02-04 14:07 - 00000956 _____ () C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2268705684-3369493718-70437878-1002UA.job

2014-02-07 07:54 - 2013-01-16 18:28 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2268705684-3369493718-70437878-1002

2014-02-07 07:49 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-02-07 07:48 - 2013-09-30 05:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2014-02-07 07:48 - 2013-09-30 04:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat

2014-02-07 07:48 - 2013-09-30 04:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat

2014-02-07 07:44 - 2014-02-07 07:44 - 02347384 _____ (ESET) C:\Users\Björn\Downloads\esetsmartinstaller_enu.exe

2014-02-07 07:44 - 2014-02-07 07:44 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-07 07:43 - 2013-11-18 01:09 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D60094E3-77E5-48EC-AA70-CB6C017F466A}

2014-02-07 07:41 - 2013-01-19 08:08 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-07 07:41 - 2013-01-19 08:08 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-07 07:40 - 2014-02-04 23:41 - 00000000 ____D () C:\Users\Björn\AppData\Local\Overwolf

2014-02-07 07:40 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\newnext.me

2014-02-07 07:37 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-02-05 15:08 - 2014-02-04 22:01 - 00000000 ____D () C:\Program Files (x86)\sysTPL

2014-02-05 04:10 - 2013-01-16 19:46 - 00000000 ____D () C:\Users\Björn\AppData\Local\clear.fi

2014-02-05 01:29 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\WinStore

2014-02-05 01:28 - 2013-08-15 18:09 - 00000000 ____D () C:\WINDOWS\system32\MRT

2014-02-05 01:28 - 2013-02-18 10:24 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-02-05 01:27 - 2013-01-18 11:06 - 86054176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2014-02-05 01:13 - 2014-02-04 23:41 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\TS3Client

2014-02-05 00:49 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\AppData\Local\Mobogenie

2014-02-05 00:46 - 2013-08-22 15:44 - 00375560 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2014-02-05 00:44 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI

2014-02-05 00:41 - 2014-02-05 00:41 - 00309972 _____ () C:\Users\Björn\Documents\ts3_clientui-win64-1382530211-2014-02-05 00_41_15.869024.dmp

2014-02-05 00:32 - 2013-12-18 22:07 - 00002426 _____ () C:\WINDOWS\setupact.log

2014-02-05 00:07 - 2014-02-05 00:07 - 00001182 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk

2014-02-05 00:07 - 2014-02-05 00:07 - 00000000 ____D () C:\Program Files (x86)\TeamViewer

2014-02-05 00:06 - 2014-02-05 00:06 - 05852000 _____ (TeamViewer GmbH) C:\Users\Björn\Downloads\TeamViewer_Setup_de-ckc.exe

2014-02-04 23:42 - 2014-02-04 23:42 - 00001985 _____ () C:\Users\Public\Desktop\Overwolf.lnk

2014-02-04 23:42 - 2014-02-04 23:42 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf

2014-02-04 23:42 - 2014-02-04 23:42 - 00000000 ____D () C:\Program Files (x86)\Overwolf

2014-02-04 23:41 - 2014-02-04 23:41 - 00001262 _____ () C:\Users\Björn\Desktop\TeamSpeak 3 Client.lnk

2014-02-04 23:41 - 2014-02-04 23:41 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-02-04 23:41 - 2014-02-04 23:41 - 00000000 ____D () C:\Users\Björn\AppData\Local\TeamSpeak 3 Client

2014-02-04 23:40 - 2014-02-04 23:40 - 32520760 _____ (TeamSpeak Systems GmbH) C:\Users\Björn\Downloads\TeamSpeak3-Client-win64-3.0.13.1.exe

2014-02-04 22:23 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\AppData\Local\cache

2014-02-04 22:23 - 2014-02-04 22:22 - 00000000 ____D () C:\Program Files (x86)\Mobogenie

2014-02-04 22:22 - 2014-02-04 22:22 - 00001035 _____ () C:\Users\Björn\Desktop\Mobogenie.lnk

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\Documents\Mobogenie

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\AppData\Local\genienext

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 ____D () C:\Users\Björn\.android

2014-02-04 22:22 - 2014-02-04 22:22 - 00000000 _____ () C:\Users\Björn\daemonprocess.txt

2014-02-04 22:22 - 2013-10-29 08:51 - 00000000 ____D () C:\Users\Björn

2014-02-04 22:21 - 2014-02-04 22:21 - 00001577 _____ () C:\Users\Public\Desktop\LastChaosGER.lnk

2014-02-04 22:15 - 2014-02-04 22:15 - 00000118 _____ () C:\Users\Public\Desktop\LastChaos Homepage.url

2014-02-04 22:15 - 2012-09-01 19:11 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-02-04 22:14 - 2014-02-04 22:05 - 729699846 _____ (InstallShield Software Corporation) C:\Users\Björn\Desktop\LcInstallGER_090903.exe

2014-02-04 22:04 - 2014-02-04 22:04 - 00401752 _____ (Softonic ) C:\Users\Björn\Downloads\SoftonicDownloader_fuer_last-chaos.exe

2014-02-04 22:01 - 2014-02-04 22:01 - 00000000 __SHD () C:\WINDOWS\SysWOW64\AI_RecycleBin

2014-02-04 22:00 - 2014-02-04 22:00 - 01898464 _____ (Tlapia ) C:\Users\Björn\Downloads\last-chaos.exe

2014-02-04 21:35 - 2014-02-04 21:23 - 991146019 _____ (InstallShield Software Corporation) C:\Users\Björn\Downloads\LastChaos_DE_Setup.exe

2014-02-04 19:40 - 2014-02-04 19:35 - 00091571 _____ () C:\Users\Björn\Documents\ESt2013_Brandstäter_Björn.elfo

2014-02-04 18:33 - 2014-02-04 16:32 - 00003852 _____ () C:\WINDOWS\PFRO.log

2014-02-04 18:30 - 2013-01-26 08:25 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular

2014-02-04 17:03 - 2014-02-04 17:03 - 00001736 _____ () C:\Users\Björn\Desktop\JRT.txt

2014-02-04 16:53 - 2014-02-04 16:53 - 01037530 _____ (Thisisu) C:\Users\Björn\Downloads\JRT.exe

2014-02-04 16:53 - 2014-02-04 16:53 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-02-04 16:41 - 2014-02-04 16:39 - 00000000 ____D () C:\AdwCleaner

2014-02-04 16:39 - 2014-02-04 16:39 - 01166132 _____ () C:\Users\Björn\Downloads\adwcleaner.exe

2014-02-04 16:22 - 2014-02-04 16:22 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\Malwarebytes

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-04 16:22 - 2014-02-04 16:22 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-04 16:21 - 2014-02-04 16:21 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Björn\Downloads\mbam-setup-1.75.0.1300.exe

2014-02-04 15:41 - 2014-02-04 15:40 - 00028713 _____ () C:\Users\Björn\Downloads\Addition.txt

2014-02-04 15:21 - 2013-08-15 17:58 - 00000000 ____D () C:\Users\Björn\AppData\Roaming\vlc

2014-02-04 15:21 - 2013-04-01 16:26 - 00000000 ____D () C:\Program Files (x86)\Kabel Deutschland

2014-02-04 15:21 - 2013-02-22 09:06 - 00000000 ____D () C:\Users\Björn\AppData\Local\Bandizip

2014-02-04 15:13 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\registration

2014-02-04 15:13 - 2013-07-05 07:05 - 00000000 ____D () C:\Users\Björn\Documents\UseNeXT

2014-01-30 21:47 - 2013-08-22 16:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2014-01-30 21:47 - 2013-08-22 16:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
 

Files to move or delete:

====================

C:\Users\Björn\MAESTIA_SETUP.exe
 
 

Some content of TEMP:

====================

C:\Users\Björn\AppData\Local\Temp\Mobogenie_Setup_2-1-37_610.exe

C:\Users\Björn\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-02-05 15:17
 

==================== End Of Log =========================

--- --- ---
[CODE]

so nun dürftest alles haben .....

außer das es sich bei mir alles verdreichfacht hat ... beim codequell
und ich eset noch nicht im win 8 runterhab
aber sonst ist seit systemwiederherstellung ok und läuft .... den rst mußt u mir sagen
lt. post
und logs

Java updaten. Funde von ESET manuell löschen bevor ich noch genauer merke dass da Cracks gefunden wurden und ich den Support einstellen muss ;)

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [775872 2014-02-04] ()

C:\Program Files (x86)\Mobogenie

S3 X6va015; \??\C:\WINDOWS\SysWOW64\Drivers\X6va015 [X]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Fixlist :

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-02-2014 02

Ran by Björn at 2014-02-09 18:17:53 Run:1

Running from C:\Users\Björn\Downloads

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [775872 2014-02-04] ()

C:\Program Files (x86)\Mobogenie

S3 X6va015; \??\C:\WINDOWS\SysWOW64\Drivers\X6va015 [X]

*****************
 

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => Value deleted successfully.

"C:\Program Files (x86)\Mobogenie" => File/Directory not found.

X6va015 => Service deleted successfully.
 

==== End of Fixlog ====

Öhm, das mit defrogger bzw. debugger mußt mir nochmal erklären, denn hab beides irgendwie nie benutzt ....
Soll ch denn gleich mit DelFix weitermachen?

genau, gleich Delfix :)

Ok....danke :applaus: mein System läuft nun stabil und ich hoff mal das bleibt auch so ;-)