| sir peter | 27.01.2015 18:25 |
ja, das funktioniert...
[CODE]
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-01-2015 (ATTENTION: ====> FRST version is 20 days old and could be outdated)
Ran by Der Peter (administrator) on DERPETER-PC on 27-01-2015 18:03:50
Running from C:\Users\Der Peter\Desktop
Loaded Profile: Der Peter (Available profiles: Der Peter)
Platform: Microsoft Windows 7 Enterprise Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Safe Mode (minimal)
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SMSERIAL] => C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [1458176 2009-10-26] (Motorola Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-10] (AVAST Software)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM\...\RunOnce: [WSE_Vosteran] => C:\Windows\system32\wscript.exe /E:vbscript /B "C:\Users\DERPET~1\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"
HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\...\Run: [WinPatrol] => C:\Program Files\Ruiware\WinPatrol\winpatrol.exe [1154112 2014-07-21] (Ruiware LLC)
HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd)
HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5489944 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\...\RunOnce: [WSE_Vosteran] => C:\Windows\system32\wscript.exe /E:vbscript /B "C:\Users\DERPET~1\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
ShortcutTarget: VPN Client.lnk -> C:\Windows\Installer\{1CE60928-8325-49A8-8B06-633E48DD2B67}\Icon3E5562ED7.ico ()
Startup: C:\Users\Der Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://vosteran.com/?f=1&a=vst_dnldastr_15_05&cd=2XzuyEtN2Y1L1QzutCtBtAyEyDyCyBzzzytD0A0ByDtBtCtBtN0D0Tzu0StCtCtBtCtN1L2XzutAtFyBtFtAtFyEtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0DtAtDzy0E0ByEtGyC0A0EzztGtByEyDyBtGyDyEtByCtGyBtDyE0Azy0DyC0A0EtA0Fzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyCzy0B0EtD0FyDtGyDtA0BtAtGyE0FzytAtG0ByC0B0FtGtD0DtByE0EtB0EtDtCyByC0B2Q&cr=1805479232&ir=
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldastr_15_05&cd=2XzuyEtN2Y1L1QzutCtBtAyEyDyCyBzzzytD0A0ByDtBtCtBtN0D0Tzu0StCtCtBtCtN1L2XzutAtFyBtFtAtFyEtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0DtAtDzy0E0ByEtGyC0A0EzztGtByEyDyBtGyDyEtByCtGyBtDyE0Azy0DyC0A0EtA0Fzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyCzy0B0EtD0FyDtGyDtA0BtAtGyE0FzytAtG0ByC0B0FtGtD0DtByE0EtB0EtDtCyByC0B2Q&cr=1805479232&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldastr_15_05&cd=2XzuyEtN2Y1L1QzutCtBtAyEyDyCyBzzzytD0A0ByDtBtCtBtN0D0Tzu0StCtCtBtCtN1L2XzutAtFyBtFtAtFyEtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0DtAtDzy0E0ByEtGyC0A0EzztGtByEyDyBtGyDyEtByCtGyBtDyE0Azy0DyC0A0EtA0Fzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyCzy0B0EtD0FyDtGyDtA0BtAtGyE0FzytAtG0ByC0B0FtGtD0DtByE0EtB0EtDtCyByC0B2Q&cr=1805479232&ir=
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldastr_15_05&cd=2XzuyEtN2Y1L1QzutCtBtAyEyDyCyBzzzytD0A0ByDtBtCtBtN0D0Tzu0StCtCtBtCtN1L2XzutAtFyBtFtAtFyEtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0DtAtDzy0E0ByEtGyC0A0EzztGtByEyDyBtGyDyEtByCtGyBtDyE0Azy0DyC0A0EtA0Fzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyCzy0B0EtD0FyDtGyDtA0BtAtGyE0FzytAtG0ByC0B0FtGtD0DtByE0EtB0EtDtCyByC0B2Q&cr=1805479232&ir=
SearchScopes: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldastr_15_05&cd=2XzuyEtN2Y1L1QzutCtBtAyEyDyCyBzzzytD0A0ByDtBtCtBtN0D0Tzu0StCtCtBtCtN1L2XzutAtFyBtFtAtFyEtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0DtAtDzy0E0ByEtGyC0A0EzztGtByEyDyBtGyDyEtByCtGyBtDyE0Azy0DyC0A0EtA0Fzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyCzy0B0EtD0FyDtGyDtA0BtAtGyE0FzytAtG0ByC0B0FtGtD0DtByE0EtB0EtDtCyByC0B2Q&cr=1805479232&ir=
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Der Peter\AppData\Roaming\Mozilla\Firefox\Profiles\j58twde5.default-1420887990363
FF Plugin: @canon.com/MycameraPlugin -> C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program File\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.75.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.75.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3580812390-2972974327-1728687882-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Der Peter\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF user.js: detected! => C:\Users\Der Peter\AppData\Roaming\Mozilla\Firefox\Profiles\j58twde5.default-1420887990363\user.js
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-10-31]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-26]
CHR HKLM\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx [Not Found]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-26] (AVAST Software)
S2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528616 2010-09-27] (Cisco Systems, Inc.)
S2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [174656 2006-11-02] () [File not signed]
S2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-11-26] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-26] (AVAST Software)
S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-11-26] (AVAST Software)
S0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-11-26] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-26] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2014-11-26] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2014-11-26] (AVAST Software)
S0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-11-26] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42784 2014-09-07] (AVG Technologies)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
S2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2010-09-27] (Cisco Systems, Inc.) [File not signed]
S3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-01] (DT Soft Ltd)
S1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82168 2013-11-21] (EZB Systems, Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2007-07-31] (ATK0100)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
S3 catchme; \??\C:\Users\DERPET~1\AppData\Local\Temp\catchme.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-27 18:03 - 2015-01-27 18:04 - 00012285 _____ () C:\Users\Der Peter\Desktop\FRST.txt
2015-01-26 18:47 - 2015-01-26 18:48 - 00000000 ____D () C:\Users\Der Peter\AppData\Local\Vosteran
2015-01-26 18:46 - 2015-01-26 19:08 - 00000000 ____D () C:\Program Files\Dynamo Combo
2015-01-26 18:46 - 2015-01-26 18:55 - 00000306 _____ () C:\Windows\Tasks\WSE_Vosteran.job
2015-01-26 18:46 - 2015-01-26 18:46 - 00000000 ____D () C:\Users\Der Peter\AppData\Roaming\WSE_Vosteran
2015-01-26 18:46 - 2015-01-26 18:46 - 00000000 ____D () C:\Users\Der Peter\AppData\Local\1886312
2015-01-26 18:46 - 2015-01-26 18:46 - 00000000 ____D () C:\Program Files\WSE_Vosteran
2015-01-26 18:40 - 2015-01-26 18:40 - 00757336 _____ (DownloadAstro) C:\Users\Der Peter\Downloads\mozilla_firefox 33.0.exe
2015-01-25 19:05 - 2015-01-26 19:08 - 00032280 _____ () C:\Windows\PFRO.log
2015-01-25 19:05 - 2015-01-26 19:08 - 00000280 _____ () C:\Windows\setupact.log
2015-01-25 19:05 - 2015-01-25 19:05 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-24 16:39 - 2015-01-24 16:39 - 01191200 _____ () C:\Users\Der Peter\Downloads\Firefox - CHIP-Installer.exe
2015-01-24 12:41 - 2015-01-26 18:41 - 04070576 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2015-01-24 12:26 - 2015-01-24 12:26 - 00002242 _____ () C:\Users\Der Peter\Desktop\cc_20150124_122602.reg
2015-01-24 12:24 - 2015-01-26 18:57 - 00001130 _____ () C:\Windows\SecuniaPackage.log
2015-01-22 16:02 - 2015-01-22 16:02 - 00081374 _____ () C:\Users\Der Peter\Desktop\cc_20150122_160150.reg
2015-01-21 18:06 - 2015-01-21 18:06 - 00000929 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-21 18:06 - 2015-01-21 18:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-21 18:06 - 2015-01-21 18:06 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-21 18:04 - 2015-01-21 18:04 - 05317104 _____ (Piriform Ltd) C:\Users\Der Peter\Desktop\ccsetup501.exe
2015-01-21 15:37 - 2015-01-21 15:36 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-01-21 15:36 - 2015-01-21 15:36 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-01-21 15:36 - 2015-01-21 15:36 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-01-21 15:36 - 2015-01-21 15:36 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-01-21 15:36 - 2015-01-21 15:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-18 18:15 - 2015-01-21 15:33 - 00058624 _____ () C:\Users\Der Peter\Desktop\SystemLook.txt
2015-01-18 18:14 - 2015-01-18 18:14 - 00139264 _____ () C:\Users\Der Peter\Desktop\SystemLook.exe
2015-01-14 16:43 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 16:43 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-14 16:43 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 16:43 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 16:42 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 16:42 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-13 19:43 - 2015-01-13 19:43 - 00001783 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2015-01-13 19:43 - 2015-01-13 19:43 - 00001763 _____ () C:\Users\Public\Desktop\PDF24 Fax.lnk
2015-01-13 19:43 - 2015-01-13 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2015-01-10 11:57 - 2015-01-10 11:57 - 00244264 _____ () C:\Users\Der Peter\Downloads\Firefox Setup Stub 34.0.5.exe
2015-01-10 11:34 - 2015-01-10 11:34 - 00001186 _____ () C:\Users\Der Peter\Desktop\Revo Uninstaller.lnk
2015-01-10 11:34 - 2015-01-10 11:34 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-01-10 11:32 - 2015-01-10 11:32 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Der Peter\Desktop\revosetup95.exe
2015-01-07 18:47 - 2015-01-07 18:47 - 00000000 __SHD () C:\Users\Der Peter\AppData\Local\EmieBrowserModeList
2015-01-07 17:06 - 2015-01-07 17:06 - 00852505 _____ () C:\Users\Der Peter\Desktop\SecurityCheck.exe
2015-01-06 20:19 - 2015-01-06 20:19 - 02347384 _____ (ESET) C:\Users\Der Peter\Desktop\esetsmartinstaller_deu.exe
2015-01-06 18:56 - 2015-01-07 17:14 - 00000000 ____D () C:\Users\Der Peter\Desktop\FRST-OlderVersion
2015-01-06 18:40 - 2015-01-06 18:40 - 00000000 ____D () C:\Windows\ERUNT
2015-01-06 18:39 - 2015-01-06 18:39 - 01707939 _____ (Thisisu) C:\Users\Der Peter\Desktop\JRT.exe
2015-01-06 18:21 - 2015-01-06 18:25 - 00000000 ____D () C:\AdwCleaner
2015-01-06 18:19 - 2015-01-06 18:19 - 02173952 _____ () C:\Users\Der Peter\Desktop\AdwCleaner_4.106.exe
2015-01-06 17:30 - 2015-01-06 17:30 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Der Peter\Desktop\mbam-setup-2.0.4.1028.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-27 18:03 - 2014-12-18 17:53 - 00000000 ____D () C:\FRST
2015-01-26 19:34 - 2012-10-31 18:37 - 01641993 _____ () C:\Windows\WindowsUpdate.log
2015-01-26 19:08 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-26 19:00 - 2009-07-14 03:04 - 00000505 _____ () C:\Windows\win.ini
2015-01-26 18:41 - 2012-10-31 19:46 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-26 18:27 - 2012-10-31 19:46 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-01-26 18:27 - 2012-10-31 19:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-01-26 18:26 - 2014-05-28 20:21 - 00000944 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3580812390-2972974327-1728687882-1001UA.job
2015-01-26 18:24 - 2009-07-14 05:34 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-26 18:24 - 2009-07-14 05:34 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-26 18:19 - 2012-11-01 13:47 - 00000000 ___RD () C:\Users\Der Peter\Dropbox
2015-01-26 18:18 - 2012-11-01 13:24 - 00000000 ____D () C:\Users\Der Peter\AppData\Roaming\Dropbox
2015-01-21 18:13 - 2012-11-01 19:38 - 00000000 ____D () C:\Users\Der Peter\AppData\Roaming\DAEMON Tools Lite
2015-01-21 18:12 - 2013-12-19 15:36 - 00000000 ____D () C:\Windows\Minidump
2015-01-21 18:12 - 2012-11-06 13:15 - 00000000 ____D () C:\Users\Der Peter\AppData\Local\CrashDumps
2015-01-21 18:12 - 2009-10-15 11:22 - 00000000 ____D () C:\Windows\Panther
2015-01-21 15:35 - 2013-10-02 22:31 - 00000000 ____D () C:\Program Files\Java
2015-01-21 15:07 - 2014-07-14 21:08 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-18 21:26 - 2014-05-28 20:21 - 00000922 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3580812390-2972974327-1728687882-1001Core.job
2015-01-14 21:45 - 2013-08-29 10:06 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 21:38 - 2012-10-31 20:07 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-13 19:43 - 2012-11-03 16:25 - 00000000 ____D () C:\Program Files\PDF24
2015-01-13 17:33 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-12 14:36 - 2014-10-06 10:30 - 00000039 _____ () C:\Windows\magix.ini
2015-01-11 17:39 - 2009-10-15 10:59 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-08 09:55 - 2012-10-31 18:58 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-07 17:14 - 2014-12-18 17:52 - 01115648 _____ (Farbar) C:\Users\Der Peter\Desktop\FRST.exe
2015-01-06 17:31 - 2014-07-14 20:33 - 00001024 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-06 17:31 - 2014-07-14 20:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-06 17:31 - 2014-07-14 20:33 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
Some content of TEMP:
====================
C:\Users\Der Peter\AppData\Local\temp\0009.exe
C:\Users\Der Peter\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpdkstez.dll
C:\Users\Der Peter\AppData\Local\temp\uninstall.exe
C:\Users\Der Peter\AppData\Local\temp\VSTStubSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-24 15:26
==================== End Of Log ============================
--- --- ---
und das kam auch gleich noch dazu: Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-01-2015
Ran by Der Peter at 2015-01-27 18:05:29
Running from C:\Users\Der Peter\Desktop
Boot Mode: Safe Mode (minimal)
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 Plugin (HKLM\...\{F1410A0A-8205-4D45-BF2B-9C7ACB2F4B24}) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\{465571A6-29A2-4D39-B77D-3A1F6C964B65}) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 4.2 (HKLM\...\{FC5A8E68-A2E5-4E14-91FA-7A3FB83C7E23}) (Version: 4.2.1 - Adobe)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
ALDI NORD Bestellsoftware 4.14.5 (HKLM\...\ALDI NORD Bestellsoftware) (Version: 4.14.5 - ORWO Net)
Allway Sync version 14.0.1 (HKLM\...\Allway Sync_is1) (Version: - Botkind Inc)
Aquamarin Haushaltsbuch 2.9.2 b (HKLM\...\{1E517C0C-8542-4F8C-DA23-98BCA13CD1F4}_is1) (Version: - makasy.com)
Avast Free Antivirus (HKLM\...\avast) (Version: 10.0.2208 - AVAST Software)
CANON iMAGE GATEWAY MyCamera Download Plugin (HKLM\...\MyCamera Download Plugin) (Version: 3.1.1.2 - Canon Inc.)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM\...\CANON iMAGE GATEWAY Task) (Version: 1.9.0.9 - Canon Inc.)
Canon MOV Decoder (HKLM\...\Canon MOV Decoder) (Version: 1.8.0.7 - Canon Inc.)
Canon MOV Encoder (HKLM\...\Canon MOV Encoder) (Version: 1.6.0.1 - Canon Inc.)
Canon MovieEdit Task for ZoomBrowser EX (HKLM\...\MovieEditTask) (Version: 3.7.0.4 - Canon Inc.)
Canon Utilities Digital Photo Professional 3.10 (HKLM\...\DPP) (Version: 3.10.2.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM\...\EOS Utility) (Version: 2.10.2.0 - Canon Inc.)
Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX (HKLM\...\EOS Video Snapshot Task) (Version: 1.0.0.10 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM\...\Picture Style Editor) (Version: 1.9.0.0 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (HKLM\...\ZoomBrowser EX Memory Card Utility) (Version: 1.5.0.9 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Cisco Systems VPN Client 5.0.07.0410 (HKLM\...\{1CE60928-8325-49A8-8B06-633E48DD2B67}) (Version: 5.0.7 - Cisco Systems, Inc.)
Corel PaintShop Pro X4 (HKLM\...\_{00580795-581C-4587-B9F2-37320D7AB37F}) (Version: 14.0.0.332 - Corel Corporation)
Corel PaintShop Pro X4 (Version: 14.2.0.1 - Corel Corporation) Hidden
Counter-Strike 1.6 (HKLM\...\Counter-Strike 1.6) (Version: - )
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.45.4.0314 - DT Soft Ltd)
Dropbox (HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Garmin BaseCamp (HKLM\...\{B27D272F-2860-4363-9803-956C0A9FAFB9}) (Version: 4.1.2 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
HP Deskjet 1050 J410 series - Grundlegende Software für das Gerät (HKLM\...\{9C31FFDC-E796-4884-B990-41B9A5B2A647}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
ICA (Version: 14.0.0.332 - Corel Corporation) Hidden
IPM_PSP_COM (Version: 14.0.0.332 - Corel Corporation) Hidden
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
ISO to USB (HKLM\...\{D08A30AC-A663-4EA8-8D81-B98E17F19F1C}_is1) (Version: - isotousb.com)
Java 7 Update 75 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217075FF}) (Version: 7.0.750 - Oracle)
Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
LibreOffice 4.2.7.2 (HKLM\...\{A313C39F-79A7-408B-97EE-8F958407D694}) (Version: 4.2.7.2 - The Document Foundation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Image Composite Editor (HKLM\...\{3D599ADA-65D9-4B51-898F-CE718DEC5DBB}) (Version: 1.4.4 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Motorola SM56 Speakerphone Modem (HKLM\...\SMSERIAL) (Version: 6.12.25.06 - Motorola Inc)
NVIDIA PhysX (HKLM\...\{1C4551A6-4743-4093-91E4-1477CD655043}) (Version: 9.09.0203 - NVIDIA Corporation)
PDF24 Creator 6.9.2 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PSPPContent (Version: 14.0.0.332 - Corel Corporation) Hidden
PSPPHelp (Version: 14.0.0.332 - Corel Corporation) Hidden
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Setup (Version: 14.0.0.332 - Ihr Firmenname) Hidden
Skype™ 6.21 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.50 - Ghisler Software GmbH)
UltraISO Premium V9.62 (HKLM\...\UltraISO_is1) (Version: - )
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.64 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKU\S-1-5-21-3580812390-2972974327-1728687882-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
WSE_Vosteran (HKLM\...\WSE_Vosteran) (Version: - WSE_Vosteran) <==== ATTENTION!
XMind (HKLM\...\XMind) (Version: 3.3.0 - XMind Ltd.)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{1EF21888-3BD8-4064-BAD3-4BF694952652}\InprocServer32 -> C:\Program Files\Microsoft Research\Image Composite Editor\WLPG.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Der Peter\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Der Peter\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Der Peter\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Der Peter\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3580812390-2972974327-1728687882-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Der Peter\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
07-01-2015 16:59:44 Windows Update
10-01-2015 11:37:01 Revo Uninstaller's restore point - Mozilla Firefox 34.0.5 (x86 de)
12-01-2015 14:35:17 Revo Uninstaller's restore point - MAGIX hiphop maker
13-01-2015 17:43:02 Windows Update
14-01-2015 21:36:31 Windows Update
18-01-2015 17:40:22 Revo Uninstaller's restore point - Mozilla Firefox 35.0 (x86 de)
21-01-2015 15:16:44 Windows Update
21-01-2015 15:25:22 Revo Uninstaller's restore point - Mozilla Firefox 35.0 (x86 de)
24-01-2015 12:17:56 Revo Uninstaller's restore point - Mozilla Firefox 35.0 (x86 de)
25-01-2015 19:18:31 Windows Update
26-01-2015 18:41:38 Revo Uninstaller's restore point - Mozilla Firefox 35.0 (x86 de)
26-01-2015 18:49:07 Revo Uninstaller's restore point - Vosteran
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2014-12-21 23:23 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {03FEED26-A270-4097-96D2-2918B9FBAFC3} - System32\Tasks\{97EC7512-BA5D-45F1-9A4D-39C3316F6545} => C:\Program Files\1602.exe
Task: {114CEE5A-C82E-477C-B0F7-21360BA0E1DC} - System32\Tasks\{A8CBA0FA-44BB-4DCD-88A9-1AFC30074848} => G:\check.exe
Task: {1B5B31FC-C410-431C-8A9D-49F95A728EA3} - System32\Tasks\{1A3975A3-204F-4020-A3AE-1F47F0F3411D} => C:\Program Files\1602.exe
Task: {1DECE877-BE8A-4BC3-AB14-C08713E5B209} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3580812390-2972974327-1728687882-1001UA => C:\Users\Der Peter\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-05-28] (Facebook Inc.)
Task: {25C83CBE-D6B4-4AB5-B4AD-F24F9CF9FE72} - System32\Tasks\{0A657B28-E4EE-497D-8892-B7CCF22A9FD3} => G:\check.exe
Task: {28775E87-2B6F-4746-850A-245302E9C12C} - System32\Tasks\{D07F1F52-1CE0-45EA-90C4-0955B5ED0E21} => C:\BlueByte\Siedler3\AUTORUN.EXE
Task: {5311C552-F1D3-41A6-AC08-7C6ED153A3BD} - System32\Tasks\{17DEF135-9569-4BA5-95E3-48C7AA23B2F8} => G:\check.exe
Task: {57A402B2-6EED-44B0-8C11-BFBE198D04DF} - System32\Tasks\{2DBDD41D-243F-4DDE-874B-74D37969213F} => C:\Program Files\1602.exe
Task: {58BD1DAE-13F2-4F18-BE96-60C3B663DF69} - System32\Tasks\{49EF9064-42D9-4D8A-931F-07D7699E0132} => C:\Program Files\1602.exe
Task: {7BE91E5F-FDC5-4F74-A2D9-EF620957D479} - System32\Tasks\{DFCE74AB-D7A9-4837-8187-C10C68858B07} => C:\Program Files\1602.exe
Task: {81DD86F8-E485-4FFC-801F-F3612633744B} - System32\Tasks\WSE_Vosteran => C:\Users\Der Peter\AppData\Roaming\WSE_Vosteran\UpdateProc\UpdateTask.exe [2015-01-26] () <==== ATTENTION
Task: {8C90D7E9-10D0-4541-A5E1-48077299C5FD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-26] (AVAST Software)
Task: {9AB87F04-62D9-44B2-88F7-3D7FC45B3573} - System32\Tasks\{E66DB108-FF6D-44E7-91CF-DB0BCEE5E11C} => G:\check.exe
Task: {A321AB1B-3B08-48DD-B897-8AF575749E64} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {B869A3F5-6241-49AE-8099-3C03C0801086} - System32\Tasks\{3AAD059D-B040-4917-AF54-6D6B3363DE92} => G:\check.exe
Task: {BB6EEFE9-2E05-4B32-B37B-628D4E684872} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {C2C3FA7F-EAA0-472D-BE8B-064C50AC4327} - System32\Tasks\{1DE3ECA0-83BC-4DBD-873E-25DB5C034703} => C:\Program Files\1602.exe
Task: {C7223C8C-9A82-447A-92F3-FE1F5D6442D8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-26] (Adobe Systems Incorporated)
Task: {D3D5D37B-2EB5-45C2-B3CD-A983499E380D} - System32\Tasks\{0E5448D0-541C-4220-80AE-5F9F5445DE60} => pcalua.exe -a C:\BlueByte\Siedler3\siedler-3-urversion-160\s3old160.exe -d C:\BlueByte\Siedler3\siedler-3-urversion-160
Task: {DC429F0F-863B-4D4E-B945-432FC9A13C87} - System32\Tasks\{A9DED861-AFD3-43E1-A59B-90428AE26238} => G:\_setup\Setup.exe
Task: {E2D86434-606D-4B9A-85E1-6EC9B984ACA3} - System32\Tasks\{7268DC39-C6B1-4D2A-B9BA-EBE36791C299} => C:\Westwood\AR2\Ra2.exe
Task: {E30659E5-0D2D-42CF-981A-F690A013C51E} - System32\Tasks\{218CE1E3-9A9F-44F9-BD29-20A42E735F13} => C:\Program Files\1602.exe
Task: {F0335FB9-37EB-4D30-906B-829286C930AC} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3580812390-2972974327-1728687882-1001Core => C:\Users\Der Peter\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-05-28] (Facebook Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3580812390-2972974327-1728687882-1001Core.job => C:\Users\Der Peter\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3580812390-2972974327-1728687882-1001UA.job => C:\Users\Der Peter\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\WSE_Vosteran.job => C:\Users\DERPET~1\AppData\Roaming\WSE_VO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:C64BF02A
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-3580812390-2972974327-1728687882-500 - Administrator - Disabled)
Der Peter (S-1-5-21-3580812390-2972974327-1728687882-1001 - Administrator - Enabled) => C:\Users\Der Peter
Gast (S-1-5-21-3580812390-2972974327-1728687882-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3580812390-2972974327-1728687882-1185 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: aswRvrt
Description: aswRvrt
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswRvrt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: aswVmm
Description: aswVmm
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswVmm
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Cisco Systems VPN Adapter
Description: Cisco Systems VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/26/2015 07:25:33 PM) (Source: SignInAssistant) (EventID: 0) (User: )
Description: StartService failed with hr = 0x8007043c
Error: (01/26/2015 06:41:37 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {89b5100b-cc80-4e53-ba8c-b33643041bea}
Error: (01/26/2015 06:34:53 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (01/26/2015 06:33:29 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (01/24/2015 03:27:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/24/2015 03:27:20 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/24/2015 00:51:21 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (01/24/2015 00:29:48 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (01/24/2015 00:17:55 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {65cb48f7-77f6-4163-bae1-e8222374193b}
Error: (01/22/2015 03:48:53 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
System errors:
=============
Error: (01/27/2015 05:50:11 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/27/2015 05:50:11 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/27/2015 05:50:11 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/27/2015 05:50:11 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/27/2015 05:50:11 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/27/2015 05:50:11 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/27/2015 05:50:11 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (01/27/2015 05:50:10 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Error: (01/27/2015 05:50:08 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/27/2015 05:50:08 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Microsoft Office Sessions:
=========================
Error: (01/26/2015 07:25:33 PM) (Source: SignInAssistant) (EventID: 0) (User: )
Description: StartService failed with hr = 0x8007043c
Error: (01/26/2015 06:41:37 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {89b5100b-cc80-4e53-ba8c-b33643041bea}
Error: (01/26/2015 06:34:53 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:
Error: (01/26/2015 06:33:29 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:
Error: (01/24/2015 03:27:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Deskjet 1050 J410 series\DriverStore\Pipeline\amd64\hpinkins8911.exe
Error: (01/24/2015 03:27:20 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\aldi nord bestellsoftware\install_flash_player.exe
Error: (01/24/2015 00:51:21 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:
Error: (01/24/2015 00:29:48 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:
Error: (01/24/2015 00:17:55 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {65cb48f7-77f6-4163-bae1-e8222374193b}
Error: (01/22/2015 03:48:53 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz
Percentage of memory in use: 13%
Total physical RAM: 3071.27 MB
Available physical RAM: 2646.56 MB
Total Pagefile: 6140.84 MB
Available Pagefile: 5748.64 MB
Total Virtual: 2047.88 MB
Available Virtual: 1925.01 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:37.33 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 552D552D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
dann auf 
und dann auf 
. 