Trojaner-Board - search.b1.org Mozilla

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - search.b1.org Mozilla (https://www.trojaner-board.de/140741-search-b1-org-mozilla.html)

search.b1.org Mozilla

Guten Tag,

ich sitze hier am Laptop eines Kumpels meines Bruders der die besagte Toolbar? auf dem Rechner hat und nicht weiß was er machen soll. Da ich mir selbst nicht sicher bin und auch nicht weiß ob er noch andere Schadsoftware auf dem Rechner hat bitte ich euch um Hife.

Auf dem Rechner läuft Windows 8, Antivir und die Comodo Firewall soweit mir bekannt. Allerdings letztere wahrscheinlich durch die B1 Search eingeschränkt (keine Updates und deaktiviert).

MfG
AlphA

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01

Ran by Dorian (administrator) on ZOCKERPC on 31-08-2013 11:43:43

Running from C:\Users\Dorian\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

(Microsoft Corporation) C:\Windows\system32\dashost.exe

() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe

() C:\Program Files (x86)\ControlFilters\CFMonitor.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

() C:\Program Files (x86)\ControlFilters\CFService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PMMUpdate.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)

HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()

HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-09-27] (SEIKO EPSON CORPORATION)

HKCU\...\Run: [Spotify Web Helper] - C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-11-24] ()

HKCU\...\Run: [Comrade.exe] - C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe [36864 2007-05-27] (IGN Entertainment Inc.)

HKCU\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-09-27] (SEIKO EPSON CORPORATION)

HKCU\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [81952 2012-10-30] (PC Utilities Pro)

HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1672616 2013-07-09] (Valve Corporation)

HKLM-x32\...\Run: [LManager] -  [x]

HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-18] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [ControlFilters] - C:\Program Files (x86)\ControlFilters\ControlFilters.exe [403256 2013-04-11] ()

HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)

HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)

AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk

ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)

BootExecute: autocheck autochk * bootdelete
 

==================== Internet (Whitelisted) ====================
 

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:8877;https=127.0.0.1:8877

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0

SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0

SearchScopes: HKLM - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0

SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0

SearchScopes: HKLM-x32 - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - DefaultScope {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = 

SearchScopes: HKCU - {0BD0A52C-9380-4182-ADE4-0BA4CC4F198E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=811df156-cc18-4579-9a5b-9c932fd499a2&apn_sauid=40AA1AFF-8D25-4554-B408-077202E0064E

SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.portaldosites.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=0

SearchScopes: HKCU - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = 

BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)

BHO-x32: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
 

FireFox:

========

FF ProfilePath: C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default

FF Homepage: about:home

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll No File

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Dorian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: No Name - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\4sharedCopyLinks.xpi

FF Extension: firefox - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\firefox@ghostery.com.xpi

FF Extension: No Name - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-18] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-18] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [811064 2013-07-18] (Avira Operations GmbH & Co. KG)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)

R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

R2 CFMonitor.exe; C:\Program Files (x86)\ControlFilters\CFMonitor.exe [27960 2013-04-11] ()

R2 CFService.exe; C:\Program Files (x86)\ControlFilters\CFService.exe [31032 2013-04-11] ()

R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5784472 2013-04-15] (COMODO)

S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [158928 2013-04-15] (COMODO)

S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2094216 2013-05-29] ()

R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

R2 ETDService; C:\Program Files\Elantech\ETDService.exe [85904 2012-09-05] (ELAN Microelectronics Corp.)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-11-24] (Dritek System INC.)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-27] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130016 2013-03-27] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [83672 2013-07-18] (Avira Operations GmbH & Co. KG)

S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)

S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)

S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-04-15] (COMODO)

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [712216 2013-04-15] (COMODO)

R1 cmdhlp; C:\Windows\system32\DRIVERS\cmdhlp.sys [37560 2013-04-15] (COMODO)

S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32000 2013-06-02] ()

R1 inspect; C:\Windows\system32\DRIVERS\inspect.sys [118400 2013-04-15] (COMODO)

R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-11-24] (Dritek System Inc.)

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [x]

S3 X6va014; \??\C:\Windows\SysWOW64\Drivers\X6va014 [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-31 11:42 - 2013-08-31 11:42 - 01587214 _____ (Farbar) C:\Users\Dorian\Desktop\FRST64.exe

2013-08-30 13:53 - 2013-08-30 13:53 - 00000000 ____D C:\Team17

2013-08-26 19:57 - 2013-08-26 19:58 - 00000000 ____D C:\Windows\system32\MRT

2013-08-26 13:53 - 2013-05-24 01:02 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-26 13:53 - 2013-05-24 00:25 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-08-26 13:52 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-08-26 13:52 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-26 13:52 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-08-26 13:52 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-08-26 13:52 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-08-26 13:52 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-08-26 13:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-08-26 13:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-08-26 13:52 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll

2013-08-26 13:52 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-26 13:52 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-26 13:52 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-26 13:52 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll

2013-08-26 13:52 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll

2013-08-26 13:52 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-26 13:52 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-26 13:52 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll

2013-08-26 13:52 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll

2013-08-26 13:52 - 2013-07-09 08:07 - 02233168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-26 13:52 - 2013-07-02 02:44 - 00036288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys

2013-08-26 13:52 - 2013-07-02 00:08 - 00247216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys

2013-08-25 20:37 - 2013-08-30 23:04 - 00003836 _____ C:\Windows\SysWOW64\bufferpool.txt

2013-08-25 14:27 - 2013-08-25 14:32 - 110344048 _____ C:\Users\Dorian\Downloads\avira_free4045_antivirus_de.exe

2013-08-25 13:07 - 2013-08-25 13:08 - 15714204 _____ (diclovit                                                    ) C:\Users\Dorian\Downloads\dmp_1.7.3_setup.exe

2013-08-03 20:18 - 2013-08-03 20:18 - 00003044 _____ C:\Windows\System32\Tasks\{F85BD424-B543-452C-8E8E-4E16EE8FC24A}
 

==================== One Month Modified Files and Folders =======
 

2013-08-31 11:43 - 2013-08-31 11:43 - 00000000 ____D C:\FRST

2013-08-31 11:43 - 2013-04-17 18:01 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-31 11:42 - 2013-08-31 11:42 - 01587214 _____ (Farbar) C:\Users\Dorian\Desktop\FRST64.exe

2013-08-31 11:02 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-31 11:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru

2013-08-30 23:04 - 2013-08-25 20:37 - 00003836 _____ C:\Windows\SysWOW64\bufferpool.txt

2013-08-30 23:04 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\BBI

2013-08-30 22:55 - 2013-03-25 19:27 - 00000000 ____D C:\Program Files (x86)\MicroVolts

2013-08-30 22:34 - 2013-06-01 10:45 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\Skype

2013-08-30 14:41 - 2013-03-26 15:17 - 00000000 ____D C:\Users\Dorian\Documents\TrackMania

2013-08-30 13:53 - 2013-08-30 13:53 - 00000000 ____D C:\Team17

2013-08-30 13:53 - 2012-11-02 05:40 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-08-29 19:39 - 2013-04-01 19:02 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\TS3Client

2013-08-27 15:58 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Windows Defender

2013-08-27 15:58 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-08-26 19:58 - 2013-08-26 19:57 - 00000000 ____D C:\Windows\system32\MRT

2013-08-26 19:57 - 2013-03-26 19:23 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-08-26 13:53 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent

2013-08-26 13:46 - 2013-06-02 15:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-08-26 13:46 - 2013-06-02 15:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-25 14:41 - 2013-03-25 18:07 - 00002030 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2013-08-25 14:32 - 2013-08-25 14:27 - 110344048 _____ C:\Users\Dorian\Downloads\avira_free4045_antivirus_de.exe

2013-08-25 13:08 - 2013-08-25 13:07 - 15714204 _____ (diclovit                                                    ) C:\Users\Dorian\Downloads\dmp_1.7.3_setup.exe

2013-08-21 15:43 - 2013-04-17 18:01 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-08-15 19:56 - 2013-03-25 17:42 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3428012327-743159870-3646233233-1002

2013-08-12 17:21 - 2013-03-25 18:06 - 00000000 ____D C:\Users\Dorian\AppData\Local\CrashDumps

2013-08-11 17:55 - 2012-11-24 12:38 - 00763140 _____ C:\Windows\system32\perfh007.dat

2013-08-11 17:55 - 2012-11-24 12:38 - 00160234 _____ C:\Windows\system32\perfc007.dat

2013-08-11 17:55 - 2012-07-26 09:28 - 01772590 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-03 20:22 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\NDF

2013-08-03 20:18 - 2013-08-03 20:18 - 00003044 _____ C:\Windows\System32\Tasks\{F85BD424-B543-452C-8E8E-4E16EE8FC24A}

2013-08-02 18:52 - 2013-03-26 17:30 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\.minecraft
 

Files to move or delete:

====================

C:\Users\Dorian\Opera_1215_int_Setup (1).exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-21 17:13
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-08-2013 01

Ran by Dorian at 2013-08-31 11:44:20

Running from C:\Users\Dorian\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

   

 clear.fi SDK - Video 2 (x32 Version: 2.1.1925)

 clear.fi SDK- Movie 2 (x32 Version: 2.1.2008)

4shared Desktop (x32)

7-Zip 9.20 (x32)

AbiWord 2.8.6 (x32 Version: 2.8.6)

Acer Backup Manager (x32 Version: 4.0.0.0059)

Acer Device Fast-lane (Version: 1.00.3007)

Acer Instant Update Service (Version: 1.00.3013)

Acer Power Management (Version: 7.00.3006)

Acer Recovery Management (Version: 6.00.3011)

AcerCloud (x32 Version: 2.01.3115)

AcerCloud Docs (x32 Version: 1.00.3201)

Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)

Adobe Reader 6.0.1 (x32 Version: 006.000.001)

Avira Free Antivirus (x32 Version: 13.0.0.3885)

Backup Manager v4 (x32 Version: 4.0.0.0059)

Battle.net (x32)

Blazing Angels Squadrons of WWII (x32 Version: 1.02.0000)

Broadcom Card Reader Driver Installer (Version: 15.4.7.1)

clear.fi Media (x32 Version: 2.01.3108)

clear.fi Photo (x32 Version: 2.01.3108)

Clonk Rage (x32)

Comodo Dragon (x32 Version: 27.0.4.0)

COMODO Firewall (Version: 6.1.13008.2801)

ControlFilters (x32 Version: 1.0.0)

CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819)

Diablo (x32)

Dolby Home Theater v4 (x32 Version: 7.2.8000.13)

eaner (Version: 4.02)

EPSON WF-3520 Series Printer Uninstall

ETDWare PS/2-X64 11.6.9.001_WHQL (Version: 11.6.9.001)

GameSpy Comrade (x32 Version: 1.4.3.154)

HitmanPro 3.7 (Version: 3.7.5.199)

Identity Card (x32 Version: 2.00.3004)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2867)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.0.1207)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149)

Intel® Trusted Connect Service Client (Version: 1.24.388.1)

Java 7 Update 17 (x32 Version: 7.0.170)

Java Auto Updater (x32 Version: 2.1.9.0)

Launch Manager (x32 Version: 7.0.5)

LEGO® Star Wars™ III: The Clone Wars™ (x32 Version: 1.0.0.0)

Live Updater (x32 Version: 2.00.3004)

Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)

Microsoft Office (x32 Version: 14.0.6120.5004)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0)

MicroVolts (x32)

Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)

Mozilla Maintenance Service (x32 Version: 23.0.1)

MyWinLocker (Version: 4.0.14.35)

MyWinLocker 4 (x32 Version: 4.0.14.35)

MyWinLocker Suite (x32 Version: 4.0.14.24)

NTI Media Maker 9 (x32 Version: 9.0.2.9008)

NVIDIA Grafiktreiber 307.17 (Version: 307.17)

NVIDIA Install Application (Version: 2.1002.85.551)

NVIDIA Optimus 1.10.8 (Version: 1.10.8)

NVIDIA PhysX (x32 Version: 9.12.0613)

NVIDIA PhysX-Systemsoftware 9.12.0613 (Version: 9.12.0613)

NVIDIA Systemsteuerung 307.17 (Version: 307.17)

NVIDIA Update 1.10.8 (Version: 1.10.8)

NVIDIA Update Components (Version: 1.10.8)

Office Addin (x32 Version: 2.01.3200)

Optimizer Pro v3.0 (x32 Version: 3.0)

Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.206)

Qualcomm Atheros WiFi Driver Installation (x32 Version: 11.05)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6657)

sEngine (x32 Version: 1.0.1)

Shared C Run-time for x64 (Version: 10.0.0)

Shredder (Version: 2.0.8.9)

Shredder (x32 Version: 2.0.8.9)

Sid Meier's Civilization 4 Complete (x32 Version: 1.74)

Skype™ 6.2 (x32 Version: 6.2.106)

Spotify (x32 Version: 0.8.4.99.ga249b5f1)

Steam (x32 Version: 1.0.0.0)

TeamSpeak 3 Client (x32 Version: 3.0.10.1)

TmUnitedForever Update 2010-03-15 (x32)

Unity Web Player (HKCU Version: )

Visual Studio 2005 Tools for Office Second Edition Runtime (x32)

Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729)

Visual Studio Tools for the Office system 3.0 Runtime (x32)

Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (x32 Version: 1)

World of Tanks - Common Test (x32)

World of Tanks (x32)

Worms World Party (x32)
 

==================== Restore Points  =========================
 

12-08-2013 15:55:04 Geplanter Prüfpunkt

21-08-2013 15:11:10 Geplanter Prüfpunkt

26-08-2013 17:54:52 Windows Update
 

==================== Hosts content: ==========================
 

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {0E52EC20-206D-402D-AE62-58B24385DD48} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUFirmwareInstall

Task: {10D85952-E3F6-47A1-96CF-5E1C2D874EA6} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe [2012-07-26] (Microsoft Corporation)

Task: {13A2AC02-B682-48CC-9155-2E2673580117} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical

Task: {17644F17-DC4C-4AC8-9444-7AAA52EB5CDC} - System32\Tasks\Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler

Task: {19C58524-6F9C-4515-9AC3-B4A4C1163625} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe No File

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => C:\Windows\System32\sysmain.dll [2013-05-04] (Microsoft Corporation)

Task: {1DB7C2F1-876C-4F24-AD17-8428211113F9} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents

Task: {214B24F4-FEB4-4C59-AF1F-70136065199C} - System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance

Task: {23700E5C-0E77-499D-908A-415D5C6252F4} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy

Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => C:\Windows\System32\WSClient.dll [2012-09-20] (Microsoft Corporation)

Task: {27949D9D-ABF9-436E-A568-6B88DBF87C2B} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-07-04] (CyberLink)

Task: {2C6B9EA8-7F5A-4ABA-BF96-8D352D02A743} - System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh

Task: {2E030FA7-3D7C-4E1D-8CFE-56ADB26FD402} - System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks

Task: {3054485A-F517-4E95-9977-4DD827B1E9B3} - System32\Tasks\Microsoft\Windows\WS\Badge Update

Task: {33F733D5-F865-4EDD-8086-6857ED5D3DD1} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup

Task: {3764ACD2-537D-4A2A-B876-701C956B9C2B} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] ()

Task: {378401BA-A703-444A-A79C-3C47AD2DC5B6} - System32\Tasks\Microsoft\Windows\TaskScheduler\Maintenance Configurator

Task: {3AE164E7-30CD-40BC-9422-3EC7A5618965} - System32\Tasks\Microsoft\Windows\WS\WSTask

Task: {3C490ABD-D849-41AF-9AC4-87DD759B0996} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem

Task: {4073C1B3-6E16-4AA8-B7F3-C6A6D35D5071} - System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance

Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - System32\Tasks\Microsoft\Windows\Live\Roaming\SynchronizeWithStorage

Task: {483A8F5C-5D26-44B5-B49E-AF6741D1BBEB} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\Windows\System32\MbaeParserTask.exe [2013-06-01] (Microsoft Corporation)

Task: {4B952129-9AE9-41A3-BE2B-8AD2E06F66B6} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon

Task: {4D02C09C-7EC1-4366-89F4-A63219B60ED6} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-23] ()

Task: {5755E746-D7ED-4C20-A472-66C11834CDE4} - System32\Tasks\Microsoft\Windows\TaskScheduler\Manual Maintenance

Task: {5C4EFB77-EFA6-45DF-A373-D795C0725BFF} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required

Task: {627441F3-8526-4B62-BF9A-1A3EA414E71A} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\Windows\system32\SpaceAgent.exe [2012-07-26] (Microsoft Corporation)

Task: {69AC89AD-0274-4668-8047-BEEAA6D194B4} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.)

Task: {6E9DE125-5583-4031-B572-FEE48F25CFFF} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\Windows\System32\wpcmon.exe [2012-09-20] (Microsoft Corporation)

Task: {6FDDEA7C-6310-428D-AEB2-54FFC72811EF} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319

Task: {725D1200-2B5D-4369-B0DC-3631C371AE58} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)

Task: {74096F94-B654-4DB0-96F5-3C3408B92FE3} - System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update

Task: {74CDED6B-8592-4E7A-8D60-313673DFD1F5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-21] (Adobe Systems Incorporated)

Task: {7C9C9B35-B542-48E9-A25E-88938FCD4BDA} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe [2012-08-15] (Microsoft Corporation)

Task: {7D9A9A1C-499C-40A6-8F8A-5BCC4CC9A87C} - System32\Tasks\Microsoft\Windows\TaskScheduler\Regular Maintenance

Task: {82B33C67-F329-458D-B9FC-BD1FEDEC1E40} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-23] ()

Task: {845CB020-68B5-4C6B-9876-7BEC7B3E27AC} - System32\Tasks\Microsoft\Windows\TaskScheduler\Idle Maintenance

Task: {87354DAA-66DF-4B41-9346-15958D96E1D2} - System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode)

Task: {8D71B8DF-2A46-4C7B-90D9-CCFC5BFDBD95} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)

Task: {921A1D4E-32FB-46D7-B6C0-6F467884074D} - System32\Tasks\Microsoft\Windows\WS\Sync Licenses

Task: {9479EF8E-11D4-41B3-9783-CC65070D592D} - System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime

Task: {94DCF254-64FB-4C4E-8E12-5F4055C10C2A} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64

Task: {989A7C6D-BE82-4C3C-AF96-6116039E336B} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic

Task: {9F2B63B0-1C17-42E5-AB42-A941607F84A8} - System32\Tasks\COMODO\COMODO Welcome {CEB54B45-2B5E-4FF5-9223-6735CD80FE69} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [2013-04-15] (COMODO)

Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => C:\Windows\System32\WSClient.dll [2012-09-20] (Microsoft Corporation)

Task: {A800277E-E202-4492-AD38-3312641CBC04} - System32\Tasks\Microsoft\Windows\Live\Roaming\MaintenanceTask

Task: {AB62FA47-2C99-44B1-A5D0-D4161423BE43} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefresh

Task: {AC6259DE-AC59-459E-849E-6ADFFD1ADE63} - System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask

Task: {ADC49FC3-377E-422F-B07A-70BCACB1A72F} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start => C:\Windows\system32\sc.exe [2012-07-26] (Microsoft Corporation)

Task: {AEB0B5BD-B9E5-458A-898A-E559BD9EB51B} - System32\Tasks\Microsoft\Windows\SettingSync\BackgroundUploadTask

Task: {AF549BD8-337C-4BF7-8681-36A182E30507} - System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan

Task: {B1F4564E-D7D1-42C7-872B-7B44C40C987A} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe No File

Task: {B4ACA1C1-0B05-4B67-AFB7-D89F2782507D} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUSessionConnect

Task: {BC76AEF7-2CF0-4EB6-B65B-A8803E0B5E12} - System32\Tasks\Microsoft\Windows\AppID\SmartScreenSpecific

Task: {C1ACCD1E-4385-4FB2-B5E4-7F2A57A626A2} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan

Task: {C463FD1E-31C7-4C20-AB65-08E514CA152D} - System32\Tasks\Microsoft\Windows\IME\SQM data sender

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => C:\Windows\System32\Windows.Storage.ApplicationData.dll [2012-07-26] (Microsoft Corporation)

Task: {CD1054FF-8005-4904-8B9C-436EAB1E2021} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork

Task: {CD5149D5-8940-4D9F-8122-52E94B90B707} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2012-07-31] (Acer Incorporated)

Task: {D5658A95-2CD9-4FEB-BFEC-74D04707221F} - System32\Tasks\WPD\SqmUpload_S-1-5-21-3428012327-743159870-3646233233-1002 => C:\Windows\System32\portabledeviceapi.dll [2012-07-26] (Microsoft Corporation)

Task: {DBCF6E1B-CE0A-441E-B7A5-219C8BE50C65} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical

Task: {DC38ACCD-5CF4-4109-B7B5-E3E50A04CE26} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-04-15] (COMODO)

Task: {DDADEDBD-2B56-4634-9D9F-F4CED38F85BA} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()

Task: {DECE5921-598D-454B-9A04-B2DE95EFC1B3} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery

Task: {E362B774-061C-4883-A305-3D84DD76F7EF} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUScheduledInstall

Task: {E3BA6B46-84C1-41D8-ACA7-CC753BBE99DF} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2013-04-15] (COMODO)

Task: {E4DFE66F-E089-4CC3-A70F-957223D565F4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Task: {E8DAA09B-DF2A-4951-9134-6FA9587793F9} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\Windows\System32\drvinst.exe [2012-09-20] (Microsoft Corporation)

Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => C:\Windows\System32\Startupscan.dll [2012-07-26] (Microsoft Corporation)

Task: {ED0C1F69-C3A2-41EA-B8C3-3F0D83A1F6C0} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\BthSQM

Task: {F27D265F-64FC-4972-9BF9-8DC396EF1F5B} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated)

Task: {F5B6D118-0F7A-46EA-906B-CA075495B28F} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3428012327-743159870-3646233233-1002

Task: {FF9139C4-4EC4-44E3-8386-F257B4C7FA9D} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3428012327-743159870-3646233233-500

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-11-02 05:16 - 2012-09-20 08:30 - 01743872 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\combase.dll

2012-07-26 01:55 - 2012-07-26 05:07 - 00180224 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\WINMMBASE.dll

2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\SHCORE.DLL

2012-11-02 05:54 - 2012-09-05 11:31 - 02277776 _____ (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDFavorite.dll

2012-11-02 05:54 - 2012-09-05 11:31 - 02303376 _____ (ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDApix.dll

2012-11-02 05:54 - 2012-09-05 11:31 - 02384272 _____ (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCmds.dll

2012-07-26 04:19 - 2012-07-26 05:06 - 00023040 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\pcacli.dll

2012-07-26 01:55 - 2012-07-26 05:07 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\WINMMBASE.dll

2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\SHCORE.dll

2013-04-15 18:38 - 2013-04-15 18:38 - 00111312 _____ (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll

2013-04-15 18:38 - 2013-04-15 18:38 - 02376912 _____ (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdcfg.dll

2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\SHCORE.dll

2013-03-27 17:10 - 2012-10-11 07:46 - 01395712 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Immersive.dll

2012-11-02 05:16 - 2012-09-20 08:33 - 00699392 _____ (Microsoft Corporation) C:\Windows\System32\twinapi.dll

2013-06-20 11:39 - 2013-05-04 08:57 - 00389120 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\Bcp47Langs.dll

2013-06-20 11:39 - 2013-05-04 08:58 - 10116096 _____ (Microsoft Corporation) C:\Windows\System32\twinui.dll

2012-07-26 01:33 - 2012-07-26 05:07 - 00069632 _____ (Microsoft Corporation) C:\Windows\System32\windows.immersiveshell.serviceprovider.dll

2013-03-27 17:10 - 2012-10-11 07:45 - 00093184 _____ (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TipBand.dll

2012-07-26 01:54 - 2012-07-26 05:05 - 00171008 _____ (Microsoft Corporation) C:\Windows\System32\IDStore.dll

2013-06-20 11:40 - 2013-04-09 06:51 - 00456704 _____ (Microsoft Corporation) C:\Windows\System32\wpncore.dll

2012-07-26 04:06 - 2012-07-26 05:07 - 00119296 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\sppc.dll

2012-11-24 03:57 - 2012-10-11 20:41 - 00974184 _____ (NVIDIA Corporation) C:\Windows\SYSTEM32\nvumdshimx.dll

2012-11-24 03:57 - 2012-10-11 20:41 - 00247144 _____ (NVIDIA Corporation) C:\Windows\SYSTEM32\nvinitx.dll

2012-07-25 22:22 - 2012-10-23 20:37 - 12836864 _____ (Intel Corporation) C:\Windows\system32\igd10umd64.dll

2012-07-26 02:05 - 2012-07-26 05:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\dcomp.dll

2012-07-26 01:31 - 2012-07-26 05:08 - 00343552 _____ (Microsoft Corporation) C:\Windows\System32\wlidprov.dll

2012-07-26 01:55 - 2012-07-26 05:07 - 01161216 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\UIAutomationCore.dll

2012-07-26 01:24 - 2012-07-26 05:05 - 00186368 _____ (Microsoft Corporation) C:\Windows\System32\InputSwitch.dll

2012-07-26 02:04 - 2012-07-26 05:07 - 00046592 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\windows.globalization.fontgroups.dll

2012-07-26 01:22 - 2012-07-26 05:06 - 00601600 _____ (Microsoft Corporation) C:\Windows\System32\MrmCoreR.dll

2013-03-26 18:03 - 2013-02-02 10:23 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\Windows.Networking.Connectivity.dll

2012-07-26 03:37 - 2012-07-26 05:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\NcaApi.dll

2012-07-26 01:33 - 2012-07-26 05:06 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\NetworkStatus.dll

2012-07-26 03:06 - 2012-07-26 05:06 - 00454144 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll

2012-07-26 04:33 - 2012-07-26 04:33 - 00629760 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\UIRibbonRes.dll

2012-07-26 01:54 - 2012-07-26 05:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\System32\BluetoothApis.dll

2012-07-26 02:59 - 2012-07-26 05:05 - 00465408 _____ (Microsoft Corporation) C:\Windows\System32\dlnashext.dll

2013-04-13 18:26 - 2013-03-02 04:44 - 00049152 _____ (Microsoft Corporation) C:\Windows\System32\DevDispItemProvider.dll

2013-03-25 18:05 - 2013-07-18 08:01 - 00231480 _____ (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll

2013-08-26 13:52 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\apprepapi.dll

2012-11-02 05:55 - 2012-10-23 20:37 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrDEU.lrc

2012-08-10 19:28 - 2012-08-10 19:28 - 00033408 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\CommApi.dll

2012-08-10 19:28 - 2012-08-10 19:28 - 00035456 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\ipc.dll

2011-06-11 02:15 - 2011-06-11 02:15 - 00608080 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\MSVCP100.dll

2011-06-11 02:15 - 2011-06-11 02:15 - 00829264 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\MSVCR100.dll

2012-08-10 19:28 - 2012-08-10 19:28 - 00098944 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\utils.dll

2012-08-10 19:28 - 2012-08-10 19:28 - 00027264 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\TCPConnection.dll

2012-07-26 03:00 - 2012-07-26 05:05 - 00163328 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\credui.dll

2012-11-24 03:57 - 2012-10-11 20:41 - 02735976 _____ (NVIDIA Corporation) C:\Windows\SYSTEM32\nvapi64.dll

2012-07-26 04:09 - 2012-07-26 05:05 - 00124928 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\CHARTV.dll

2012-08-10 19:28 - 2012-08-10 19:28 - 00202368 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\FolderViewImpl.dll

2012-07-26 02:12 - 2012-07-26 06:55 - 01326784 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\webservices.dll

2011-03-29 22:10 - 2011-03-29 22:10 - 00063344 _____ (Egis Technology Inc.) C:\Program Files (x86)\EgisTec Shredder\x64\ShredderContextMenu.dll

2011-03-29 22:10 - 2011-03-29 22:10 - 00322416 _____ (Egis Technology Inc.) C:\Program Files (x86)\EgisTec Shredder\x64\FrameUtility.dll

2012-11-24 04:09 - 2012-11-24 04:09 - 00179704 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818\ATL90.DLL

2011-03-29 22:10 - 2011-03-29 22:10 - 01067376 _____ (Egis Technology Inc.) C:\Program Files (x86)\EgisTec Shredder\x64\LibFrame.dll

2012-07-12 05:10 - 2012-07-12 05:10 - 00053328 _____ (Egis Technology Inc. ) C:\Program Files (x86)\EgisTec MyWinLocker\x64\MWLIVShellExt.dll

2012-07-12 05:10 - 2012-07-12 05:10 - 00756304 _____ (Egis Technology Inc. ) C:\Program Files (x86)\EgisTec MyWinLocker\x64\MWLUtility.dll

2012-07-26 02:05 - 2012-07-26 05:06 - 00069632 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\NETAPI32.dll

2012-07-12 05:10 - 2012-07-12 05:10 - 00251984 _____ (Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x64\CryptoAPI.dll

2012-06-22 03:12 - 2012-06-22 03:12 - 01407568 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll

2012-08-10 19:28 - 2012-08-10 19:28 - 00288896 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\ShellContextExt.dll

2013-03-25 18:05 - 2013-07-18 08:02 - 02288184 _____ (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\shlext64.dll

2012-08-10 19:28 - 2012-08-10 19:28 - 00107648 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvAppExt.dll

2012-08-10 19:28 - 2012-08-10 19:28 - 01067136 _____ (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\OutLookLib.dll

2011-06-11 02:15 - 2011-06-11 02:15 - 05601616 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\mfc100u.dll

2011-06-11 02:15 - 2011-06-11 02:15 - 00158536 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\ATL100.DLL

2011-06-11 02:15 - 2011-06-11 02:15 - 00064336 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\MFC100DEU.DLL

2013-03-14 18:28 - 2013-03-14 18:28 - 00653824 _____ () C:\PROGRA~2\4SHARE~1\CMenu64.dll

2012-11-24 03:58 - 2012-10-12 09:36 - 00870760 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll

2012-11-02 05:16 - 2012-09-20 08:33 - 01304064 _____ (Microsoft Corporation) C:\Windows\System32\Windows.Media.Streaming.dll

2012-11-02 05:54 - 2012-08-28 22:37 - 00922736 _____ (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDUtl.dll

2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\shcore.dll

2012-11-02 05:55 - 2012-10-23 20:37 - 00028672 _____ (Intel Corporation) C:\Windows\system32\IGFXEXPS.DLL

2012-11-02 05:55 - 2012-10-23 20:37 - 00063488 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.dll

2012-11-24 03:58 - 2012-10-12 09:37 - 04128616 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvUI.dll

2012-11-24 03:58 - 2012-10-11 20:41 - 00778088 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\easyDaemonAPIU64.DLL

2012-07-26 01:58 - 2012-07-26 05:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll

2012-11-24 03:58 - 2012-10-11 20:41 - 03457896 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\NvUpdt.dll

2012-11-24 03:58 - 2012-10-11 20:41 - 00980840 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\NVUPDTR.DLL

2013-04-15 18:38 - 2013-04-15 18:38 - 05033168 _____ (Terra Informatica Software, Inc.) C:\Program Files\COMODO\COMODO Internet Security\cmdhtml.dll

2012-08-22 21:02 - 2012-08-22 21:02 - 00174736 _____ (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\CommonControl.dll

2012-08-22 21:02 - 2012-08-22 21:02 - 00175248 _____ (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\PowerSettingControl.dll

2012-07-26 02:06 - 2012-07-26 05:05 - 00024064 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\DSPARSE.dll

2012-11-02 05:55 - 2012-10-23 20:37 - 00441856 _____ (Intel Corporation) C:\Windows\system32\igfxdev.dll

2012-11-02 05:55 - 2012-10-23 20:37 - 00110592 _____ (Intel Corporation) C:\Windows\System32\hccutils.DLL

2013-03-27 17:10 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\System32\SHCORE.dll

2012-11-02 05:55 - 2012-10-23 20:37 - 09007616 _____ (Intel Corporation) C:\Windows\System32\igfxress.dll

2012-11-02 05:55 - 2012-10-23 20:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-11-24 04:03 - 2010-11-03 12:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll

2012-11-24 04:03 - 2012-06-08 10:18 - 03615888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll

2013-06-20 11:40 - 2013-04-09 07:33 - 00489576 _____ (Microsoft Corporation) C:\Windows\system32\audioeng.dll

2012-11-24 04:09 - 2012-11-24 04:09 - 05086712 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9\mfc90.dll

2012-11-24 04:09 - 2012-11-24 04:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90DEU.DLL

2012-07-12 04:40 - 2012-07-12 04:40 - 00072272 _____ (Egis Technology Inc.) C:\Program Files\EgisTec IPS\KernelController.dll

2012-07-12 04:41 - 2012-07-12 04:41 - 00090704 _____ (Egis Technology Inc.) C:\Program Files\EgisTec IPS\LicenseCenter.dll

2012-07-12 04:41 - 2012-07-12 04:41 - 00070736 _____ (Egis Technology Inc.) C:\Program Files\EgisTec IPS\UpdateModel.dll

2012-07-26 04:32 - 2012-07-26 05:05 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\ktmw32.dll

2012-07-26 04:20 - 2012-07-26 05:07 - 00015360 _____ (Microsoft Corporation) C:\Windows\System32\tschannel.dll
 

==================== Alternate Data Streams (whitelisted) ==========
 

AlternateDataStreams: C:\Users\Dorian\Desktop\Thumbs.db:encryptable

AlternateDataStreams: C:\Users\Dorian\Downloads\Thumbs.db:encryptable
 
 

==================== Faulty Device Manager Devices =============
 

Name: Bluetooth USB Module

Description: Bluetooth USB Module

Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}

Manufacturer: Qualcomm Atheros Communications

Service: BTHUSB

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/05/2013 10:06:59 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (08/01/2013 04:00:59 PM) (Source: Application Error) (User: )

Description: Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen werden:

Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten

Speichertreibern, oder der Datenträger fehlt.

Das Programm LEGO® Clone Wars™ wurde wegen dieses Fehlers geschlossen.
 

Programm: LEGO® Clone Wars™

Datei: 
 

Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.

Benutzeraktion

1. Öffnen Sie die Datei erneut.

Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.

2.

Wenn Sie weiterhin nicht auf die Datei zugreifen können und

        - diese sich im Netzwerk befindet, 

dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann.

        - diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.

3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.

4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht.

5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt. 

Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.
 

Zusätzliche Daten

Fehlerwert: 00000000

Datenträgertyp: 0
 

Error: (08/01/2013 04:00:59 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: LEGOCloneWars.exe, Version: 1.0.0.0, Zeitstempel: 0x00000000

Name des fehlerhaften Moduls: LEGOCloneWars.exe, Version: 1.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc000001d

Fehleroffset: 0x014640fd

ID des fehlerhaften Prozesses: 0xf98

Startzeit der fehlerhaften Anwendung: 0xLEGOCloneWars.exe0

Pfad der fehlerhaften Anwendung: LEGOCloneWars.exe1

Pfad des fehlerhaften Moduls: LEGOCloneWars.exe2

Berichtskennung: LEGOCloneWars.exe3

Vollständiger Name des fehlerhaften Pakets: LEGOCloneWars.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LEGOCloneWars.exe5
 

Error: (07/30/2013 05:13:12 PM) (Source: Application Hang) (User: )

Description: Programm 7zFM.exe, Version 9.20.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1fb4
 

Startzeit: 01ce8d3744f90759
 

Endzeit: 4294967295
 

Anwendungspfad: C:\Program Files (x86)\7-Zip\7zFM.exe
 

Berichts-ID: 8c3e38d7-f92a-11e2-bee5-b888e3ac4950
 

Vollständiger Name des fehlerhaften Pakets: 
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
 

Error: (07/30/2013 05:11:48 PM) (Source: Application Hang) (User: )

Description: Programm 7zFM.exe, Version 9.20.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1cdc
 

Startzeit: 01ce8d370c70b59b
 

Endzeit: 4294967295
 

Anwendungspfad: C:\Program Files (x86)\7-Zip\7zFM.exe
 

Berichts-ID: 59df9f31-f92a-11e2-bee5-b888e3ac4950
 

Vollständiger Name des fehlerhaften Pakets: 
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
 

Error: (07/30/2013 05:10:54 PM) (Source: Application Hang) (User: )

Description: Programm 7zFM.exe, Version 9.20.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1710
 

Startzeit: 01ce8d36e12d741c
 

Endzeit: 4294967295
 

Anwendungspfad: C:\Program Files (x86)\7-Zip\7zFM.exe
 

Berichts-ID: 3a39943d-f92a-11e2-bee5-b888e3ac4950
 

Vollständiger Name des fehlerhaften Pakets: 
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
 

Error: (07/30/2013 04:02:46 PM) (Source: Application Hang) (User: )

Description: Programm javaw.exe, Version 7.0.170.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1a4
 

Startzeit: 01ce8d2c9584195f
 

Endzeit: 101
 

Anwendungspfad: C:\Windows\SysWOW64\javaw.exe
 

Berichts-ID: a753a764-f920-11e2-bee5-b888e3ac4950
 

Vollständiger Name des fehlerhaften Pakets: 
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
 
 

System errors:

=============

Error: (08/31/2013 11:02:11 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎31.‎08.‎2013 um 10:33:36 unerwartet heruntergefahren.
 

Error: (08/31/2013 10:34:16 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFService erreicht.
 

Error: (08/31/2013 10:33:46 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.
 

Error: (08/30/2013 02:02:43 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFService erreicht.
 

Error: (08/30/2013 02:02:13 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.
 

Error: (08/30/2013 01:52:11 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFService erreicht.
 

Error: (08/30/2013 01:51:41 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.
 

Error: (08/27/2013 04:00:03 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎26.‎08.‎2013 um 20:11:51 unerwartet heruntergefahren.
 

Error: (08/26/2013 01:42:05 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.
 

Error: (08/25/2013 08:41:38 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CFMonitor erreicht.
 
 

Microsoft Office Sessions:

=========================

Error: (08/05/2013 10:06:59 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (08/01/2013 04:00:59 PM) (Source: Application Error)(User: )

Description: LEGO® Clone Wars™000000000
 

Error: (08/01/2013 04:00:59 PM) (Source: Application Error)(User: )

Description: LEGOCloneWars.exe1.0.0.000000000LEGOCloneWars.exe1.0.0.000000000c000001d014640fdf9801ce8ebf81cbd357C:\Program Files (x86)\LucasArts\LEGO Clone Wars\LEGOCloneWars.exeC:\Program Files (x86)\LucasArts\LEGO Clone Wars\LEGOCloneWars.execa935ef1-fab2-11e2-bee9-b888e3ac4950
 

Error: (07/30/2013 05:13:12 PM) (Source: Application Hang)(User: )

Description: 7zFM.exe9.20.0.01fb401ce8d3744f907594294967295C:\Program Files (x86)\7-Zip\7zFM.exe8c3e38d7-f92a-11e2-bee5-b888e3ac4950
 

Error: (07/30/2013 05:11:48 PM) (Source: Application Hang)(User: )

Description: 7zFM.exe9.20.0.01cdc01ce8d370c70b59b4294967295C:\Program Files (x86)\7-Zip\7zFM.exe59df9f31-f92a-11e2-bee5-b888e3ac4950
 

Error: (07/30/2013 05:10:54 PM) (Source: Application Hang)(User: )

Description: 7zFM.exe9.20.0.0171001ce8d36e12d741c4294967295C:\Program Files (x86)\7-Zip\7zFM.exe3a39943d-f92a-11e2-bee5-b888e3ac4950
 

Error: (07/30/2013 04:02:46 PM) (Source: Application Hang)(User: )

Description: javaw.exe7.0.170.21a401ce8d2c9584195f101C:\Windows\SysWOW64\javaw.exea753a764-f920-11e2-bee5-b888e3ac4950
 
 

CodeIntegrity Errors:

===================================

  Date: 2013-08-31 11:43:15.763

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-31 11:05:23.097

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-31 10:45:48.994

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-31 10:36:21.000

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-30 19:30:57.808

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-30 14:04:47.665

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-30 14:04:28.155

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-30 13:54:18.869

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-30 13:52:50.846

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2013-08-29 17:34:07.576

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 22%

Total physical RAM: 8007.27 MB

Available physical RAM: 6208.01 MB

Total Pagefile: 9223.27 MB

Available Pagefile: 7254.39 MB

Total Virtual: 8192 MB

Available Virtual: 8191.77 MB
 

==================== Drives ================================
 

Drive c: (Acer) (Fixed) (Total:679.19 GB) (Free:568.06 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 699 GB) (Disk ID: 7973EA10)
 

Partition: GPT Partition Type

==================== End Of Log ============================

MfG
AlphA

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ES ploppt eine Meldung auf. Ich hab keine Windows 8 Kopie hier da er seine CDs nicht mitgebracht hat. Wäre das notwendig? Muss die registry wiederhergestellt werden?

ERU for Windoes NT

Unable to create file:
C:\Windows\erdnt\Hiv-bsckup\ERDNT.INF

Registry backup will continue, but not restore information for the ERDNT programm will be saved. This means that later restoration of the registry can only be done manually, by using another OS copy back the files.

Hm warum darf ich meinen eigenen Post erst nach 60min editieren? oO und warum hängt er einen weiteren Post einfach dran? Komisches System..

Ich hab nach der Meldung weiter geklickt:sz:. Im weiteren Verlauf sind immer wieder Fehlermeldungen aufgetaucht...

Code:

ComboFix 13-08-30.02 - Dorian 31.08.2013  16:27:30.1.8 - x64

ausgeführt von:: c:\users\Dorian\Desktop\ComboFix.exe

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\install.exe

c:\users\Public\sdelevURL.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-07-28 bis 2013-08-31  ))))))))))))))))))))))))))))))

.

.

2013-08-31 14:36 . 2013-08-31 14:36        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-08-31 14:36 . 2013-08-31 14:36        --------        d-----w-        c:\users\Dorian\AppData\Local\temp

2013-08-31 14:36 . 2013-08-31 14:36        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-08-31 12:53 . 2001-08-29 05:36        434176        ----a-w-        c:\windows\SysWow64\divxdec.ax

2013-08-31 12:49 . 2013-08-31 12:49        --------        d-----w-        c:\program files (x86)\Stormregion Ltd

2013-08-31 09:43 . 2013-08-31 09:43        --------        d-----w-        C:\FRST

2013-08-30 11:53 . 2013-08-30 11:53        --------        d-----w-        C:\Team17

2013-08-30 11:53 . 2001-04-11 16:25        77824        ----a-w-        c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll

2013-08-30 11:53 . 2001-04-11 16:25        225280        ----a-w-        c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll

2013-08-30 11:53 . 2001-04-11 16:21        176128        ----a-w-        c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll

2013-08-30 11:53 . 2001-04-11 16:20        32768        ----a-w-        c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll

2013-08-26 17:57 . 2013-08-26 17:58        --------        d-----w-        c:\windows\system32\MRT

2013-08-26 11:53 . 2013-05-23 23:02        1314816        ----a-w-        c:\windows\system32\rpcrt4.dll

2013-08-26 11:53 . 2013-05-23 22:25        694272        ----a-w-        c:\windows\SysWow64\rpcrt4.dll

2013-08-20 15:39 . 2013-08-20 15:39        240304        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10214.bin

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-08-26 17:57 . 2013-03-26 17:23        78161360        ----a-w-        c:\windows\system32\MRT.exe

2013-07-18 06:02 . 2013-05-07 13:28        83672        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-06-27 22:04 . 2013-06-21 08:02        78200        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-27 22:04 . 2013-06-21 08:02        693112        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-06-16 22:41 . 2013-07-29 10:37        997632        ----a-w-        c:\windows\system32\drivers\ndis.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE" [2012-09-27 283232]

"Spotify Web Helper"="c:\program files (x86)\Spotify\Data\SpotifyWebHelper.exe" [2012-11-24 1193176]

"Comrade.exe"="c:\program files (x86)\GameSpy\Comrade\Comrade.exe" [2007-05-27 36864]

"EPLTarget\P0000000000000001"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE" [2012-09-27 283232]

"Optimizer Pro"="c:\program files (x86)\Optimizer Pro\OptProLauncher.exe" [2012-10-30 81952]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2013-07-09 1672616]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dolby Home Theater v4"="c:\dolby pcee4\pcee4.exe" [2012-04-23 508256]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-07-18 345144]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"ControlFilters"="c:\program files (x86)\ControlFilters\ControlFilters.exe" [2013-04-11 403256]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"IsMyWinLockerReboot"="msiexec.exe" [2012-07-26 62976]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\

Acer Backup Manager Tray.lnk - c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe -h -k [2012-8-23 533568]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableCursorSuppression"= 1 (0x1)

"ConsentPromptBehaviorUser"= 3 (0x3)

"DisableCAD"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"ForceActiveDesktopOn"= 0 (0x0)

"NoActiveDesktopChanges"= 1 (0x1)

"NoActiveDesktop"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\windows\syswow64\nvinit.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0bootdelete

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

@=""

.

R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]

R2 DragonUpdater;COMODO Dragon Update Service;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]

R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]

R3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]

R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\System32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]

R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]

R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\System32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x]

R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]

R3 BthLEEnum;Treiber für energiearme Bluetooth-Geräte;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]

R3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [x]

R3 DeviceFastLaneService;Device Fast-lane Service;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [x]

R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]

R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys;c:\windows\SYSNATIVE\drivers\hitmanpro37.sys [x]

R3 WSDScan;WSD-Scanunterstützung;c:\windows\System32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]

R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]

R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]

S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys;c:\windows\SYSNATIVE\DRIVERS\cmderd.sys [x]

S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys;c:\windows\SYSNATIVE\DRIVERS\cmdguard.sys [x]

S1 cmdhlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys;c:\windows\SYSNATIVE\DRIVERS\cmdhlp.sys [x]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]

S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]

S2 BrcmCardReader;Broadcom Card Reader Service;c:\program files\Broadcom\MemoryCard\BrcmCardReader.exe;c:\program files\Broadcom\MemoryCard\BrcmCardReader.exe [x]

S2 CCDMonitorService;CCDMonitorService;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [x]

S2 CFMonitor.exe;CFMonitor;c:\program files (x86)\ControlFilters\CFMonitor.exe;c:\program files (x86)\ControlFilters\CFMonitor.exe [x]

S2 CFService.exe;CFService;c:\program files (x86)\ControlFilters\CFService.exe;c:\program files (x86)\ControlFilters\CFService.exe [x]

S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]

S2 ETDService;Elan Service;c:\program files\Elantech\ETDService.exe;c:\program files\Elantech\ETDService.exe [x]

S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]

S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]

S2 RfButtonDriverService;Dritek RF Button Command Service;c:\windows\RfBtnSvc64.exe;c:\windows\RfBtnSvc64.exe [x]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S2 ZAtheros Wlan Agent;ZAtheros Wlan Agent;c:\program files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe;c:\program files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [x]

S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\System32\drivers\b57xdbd.sys;c:\windows\SYSNATIVE\drivers\b57xdbd.sys [x]

S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\System32\drivers\b57xdmp.sys;c:\windows\SYSNATIVE\drivers\b57xdmp.sys [x]

S3 bScsiMSa;bScsiMSa;c:\windows\System32\drivers\bScsiMSa.sys;c:\windows\SYSNATIVE\drivers\bScsiMSa.sys [x]

S3 bScsiSDa;bScsiSDa;c:\windows\System32\drivers\bScsiSDa.sys;c:\windows\SYSNATIVE\drivers\bScsiSDa.sys [x]

S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\System32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]

S3 ePowerSvc;ePower Service;c:\program files\Acer\Acer Power Management\ePowerSvc.exe;c:\program files\Acer\Acer Power Management\ePowerSvc.exe [x]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]

S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 k57nd60a;Broadcom NetLink (TM)-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]

S3 Ps2Kb2Hid;PS/2 Keyboard to HID Driver;c:\windows\System32\drivers\aPs2Kb2Hid.sys;c:\windows\SYSNATIVE\drivers\aPs2Kb2Hid.sys [x]

S3 X6va014;X6va014;c:\windows\SysWOW64\Drivers\X6va014;c:\windows\SysWOW64\Drivers\X6va014 [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-08-31 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-17 13:43]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-10-23 171040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-10-23 399392]

"Persistence"="c:\windows\system32\igfxpers.exe" [2012-10-23 441888]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]

"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-06-07 1212048]

"BtPreLoad"="c:\program files (x86)\Bluetooth Suite\BtPreLoad.exe" [2012-08-10 64640]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x1

"AppInit_DLLs"=c:\windows\system32\nvinitx.dll

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uSearch Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991

uStart Page = hxxp://search.b1.org/?bsrc=hmior&chid=c167991

uDefault_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

mDefault_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

mStart Page = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:8877;https=127.0.0.1:8877

IE: &Download All using 4shared Desktop - c:\program files (x86)\4shared Desktop\Desktop.32/D_ALL_LINK

IE: &Download using 4shared Desktop - c:\program files (x86)\4shared Desktop\Desktop.32/D_ONE_LINK

LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll

FF - ProfilePath - c:\users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: network.proxy.type - 0

.

.

------- Dateityp-Verknüpfung -------

.

regedit=regedit.exe "%1"

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-LManager - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

Toolbar-Locked - (no file)

.

.

.

Zeit der Fertigstellung: 2013-08-31  16:41:34

ComboFix-quarantined-files.txt  2013-08-31 14:41

.

Vor Suchlauf: 11 Verzeichnis(se), 607.311.933.440 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 607.380.148.224 Bytes frei

.

- - End Of File - - 4BB67947566DE8629FE0CF92C0995FC1

komisch.

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.09.01.02
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16660

Dorian :: ZOCKERPC [Administrator]
 

Schutz: Aktiviert
 

01.09.2013 10:50:39

mbam-log-2013-09-01 (10-50-39).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: Dateisystem | Heuristiks/Extra | P2P

Durchsuchte Objekte: 23013

Laufzeit: 26 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 2

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Optimizer Pro (PUP.Optional.OptimizePro.A) -> Daten: C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe (PUP.Optional.OptimizePro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

# AdwCleaner v3.001 - Report created 01/09/2013 at 11:09:31

# Updated 24/08/2013 by Xplode

# Operating System : Windows 8  (64 bits)

# Username : Dorian - ZOCKERPC

# Running from : C:\Users\Dorian\Desktop\adwcleaner.exe

# Option : Clean
 

***** [ Services ] *****
 
 

***** [ Files / Folders ] *****
 

Folder Deleted : C:\ProgramData\apn

Folder Deleted : C:\ProgramData\eSafe

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro

Folder Deleted : C:\Program Files (x86)\optimizer pro

Folder Deleted : C:\Users\Dorian\AppData\Local\B1E

Folder Deleted : C:\Users\Dorian\AppData\Roaming\B1Toolbar

Folder Deleted : C:\Users\Dorian\AppData\Roaming\eIntaller

Folder Deleted : C:\Users\Dorian\AppData\Roaming\optimizer pro

Folder Deleted : C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\jetpack

File Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
 

***** [ Shortcuts ] *****
 

Shortcut Disinfected : C:\Users\Dorian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Shortcut Disinfected : C:\Users\Dorian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
 

***** [ Registry ] *****
 

Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS

Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc

Key Deleted : HKCU\Software\5d6888bb56aee44

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Deleted : HKCU\Software\APN PIP

Key Deleted : HKCU\Software\APN

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\Iminent

Key Deleted : HKCU\Software\Optimizer Pro

Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar

Key Deleted : HKCU\Software\AppDataLow\Software\HappyLyrics

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKLM\Software\APN

Key Deleted : HKLM\Software\AskToolbar

Key Deleted : HKLM\Software\Desksvc

Key Deleted : HKLM\Software\Iminent

Key Deleted : HKLM\Software\portaldositesSoftware

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
 

***** [ Browsers ] *****
 

-\\ Internet Explorer v10.0.9200.16660
 

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
 

-\\ Mozilla Firefox v23.0.1 (de)
 

[ File : C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [10623 octets] - [01/09/2013 11:08:52]

AdwCleaner[S0].txt - [9414 octets] - [01/09/2013 11:09:31]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9474 octets] ##########

JRT liegt auf dem Desktop, starte als Admin und bekomme folgende Fehlermeldung:

7-ZIP SFX archive: error

Error during execution ""C:\Users\Dorian\AppData\Local\Temp\jrt\get.bat"".

MfG
AlphA

Dann fehlt nur noch der FRST log, bitte:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01

Ran by Dorian (administrator) on ZOCKERPC on 01-09-2013 15:03:58

Running from C:\Users\Dorian\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe

(Microsoft Corporation) C:\Windows\system32\dashost.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe

() C:\Program Files (x86)\ControlFilters\CFMonitor.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe

() C:\Program Files (x86)\ControlFilters\CFService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PMMUpdate.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)

HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()

HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-09-27] (SEIKO EPSON CORPORATION)

HKCU\...\Run: [Spotify Web Helper] - C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-11-24] ()

HKCU\...\Run: [Comrade.exe] - C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe [36864 2007-05-27] (IGN Entertainment Inc.)

HKCU\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-09-27] (SEIKO EPSON CORPORATION)

HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1672616 2013-07-09] (Valve Corporation)

HKLM-x32\...\Run: [LManager] -  [x]

HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [] -  [x]

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-18] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [ControlFilters] - C:\Program Files (x86)\ControlFilters\ControlFilters.exe [403256 2013-04-11] ()

HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)

AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk

ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)

BootExecute: autocheck autochk * bootdelete
 

==================== Internet (Whitelisted) ====================
 

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:8877;https=127.0.0.1:8877

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.portaldosites.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=TOSHIBAXMQ01ABD075_92JEP2V7TXX92JEP2V7T&ts=1370076237

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - {0BD0A52C-9380-4182-ADE4-0BA4CC4F198E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=811df156-cc18-4579-9a5b-9c932fd499a2&apn_sauid=40AA1AFF-8D25-4554-B408-077202E0064E

SearchScopes: HKCU - {53A71375-BA0C-4DAA-8530-8AE9A1AA9C72} URL = 

BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)

BHO-x32: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default

FF Homepage: about:home

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll No File

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Dorian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: No Name - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\4sharedCopyLinks.xpi

FF Extension: firefox - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\firefox@ghostery.com.xpi

FF Extension: No Name - C:\Users\Dorian\AppData\Roaming\Mozilla\Firefox\Profiles\45ycbchs.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-18] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-18] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [811064 2013-07-18] (Avira Operations GmbH & Co. KG)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)

R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

R2 CFMonitor.exe; C:\Program Files (x86)\ControlFilters\CFMonitor.exe [27960 2013-04-11] ()

R2 CFService.exe; C:\Program Files (x86)\ControlFilters\CFService.exe [31032 2013-04-11] ()

R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5784472 2013-04-15] (COMODO)

R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [158928 2013-04-15] (COMODO)

S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2094216 2013-05-29] ()

R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

R2 ETDService; C:\Program Files\Elantech\ETDService.exe [85904 2012-09-05] (ELAN Microelectronics Corp.)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-11-24] (Dritek System INC.)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-27] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130016 2013-03-27] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [83672 2013-07-18] (Avira Operations GmbH & Co. KG)

S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)

S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)

S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-04-15] (COMODO)

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [712216 2013-04-15] (COMODO)

R1 cmdhlp; C:\Windows\system32\DRIVERS\cmdhlp.sys [37560 2013-04-15] (COMODO)

S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32000 2013-06-02] ()

R1 inspect; C:\Windows\system32\DRIVERS\inspect.sys [118400 2013-04-15] (COMODO)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-11-24] (Dritek System Inc.)

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [x]

S3 X6va014; \??\C:\Windows\SysWOW64\Drivers\X6va014 [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-09-01 11:30 - 2013-09-01 11:30 - 00866817 _____ C:\Users\Dorian\Downloads\avira_fusebundlegen-win32-en.zip

2013-09-01 11:08 - 2013-09-01 11:09 - 00000000 ____D C:\AdwCleaner

2013-09-01 10:58 - 2013-09-01 10:58 - 00000354 _____ C:\Windows\PFRO.log

2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\Malwarebytes

2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-01 10:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-09-01 10:46 - 2013-09-01 10:46 - 01027511 _____ (Thisisu) C:\Users\Dorian\Desktop\JRT.exe

2013-09-01 10:45 - 2013-09-01 10:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Dorian\Desktop\mbam-setup-1.75.0.1300.exe

2013-09-01 10:45 - 2013-09-01 10:45 - 00994642 _____ C:\Users\Dorian\Desktop\adwcleaner.exe

2013-08-31 22:16 - 2013-08-31 22:17 - 00000000 ____D C:\Users\Dorian\Desktop\QuakeIII

2013-08-31 22:08 - 2013-08-31 22:08 - 00000797 _____ C:\Windows\setupact.log

2013-08-31 22:08 - 2013-08-31 22:08 - 00000000 _____ C:\Windows\setuperr.log

2013-08-31 16:48 - 2013-08-31 16:49 - 00000000 ____D C:\Users\Dorian\Downloads\multimaps

2013-08-31 16:41 - 2013-08-31 16:41 - 00015618 _____ C:\ComboFix.txt

2013-08-31 16:25 - 2013-08-31 16:42 - 00000000 ____D C:\ComboFix

2013-08-31 16:03 - 2013-08-31 16:05 - 25897692 _____ C:\Users\Dorian\Downloads\swine_1.zip

2013-08-31 15:31 - 2013-08-31 16:42 - 00000000 ____D C:\Qoobox

2013-08-31 15:30 - 2013-08-31 16:37 - 00000000 ____D C:\Windows\erdnt

2013-08-31 15:25 - 2013-08-31 15:25 - 05117322 ____R (Swearware) C:\Users\Dorian\Desktop\ComboFix.exe

2013-08-31 14:55 - 2013-09-01 15:04 - 00512471 _____ C:\Windows\WindowsUpdate.log

2013-08-31 14:53 - 2001-08-29 07:36 - 00434176 _____ (DivXNetworks, Inc.) C:\Windows\SysWOW64\divxdec.ax

2013-08-31 14:49 - 2013-08-31 14:49 - 00000000 ____D C:\Program Files (x86)\Stormregion Ltd

2013-08-31 11:44 - 2013-08-31 11:47 - 00040292 _____ C:\Users\Dorian\Desktop\Addition.txt

2013-08-31 11:43 - 2013-08-31 11:43 - 00000000 ____D C:\FRST

2013-08-31 11:42 - 2013-08-31 11:42 - 01587214 _____ (Farbar) C:\Users\Dorian\Desktop\FRST64.exe

2013-08-30 13:53 - 2013-08-30 13:53 - 00000000 ____D C:\Team17

2013-08-26 19:57 - 2013-08-26 19:58 - 00000000 ____D C:\Windows\system32\MRT

2013-08-26 13:53 - 2013-05-24 01:02 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-08-26 13:53 - 2013-05-24 00:25 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll

2013-08-26 13:52 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-08-26 13:52 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-08-26 13:52 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-08-26 13:52 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-08-26 13:52 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-08-26 13:52 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-08-26 13:52 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-08-26 13:52 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-08-26 13:52 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-08-26 13:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-08-26 13:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-08-26 13:52 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll

2013-08-26 13:52 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-08-26 13:52 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-08-26 13:52 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-08-26 13:52 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll

2013-08-26 13:52 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll

2013-08-26 13:52 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-26 13:52 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-26 13:52 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll

2013-08-26 13:52 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll

2013-08-26 13:52 - 2013-07-09 08:07 - 02233168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-08-26 13:52 - 2013-07-02 02:44 - 00036288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys

2013-08-26 13:52 - 2013-07-02 00:08 - 00247216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys

2013-08-25 20:37 - 2013-09-01 11:25 - 00006023 _____ C:\Windows\SysWOW64\bufferpool.txt

2013-08-25 14:27 - 2013-08-25 14:32 - 110344048 _____ C:\Users\Dorian\Downloads\avira_free4045_antivirus_de.exe

2013-08-25 13:07 - 2013-08-25 13:08 - 15714204 _____ (diclovit                                                    ) C:\Users\Dorian\Downloads\dmp_1.7.3_setup.exe

2013-08-03 20:18 - 2013-08-03 20:18 - 00003044 _____ C:\Windows\System32\Tasks\{F85BD424-B543-452C-8E8E-4E16EE8FC24A}
 

==================== One Month Modified Files and Folders =======
 

2013-09-01 15:04 - 2013-08-31 14:55 - 00512471 _____ C:\Windows\WindowsUpdate.log

2013-09-01 15:02 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru

2013-09-01 14:43 - 2013-04-17 18:01 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-09-01 11:55 - 2013-06-02 15:06 - 00325710 _____ C:\Windows\system32\Drivers\fvstore.dat

2013-09-01 11:30 - 2013-09-01 11:30 - 00866817 _____ C:\Users\Dorian\Downloads\avira_fusebundlegen-win32-en.zip

2013-09-01 11:25 - 2013-08-25 20:37 - 00006023 _____ C:\Windows\SysWOW64\bufferpool.txt

2013-09-01 11:25 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-09-01 11:21 - 2013-03-25 17:42 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3428012327-743159870-3646233233-1002

2013-09-01 11:09 - 2013-09-01 11:08 - 00000000 ____D C:\AdwCleaner

2013-09-01 11:09 - 2013-03-25 17:35 - 00001001 _____ C:\Users\Dorian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-09-01 10:58 - 2013-09-01 10:58 - 00000354 _____ C:\Windows\PFRO.log

2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\Malwarebytes

2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-09-01 10:47 - 2013-09-01 10:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-01 10:46 - 2013-09-01 10:46 - 01027511 _____ (Thisisu) C:\Users\Dorian\Desktop\JRT.exe

2013-09-01 10:45 - 2013-09-01 10:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Dorian\Desktop\mbam-setup-1.75.0.1300.exe

2013-09-01 10:45 - 2013-09-01 10:45 - 00994642 _____ C:\Users\Dorian\Desktop\adwcleaner.exe

2013-08-31 22:17 - 2013-08-31 22:16 - 00000000 ____D C:\Users\Dorian\Desktop\QuakeIII

2013-08-31 22:08 - 2013-08-31 22:08 - 00000797 _____ C:\Windows\setupact.log

2013-08-31 22:08 - 2013-08-31 22:08 - 00000000 _____ C:\Windows\setuperr.log

2013-08-31 21:17 - 2013-03-26 15:17 - 00000000 ____D C:\Users\Dorian\Documents\TrackMania

2013-08-31 19:08 - 2013-03-25 18:06 - 00000000 ____D C:\Users\Dorian\AppData\Local\CrashDumps

2013-08-31 19:05 - 2013-03-25 19:27 - 00000000 ____D C:\Program Files (x86)\MicroVolts

2013-08-31 19:03 - 2013-03-26 17:30 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\.minecraft

2013-08-31 17:38 - 2012-11-24 12:38 - 00763140 _____ C:\Windows\system32\perfh007.dat

2013-08-31 17:38 - 2012-11-24 12:38 - 00160234 _____ C:\Windows\system32\perfc007.dat

2013-08-31 17:38 - 2012-07-26 09:28 - 01772590 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-31 17:04 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\NDF

2013-08-31 16:49 - 2013-08-31 16:48 - 00000000 ____D C:\Users\Dorian\Downloads\multimaps

2013-08-31 16:42 - 2013-08-31 16:25 - 00000000 ____D C:\ComboFix

2013-08-31 16:42 - 2013-08-31 15:31 - 00000000 ____D C:\Qoobox

2013-08-31 16:42 - 2013-04-16 15:16 - 00000000 ____D C:\Users\Dorian\Desktop\Meine Dateien

2013-08-31 16:41 - 2013-08-31 16:41 - 00015618 _____ C:\ComboFix.txt

2013-08-31 16:37 - 2013-08-31 15:30 - 00000000 ____D C:\Windows\erdnt

2013-08-31 16:05 - 2013-08-31 16:03 - 25897692 _____ C:\Users\Dorian\Downloads\swine_1.zip

2013-08-31 15:25 - 2013-08-31 15:25 - 05117322 ____R (Swearware) C:\Users\Dorian\Desktop\ComboFix.exe

2013-08-31 15:03 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent

2013-08-31 14:49 - 2013-08-31 14:49 - 00000000 ____D C:\Program Files (x86)\Stormregion Ltd

2013-08-31 14:49 - 2012-11-02 05:40 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-08-31 11:47 - 2013-08-31 11:44 - 00040292 _____ C:\Users\Dorian\Desktop\Addition.txt

2013-08-31 11:43 - 2013-08-31 11:43 - 00000000 ____D C:\FRST

2013-08-31 11:42 - 2013-08-31 11:42 - 01587214 _____ (Farbar) C:\Users\Dorian\Desktop\FRST64.exe

2013-08-30 23:04 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\BBI

2013-08-30 22:34 - 2013-06-01 10:45 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\Skype

2013-08-30 13:53 - 2013-08-30 13:53 - 00000000 ____D C:\Team17

2013-08-29 19:39 - 2013-04-01 19:02 - 00000000 ____D C:\Users\Dorian\AppData\Roaming\TS3Client

2013-08-27 15:58 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Windows Defender

2013-08-27 15:58 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-08-26 19:58 - 2013-08-26 19:57 - 00000000 ____D C:\Windows\system32\MRT

2013-08-26 19:57 - 2013-03-26 19:23 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-08-26 13:46 - 2013-06-02 15:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-08-26 13:46 - 2013-06-02 15:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-25 14:41 - 2013-03-25 18:07 - 00002030 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2013-08-25 14:32 - 2013-08-25 14:27 - 110344048 _____ C:\Users\Dorian\Downloads\avira_free4045_antivirus_de.exe

2013-08-25 13:08 - 2013-08-25 13:07 - 15714204 _____ (diclovit                                                    ) C:\Users\Dorian\Downloads\dmp_1.7.3_setup.exe

2013-08-21 15:43 - 2013-04-17 18:01 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-08-03 20:18 - 2013-08-03 20:18 - 00003044 _____ C:\Windows\System32\Tasks\{F85BD424-B543-452C-8E8E-4E16EE8FC24A}
 

Files to move or delete:

====================

C:\Users\Dorian\Opera_1215_int_Setup (1).exe

C:\Users\Dorian\AppData\Local\Temp\i4jdel0.exe

C:\Users\Dorian\AppData\Local\Temp\Quarantine.exe

C:\Users\Dorian\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-01 10:40
 

==================== End Of Log ============================

--- --- ---

MfG
AlphA

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)