Trojaner-Board - Einzelne Wörter sind plötzlich blau und doppelt unterstrichen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Einzelne Wörter sind plötzlich blau und doppelt unterstrichen - Fenster öffnen sich (https://www.trojaner-board.de/145583-einzelne-woerter-ploetzlich-blau-doppelt-unterstrichen-fenster-oeffnen.html)

Einzelne Wörter sind plötzlich blau und doppelt unterstrichen - Fenster öffnen sich

Moin Leute, ich habe seit ein paar Tagen ein Problem mit meinem Laptop.
Habe Windows 8 drauf + Gratis-Avira mit täglichem Update.
Auf fast allen Seiten werden einzelne Wörter plötzlich blau und sind doppelt unterstrichen.
Wenn man dann mit der Maus zu dem Wort geht, öffnen sich Fenster, dass man irgendwas gewonnen hat usw...
Manchmal nevt das so stark, dass ich gar keine Links mehr klicken kann, ohne dass solche Fenster kommen.
Info, ich bin absoluter PC Laie.
Wäre super, wenn mir jemand helfen könnte, ich bin allerdings erst immer ab Nachmittag am PC, also nicht ungeduldig werden, wenn ich mal verzögert antworte.

Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Also Avira ist anscheinend noch nicht fündig geworden. Ich werden mir gleich mal das passende Programm für 64 bit runterladen

[/CODE]
FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-12-2013 02

Ran by Eike Koopamann (administrator) on EIKE on 03-12-2013 23:28:54

Running from C:\Users\Eike Koopamann\Downloads

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(cake bake) C:\Program Files (x86)\Tepfel\WebCakeDesktop.Updater.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4396.1016_x64__8wekyb3d8bbwe\LiveComm.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(Bake Cake) C:\Users\Eike Koopamann\AppData\Roaming\Tepfel\WebCakeDesktop.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor)

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] ()

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223242 2012-10-22] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKCU\...\Run: [WebCake Desktop] - C:\Users\Eike Koopamann\AppData\Roaming\Tepfel\WebCakeDesktop.exe [52504 2013-08-10] (Bake Cake)

HKLM-x32\...\Run: [Intel AppUp(R) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
 

==================== Internet (Whitelisted) ====================
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=sc&from=newgdp&uid=TOSHIBAXMQ01ABF032_33FES27ISXX33FES27IS&ts=1380221349

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=TOSHIBAXMQ01ABF032_33FES27ISXX33FES27IS&ts=1380221349&type=default&q={searchTerms}

SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=TOSHIBAXMQ01ABF032_33FES27ISXX33FES27IS&ts=1380221349&type=default&q={searchTerms}

SearchScopes: HKLM - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=TOSHIBAXMQ01ABF032_33FES27ISXX33FES27IS&ts=1380221349&type=default&q={searchTerms}

SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=TOSHIBAXMQ01ABF032_33FES27ISXX33FES27IS&ts=1380221349&type=default&q={searchTerms}

SearchScopes: HKLM-x32 - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=D8F424FD521584F3&affID=120523&tt=070813_wc1&tsp=4971

SearchScopes: HKCU - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = 

BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)

BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default

FF user.js: detected! => C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\user.js

FF SearchEngineOrder.1: Google

FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: plugins - C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\Extensions\plugins@getwebcake.com.xpi

FF Extension: Adblock Plus - C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-06-29] (IvoSoft)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)

R2 WebCakeUpdater; C:\Program Files (x86)\Tepfel\WebCakeDesktop.Updater.exe [51992 2013-08-10] (cake bake)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [83160 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

S3 RTL8192Ce; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                           )

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                           )

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31032 2012-11-29] (Synaptics Incorporated)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [198656 2012-07-26] (Microsoft Corporation)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-12-03 23:28 - 2013-12-03 23:29 - 00013794 _____ C:\Users\Eike Koopamann\Downloads\FRST.txt

2013-12-03 23:28 - 2013-12-03 23:28 - 00000000 ____D C:\FRST

2013-12-03 23:27 - 2013-12-03 23:27 - 01959614 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64.exe

2013-12-03 22:38 - 2013-12-03 22:38 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 22:38 - 00001942 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee

2013-12-03 18:27 - 2013-12-03 18:28 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Local\Adobe

2013-11-27 15:25 - 2013-11-27 15:30 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\28.11.2013

2013-11-25 21:20 - 2013-10-02 00:37 - 02035712 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-25 21:20 - 2013-10-02 00:26 - 02304512 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-25 21:20 - 2013-08-23 08:22 - 02062848 _____ (Microsoft Corporation) C:\windows\system32\d3d11.dll

2013-11-25 21:20 - 2013-08-23 02:44 - 01711616 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d11.dll

2013-11-25 19:49 - 2013-11-25 19:49 - 00329024 _____ C:\windows\system32\FNTCACHE.DAT

2013-11-19 21:21 - 2013-11-05 23:58 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-19 21:21 - 2013-11-05 23:58 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-11-16 09:58 - 2013-11-16 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-16 09:38 - 2013-09-14 02:15 - 00059416 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2013-11-16 09:38 - 2013-09-13 23:36 - 00628736 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00084992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2013-11-16 09:38 - 2013-09-13 23:34 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2013-11-16 09:38 - 2013-09-13 23:33 - 03279360 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 01622016 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00773120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00252928 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00142848 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2013-11-16 09:38 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\windows\system32\Drivers\crashdmp.sys

2013-11-16 09:38 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\windows\system32\UIAutomationCore.dll

2013-11-16 09:38 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\windows\SysWOW64\UIAutomationCore.dll

2013-11-16 09:38 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fvevol.sys

2013-11-16 09:38 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tpm.sys

2013-11-16 09:38 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2013-11-16 09:38 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2013-11-16 09:38 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll

2013-11-16 09:38 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll

2013-11-16 09:38 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\WSDApi.dll

2013-11-16 09:38 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSDApi.dll

2013-11-16 09:37 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-16 09:37 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-16 09:37 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-16 09:37 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-11-16 09:36 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-11-16 09:36 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-11-16 09:36 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-11-16 09:36 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wfplwfs.sys

2013-11-16 09:36 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-16 09:36 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL

2013-11-16 09:36 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-16 09:36 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-16 09:36 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_wpdcomp_01_11_00.Wdf

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_ccdcmbx64_01009.Wdf

2013-11-09 17:08 - 2013-11-09 17:08 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

2013-11-09 17:07 - 2013-11-16 09:33 - 104513208 _____ C:\windows\SysWOW64\ᶩ꫋LÃ

2013-11-08 19:10 - 2013-11-09 09:20 - 00000000 ____D C:\Program Files (x86)\Betcat

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 _____ C:\autoexec.bat

2013-11-08 18:43 - 2013-11-08 22:47 - 00000000 ____D C:\windows\CD09642E061D4844BA37ED1480916404.TMP

2013-11-08 18:41 - 2013-11-08 18:41 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Eike Koopamann\Downloads\SpyHunter-Installer.exe

2013-11-08 17:56 - 2013-11-08 17:56 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Roaming\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 17:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-11-08 17:55 - 2013-11-08 17:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eike Koopamann\Downloads\mbam-setup-1.75.0.1300.exe
 

==================== One Month Modified Files and Folders =======
 

2013-12-03 23:29 - 2013-12-03 23:28 - 00013794 _____ C:\Users\Eike Koopamann\Downloads\FRST.txt

2013-12-03 23:28 - 2013-12-03 23:28 - 00000000 ____D C:\FRST

2013-12-03 23:27 - 2013-12-03 23:27 - 01959614 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64.exe

2013-12-03 23:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru

2013-12-03 22:43 - 2013-08-16 15:07 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-12-03 22:38 - 2013-12-03 22:38 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-12-03 22:38 - 2013-12-03 18:28 - 00001942 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-12-03 22:36 - 2013-08-11 18:03 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Roaming\Tepfel

2013-12-03 22:28 - 2013-08-11 17:48 - 01672442 _____ C:\windows\WindowsUpdate.log

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee

2013-12-03 18:28 - 2013-12-03 18:27 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Local\Adobe

2013-12-03 18:28 - 2013-08-16 15:07 - 00003772 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-30 19:22 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent

2013-11-29 19:21 - 2012-08-01 18:03 - 00785550 _____ C:\windows\system32\perfh013.dat

2013-11-29 19:21 - 2012-08-01 18:03 - 00158586 _____ C:\windows\system32\perfc013.dat

2013-11-29 19:21 - 2012-08-01 17:55 - 00780976 _____ C:\windows\system32\perfh010.dat

2013-11-29 19:21 - 2012-08-01 17:55 - 00152608 _____ C:\windows\system32\perfc010.dat

2013-11-29 19:21 - 2012-08-01 17:46 - 00790022 _____ C:\windows\system32\perfh00C.dat

2013-11-29 19:21 - 2012-08-01 17:46 - 00155084 _____ C:\windows\system32\perfc00C.dat

2013-11-29 19:21 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat

2013-11-29 19:21 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat

2013-11-29 19:21 - 2012-07-26 08:28 - 04568320 _____ C:\windows\system32\PerfStringBackup.INI

2013-11-29 19:16 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-11-29 19:15 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI

2013-11-29 19:14 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ToastData

2013-11-29 08:03 - 2012-07-26 08:21 - 00027869 _____ C:\windows\setupact.log

2013-11-27 21:41 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\NDF

2013-11-27 15:30 - 2013-11-27 15:25 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\28.11.2013

2013-11-26 11:26 - 2013-08-18 20:50 - 00000000 ____D C:\windows\system32\MRT

2013-11-26 11:23 - 2013-08-18 20:50 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-11-25 19:49 - 2013-11-25 19:49 - 00329024 _____ C:\windows\system32\FNTCACHE.DAT

2013-11-25 19:45 - 2013-08-13 20:57 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys

2013-11-19 21:19 - 2013-08-11 18:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-19 19:09 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore

2013-11-16 09:58 - 2013-11-16 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-16 09:33 - 2013-11-09 17:07 - 104513208 _____ C:\windows\SysWOW64\ᶩ꫋LÃ

2013-11-13 19:17 - 2013-08-21 17:15 - 00000000 ____D C:\Program Files (x86)\ElsterFormular

2013-11-13 19:17 - 2013-08-11 17:49 - 00000000 ____D C:\Users\Eike Koopamann

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_wpdcomp_01_11_00.Wdf

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_ccdcmbx64_01009.Wdf

2013-11-09 17:08 - 2013-11-09 17:08 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

2013-11-09 09:20 - 2013-11-08 19:10 - 00000000 ____D C:\Program Files (x86)\Betcat

2013-11-08 22:47 - 2013-11-08 18:43 - 00000000 ____D C:\windows\CD09642E061D4844BA37ED1480916404.TMP

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 _____ C:\autoexec.bat

2013-11-08 18:41 - 2013-11-08 18:41 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Eike Koopamann\Downloads\SpyHunter-Installer.exe

2013-11-08 18:07 - 2013-08-11 18:04 - 00000000 ____D C:\ProgramData\eSafe

2013-11-08 18:07 - 2013-01-30 03:47 - 00018610 _____ C:\windows\PFRO.log

2013-11-08 18:05 - 2013-08-11 18:03 - 00000000 ____D C:\Program Files (x86)\Tepfel

2013-11-08 17:56 - 2013-11-08 17:56 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Roaming\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 17:55 - 2013-11-08 17:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eike Koopamann\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-05 23:58 - 2013-11-19 21:21 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-05 23:58 - 2013-11-19 21:21 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
 

Some content of TEMP:

====================

C:\Users\Eike Koopamann\AppData\Local\Temp\avgnt.exe

C:\Users\Eike Koopamann\AppData\Local\Temp\SHSetup.exe

C:\Users\Eike Koopamann\AppData\Local\Temp\uninst1.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-11-29 08:11
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-12-2013 02

Ran by Eike Koopamann at 2013-12-03 23:29:41

Running from C:\Users\Eike Koopamann\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152)

Avira Free Antivirus (x32 Version: 14.0.1.749)

Classic Shell (Version: 3.6.8)

ElsterFormular (x32 Version: 14.4.12044)

Intel AppUp(R) center (x32 Version: 3.8.0.41663.61)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2875)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149)

Intel® Trusted Connect Service Client (Version: 1.24.388.1)

LibreOffice 4.1.0.4 (x32 Version: 4.1.0.4)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

McAfee Security Scan Plus (Version: 3.8.130.10)

Microsoft Office (x32 Version: 15.0.4420.1017)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

MozBackup 1.5.1 (x32)

Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)

Mozilla Maintenance Service (x32 Version: 25.0.1)

Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)

Nokia Connectivity Cable Driver (Version: 7.1.32.69)

PDF24 Creator 5.7.0 (x32)

Premium Sound HD (Version: 1.12.6000)

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802)

Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6794)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136)

Realtek WLAN Driver (x32 Version: 2.00.0020)

Shared C Run-time for x64 (Version: 10.0.0)

Synaptics Pointing Device Driver (Version: 16.3.4.0)

TOSHIBA Desktop Assist (Version: 1.00.08.6402)

TOSHIBA eco Utility (Version: 2.0.0.6415)

TOSHIBA Function Key (Version: 1.00.6626.6410)

TOSHIBA Manuals (x32 Version: 10.10)

TOSHIBA Password Utility (x32 Version: 2.00.973)

TOSHIBA PC Health Monitor (Version: 1.8.17.640104)

TOSHIBA Recovery Media Creator (x32 Version: 2.2.1.54043006)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00)

TOSHIBA Service Station (Version: 2.4.4)

TOSHIBA System Driver (x32 Version: 1.00.0015)

TOSHIBA System Settings (x32 Version: 1.00.0002.32002)

Toshiba TEMPRO (x32 Version: 4.3.3)

TOSHIBA VIDEO PLAYER (Version: 5.1.0.21-A)

Web-Cake 3.00 (Version: 3.00)

Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3)
 

==================== Restore Points  =========================
 

16-11-2013 09:02:08 Windows Update

19-11-2013 18:06:04 Windows Update

26-11-2013 10:21:21 Windows Update
 

==================== Hosts content: ==========================
 

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {0A1CB763-BDC3-40BF-87B4-F1AE0CAA5020} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)

Task: {1FCD2161-F8D6-4A23-A1DF-3742FE23B9BF} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-11-29] (Synaptics Incorporated)

Task: {8260E436-41C8-4649-9C17-44C4E45025A4} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)

Task: {C15F0BA4-27D9-4E4F-8A09-8D5E3E97F1A7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-03] (Adobe Systems Incorporated)

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {CEF8B262-C34A-4992-B98E-8B950462793E} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe

Task: {D05BB670-0127-4A61-84A2-A78EB39027B7} - System32\Tasks\Microsoft\Windows\Setup\Windows Upgrade Notification Task => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)

Task: {EE327E2B-FAFF-4880-B399-0CE2667FA2CC} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-01-29 20:09 - 2012-11-01 14:43 - 00175008 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4396.1016_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll

2012-10-26 00:24 - 2012-10-24 06:44 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-07-19 02:38 - 2012-07-19 02:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll

2012-07-19 02:38 - 2012-07-19 02:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll

2012-08-14 03:13 - 2012-08-14 03:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll

2013-08-11 10:19 - 2013-08-13 21:14 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2013-05-09 17:01 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2013-11-16 09:58 - 2013-11-16 09:58 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/03/2013 06:14:33 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (12/02/2013 05:07:01 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (12/02/2013 04:36:43 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/30/2013 08:09:39 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/29/2013 11:25:36 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/28/2013 05:27:27 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/28/2013 02:24:07 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: TCrdMain_Win8.exe, Version: 2.0.7.64, Zeitstempel: 0x5091827a

Name des fehlerhaften Moduls: SynCOM.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x50b86421

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000000001001f368

ID des fehlerhaften Prozesses: 0xdb0

Startzeit der fehlerhaften Anwendung: 0xTCrdMain_Win8.exe0

Pfad der fehlerhaften Anwendung: TCrdMain_Win8.exe1

Pfad des fehlerhaften Moduls: TCrdMain_Win8.exe2

Berichtskennung: TCrdMain_Win8.exe3

Vollständiger Name des fehlerhaften Pakets: TCrdMain_Win8.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: TCrdMain_Win8.exe5
 

Error: (11/27/2013 11:03:27 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/26/2013 03:42:16 PM) (Source: Application Hang) (User: )

Description: Programm wwahost.exe, Version 6.2.9200.16420 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: d40
 

Startzeit: 01ceea9dc338884f
 

Endzeit: 4294967295
 

Anwendungspfad: C:\windows\system32\wwahost.exe
 

Berichts-ID: efc166b2-56a8-11e3-be8b-24fd5215b36f
 

Vollständiger Name des fehlerhaften Pakets: microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Microsoft.WindowsLive.ModernPhotos
 

Error: (11/26/2013 03:42:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Eike)

Description: Das Paket „microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe“ wurde beendet, da das Anhalten zu lange dauerte.
 
 

System errors:

=============

Error: (11/29/2013 07:14:32 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
 

Error: (11/19/2013 07:05:28 PM) (Source: DCOM) (User: Eike)

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 

Error: (11/19/2013 07:05:26 PM) (Source: DCOM) (User: Eike)

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 

Error: (10/26/2013 00:37:31 PM) (Source: DCOM) (User: Eike)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}EikeEike KoopamannS-1-5-21-3149299854-2721699910-2777857454-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (10/26/2013 00:37:31 PM) (Source: DCOM) (User: Eike)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}EikeEike KoopamannS-1-5-21-3149299854-2721699910-2777857454-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (10/26/2013 00:37:31 PM) (Source: DCOM) (User: Eike)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}EikeEike KoopamannS-1-5-21-3149299854-2721699910-2777857454-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (10/26/2013 00:37:31 PM) (Source: DCOM) (User: Eike)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}EikeEike KoopamannS-1-5-21-3149299854-2721699910-2777857454-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (10/26/2013 00:37:31 PM) (Source: DCOM) (User: Eike)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}EikeEike KoopamannS-1-5-21-3149299854-2721699910-2777857454-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (10/26/2013 00:37:31 PM) (Source: DCOM) (User: Eike)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}EikeEike KoopamannS-1-5-21-3149299854-2721699910-2777857454-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (10/26/2013 00:37:30 PM) (Source: DCOM) (User: Eike)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}EikeEike KoopamannS-1-5-21-3149299854-2721699910-2777857454-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 
 

Microsoft Office Sessions:

=========================

Error: (12/03/2013 06:14:33 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (12/02/2013 05:07:01 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (12/02/2013 04:36:43 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/30/2013 08:09:39 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/29/2013 11:25:36 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/28/2013 05:27:27 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/28/2013 02:24:07 PM) (Source: Application Error)(User: )

Description: TCrdMain_Win8.exe2.0.7.645091827aSynCOM.dll_unloaded0.0.0.050b86421c0000005000000001001f368db001ceec13a1814e2cC:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exeSynCOM.dll5b17c310-5830-11e3-be8b-24fd5215b36f
 

Error: (11/27/2013 11:03:27 AM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/26/2013 03:42:16 PM) (Source: Application Hang)(User: )

Description: wwahost.exe6.2.9200.16420d4001ceea9dc338884f4294967295C:\windows\system32\wwahost.exeefc166b2-56a8-11e3-be8b-24fd5215b36fmicrosoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbweMicrosoft.WindowsLive.ModernPhotos
 

Error: (11/26/2013 03:42:13 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: Eike)

Description: microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 46%

Total physical RAM: 3979.21 MB

Available physical RAM: 2147.13 MB

Total Pagefile: 4683.21 MB

Available Pagefile: 2559.12 MB

Total Virtual: 8192 MB

Available Virtual: 8191.78 MB
 

==================== Drives ================================
 

Drive c: (TI31051200A) (Fixed) (Total:286.89 GB) (Free:250.72 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type

==================== End Of Log ============================

Habe ich alles soweit richtig gemacht? Sorry, ich kann Autos reparieren, aber Computer?

@ cosinus: Ich melde mich für heute ab, wäre super, wenn Du mir morgen weiterhelfen könntest.

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

So, hier das weitere Ergebnis:

Code:

Malwarebytes Anti-Rootkit BETA 1.07.0.1007

www.malwarebytes.org
 

Database version: v2013.12.04.06
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16736

Eike Koopamann :: EIKE [administrator]
 

04.12.2013 16:39:50

mbar-log-2013-12-04 (16-39-50).txt
 

Scan type: Quick scan

Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: 

Objects scanned: 220551

Time elapsed: 31 minute(s), 11 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 0

(No malicious items detected)
 

Registry Values Detected: 0

(No malicious items detected)
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 0

(No malicious items detected)
 

Physical Sectors Detected: 0

(No malicious items detected)
 

(end)

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

So, hier die Texte:

Code:

# AdwCleaner v3.014 - Bericht erstellt am 04/12/2013 um 17:47:14

# Updated 01/12/2013 von Xplode

# Betriebssystem : Windows 8  (64 bits)

# Benutzername : Eike Koopamann - EIKE

# Gestartet von : C:\Users\Eike Koopamann\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

[#] Dienst Gelöscht : WebCakeUpdater
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\ProgramData\eSafe

Ordner Gelöscht : C:\ProgramData\Tarma Installer

Ordner Gelöscht : C:\Program Files (x86)\Betcat

Ordner Gelöscht : C:\Program Files (x86)\Tepfel

Ordner Gelöscht : C:\Program Files (x86)\Common Files\337

Ordner Gelöscht : C:\Users\EIKEKO~1\AppData\Local\Temp\Desk365

Ordner Gelöscht : C:\Users\EIKEKO~1\AppData\Local\Temp\eIntaller

Ordner Gelöscht : C:\Users\Eike Koopamann\AppData\LocalLow\Delta

Ordner Gelöscht : C:\Users\Eike Koopamann\AppData\Roaming\Tepfel

Datei Gelöscht : C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\invalidprefs.js

Datei Gelöscht : C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\user.js

Datei Gelöscht : C:\windows\System32\Tasks\Desk 365 RunAsStdUser
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [WebCake Desktop]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WebCakeIEClient.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\WebCakeIEClient.Api

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\WebCakeIEClient.Api.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc

Schlüssel Gelöscht : HKCU\Software\fe88ddb66aef10

Schlüssel Gelöscht : HKLM\SOFTWARE\fe88ddb66aef10

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7169BBB3-3289-4696-B35D-4A88BCF6FB12}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF6B0594-6008-4327-93E5-608AD710A6FA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BB975E58-E769-4E5A-BA12-B765BC559FF3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AF6B0594-6008-4327-93E5-608AD710A6FA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AF6B0594-6008-4327-93E5-608AD710A6FA}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0AFD55C8-ADF8-4A33-A6E1-DEDB7A36AEB4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command

Schlüssel Gelöscht : HKCU\Software\BabSolution

Schlüssel Gelöscht : HKCU\Software\DataMngr

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\Delta

Schlüssel Gelöscht : HKLM\Software\DataMngr

Schlüssel Gelöscht : HKLM\Software\Delta

Schlüssel Gelöscht : HKLM\Software\delta-homesSoftware

Schlüssel Gelöscht : HKLM\Software\Desksvc

Schlüssel Gelöscht : HKLM\Software\eSafeSecControl

Schlüssel Gelöscht : HKLM\Software\hdcode

Schlüssel Gelöscht : HKLM\Software\Uniblue

Schlüssel Gelöscht : HKLM\Software\V9

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DomaIQ

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16537
 
 

-\\ Mozilla Firefox v25.0.1 (de)
 

[ Datei : C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\prefs.js ]
 

Zeile gelöscht : user_pref("extensions.enabledAddons", "plugins%40getwebcake.com:1.00.01,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:25.0.1");

Zeile gelöscht : user_pref("extentions.webcake.defaultEnableAppsList", "layers,brain/features,newOffers/wc");

Zeile gelöscht : user_pref("extentions.webcake.installId", "8f5ca5eb-7a8f-4ceb-a8c4-219778558145");
 

*************************
 

AdwCleaner[R0].txt - [6068 octets] - [04/12/2013 17:46:29]

AdwCleaner[S0].txt - [5352 octets] - [04/12/2013 17:47:14]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5412 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.8 (11.05.2013:1)

OS: Windows 8 x64

Ran by Eike Koopamann on 04.12.2013 at 21:49:00,70

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\sweetim

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\webcakeupdater
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Successfully deleted: [Folder] C:\Users\Eike Koopamann\AppData\Roaming\mozilla\firefox\profiles\nvxyvzwz.default\extensions\staged

Emptied folder: C:\Users\Eike Koopamann\AppData\Roaming\mozilla\firefox\profiles\nvxyvzwz.default\minidumps [5 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 04.12.2013 at 21:53:28,39

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-12-2013

Ran by Eike Koopamann (administrator) on EIKE on 04-12-2013 21:57:42

Running from C:\Users\Eike Koopamann\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4396.1016_x64__8wekyb3d8bbwe\LiveComm.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\McUICnt.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Farbar) C:\Users\Eike Koopamann\Desktop\FRST64(1).exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor)

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] ()

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223242 2012-10-22] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM-x32\...\Run: [Intel AppUp(R) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
 

==================== Internet (Whitelisted) ====================
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = 

BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)

BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default

FF SearchEngineOrder.1: Google

FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: plugins - C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\Extensions\plugins@getwebcake.com.xpi

FF Extension: Adblock Plus - C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-06-29] (IvoSoft)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [83160 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

S3 RTL8192Ce; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                           )

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                           )

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31032 2012-11-29] (Synaptics Incorporated)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [198656 2012-07-26] (Microsoft Corporation)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-12-04 21:57 - 2013-12-04 21:57 - 00011705 _____ C:\Users\Eike Koopamann\Desktop\FRST.txt

2013-12-04 21:56 - 2013-12-04 21:56 - 01959766 _____ (Farbar) C:\Users\Eike Koopamann\Desktop\FRST64(1).exe

2013-12-04 21:55 - 2013-12-04 21:56 - 01959766 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64(1).exe

2013-12-04 21:53 - 2013-12-04 21:53 - 00001307 _____ C:\Users\Eike Koopamann\Desktop\JRT.txt

2013-12-04 21:48 - 2013-12-04 21:48 - 00005516 _____ C:\Users\Eike Koopamann\Desktop\AdwCleaner[S0].txt

2013-12-04 21:48 - 2013-12-04 21:48 - 00000000 ____D C:\windows\ERUNT

2013-12-04 21:47 - 2013-12-04 21:47 - 01034531 _____ (Thisisu) C:\Users\Eike Koopamann\Downloads\JRT.exe

2013-12-04 21:47 - 2013-12-04 21:47 - 01034531 _____ (Thisisu) C:\Users\Eike Koopamann\Desktop\JRT.exe

2013-12-04 17:54 - 2013-12-04 17:54 - 00000000 ____D C:\sources

2013-12-04 17:45 - 2013-12-04 17:47 - 00000000 ____D C:\AdwCleaner

2013-12-04 17:45 - 2013-12-04 17:44 - 01110034 _____ C:\Users\Eike Koopamann\Desktop\adwcleaner.exe

2013-12-04 17:44 - 2013-12-04 17:44 - 01110034 _____ C:\Users\Eike Koopamann\Downloads\adwcleaner.exe

2013-12-04 06:29 - 2013-12-04 16:39 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2013-12-04 06:27 - 2013-12-04 17:13 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\mbar

2013-12-04 06:27 - 2013-12-04 16:38 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-12-04 06:26 - 2013-12-04 06:26 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Eike Koopamann\Desktop\mbar-1.07.0.1007.exe

2013-12-03 23:29 - 2013-12-03 23:30 - 00014294 _____ C:\Users\Eike Koopamann\Downloads\Addition.txt

2013-12-03 23:28 - 2013-12-03 23:30 - 00029870 _____ C:\Users\Eike Koopamann\Downloads\FRST.txt

2013-12-03 23:28 - 2013-12-03 23:28 - 00000000 ____D C:\FRST

2013-12-03 23:27 - 2013-12-03 23:27 - 01959614 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64.exe

2013-12-03 22:38 - 2013-12-03 22:38 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 22:38 - 00001942 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee

2013-12-03 18:27 - 2013-12-03 18:28 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Local\Adobe

2013-11-27 15:25 - 2013-11-27 15:30 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\28.11.2013

2013-11-25 21:20 - 2013-10-02 00:37 - 02035712 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-25 21:20 - 2013-10-02 00:26 - 02304512 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-25 21:20 - 2013-08-23 08:22 - 02062848 _____ (Microsoft Corporation) C:\windows\system32\d3d11.dll

2013-11-25 21:20 - 2013-08-23 02:44 - 01711616 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d11.dll

2013-11-25 19:49 - 2013-11-25 19:49 - 00329024 _____ C:\windows\system32\FNTCACHE.DAT

2013-11-19 21:21 - 2013-11-05 23:58 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-19 21:21 - 2013-11-05 23:58 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-11-16 09:58 - 2013-11-16 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-16 09:38 - 2013-09-14 02:15 - 00059416 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2013-11-16 09:38 - 2013-09-13 23:36 - 00628736 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00084992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2013-11-16 09:38 - 2013-09-13 23:34 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2013-11-16 09:38 - 2013-09-13 23:33 - 03279360 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 01622016 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00773120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00252928 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00142848 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2013-11-16 09:38 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\windows\system32\Drivers\crashdmp.sys

2013-11-16 09:38 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\windows\system32\UIAutomationCore.dll

2013-11-16 09:38 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\windows\SysWOW64\UIAutomationCore.dll

2013-11-16 09:38 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fvevol.sys

2013-11-16 09:38 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tpm.sys

2013-11-16 09:38 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2013-11-16 09:38 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2013-11-16 09:38 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll

2013-11-16 09:38 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll

2013-11-16 09:38 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\WSDApi.dll

2013-11-16 09:38 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSDApi.dll

2013-11-16 09:37 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-16 09:37 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-16 09:37 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-16 09:37 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-11-16 09:36 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-11-16 09:36 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-11-16 09:36 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-11-16 09:36 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wfplwfs.sys

2013-11-16 09:36 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-16 09:36 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL

2013-11-16 09:36 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-16 09:36 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-16 09:36 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_wpdcomp_01_11_00.Wdf

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_ccdcmbx64_01009.Wdf

2013-11-09 17:08 - 2013-11-09 17:08 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

2013-11-09 17:07 - 2013-11-16 09:33 - 104513208 _____ C:\windows\SysWOW64\ᶩ꫋LÃ

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 _____ C:\autoexec.bat

2013-11-08 18:43 - 2013-11-08 22:47 - 00000000 ____D C:\windows\CD09642E061D4844BA37ED1480916404.TMP

2013-11-08 18:41 - 2013-11-08 18:41 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Eike Koopamann\Downloads\SpyHunter-Installer.exe

2013-11-08 17:56 - 2013-11-08 17:56 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Roaming\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 17:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-11-08 17:55 - 2013-11-08 17:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eike Koopamann\Downloads\mbam-setup-1.75.0.1300.exe
 

==================== One Month Modified Files and Folders =======
 

2013-12-04 21:57 - 2013-12-04 21:57 - 00011705 _____ C:\Users\Eike Koopamann\Desktop\FRST.txt

2013-12-04 21:56 - 2013-12-04 21:56 - 01959766 _____ (Farbar) C:\Users\Eike Koopamann\Desktop\FRST64(1).exe

2013-12-04 21:56 - 2013-12-04 21:55 - 01959766 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64(1).exe

2013-12-04 21:55 - 2013-08-11 17:48 - 01724447 _____ C:\windows\WindowsUpdate.log

2013-12-04 21:53 - 2013-12-04 21:53 - 00001307 _____ C:\Users\Eike Koopamann\Desktop\JRT.txt

2013-12-04 21:48 - 2013-12-04 21:48 - 00005516 _____ C:\Users\Eike Koopamann\Desktop\AdwCleaner[S0].txt

2013-12-04 21:48 - 2013-12-04 21:48 - 00000000 ____D C:\windows\ERUNT

2013-12-04 21:47 - 2013-12-04 21:47 - 01034531 _____ (Thisisu) C:\Users\Eike Koopamann\Downloads\JRT.exe

2013-12-04 21:47 - 2013-12-04 21:47 - 01034531 _____ (Thisisu) C:\Users\Eike Koopamann\Desktop\JRT.exe

2013-12-04 21:45 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru

2013-12-04 21:43 - 2013-08-16 15:07 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-12-04 18:18 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-12-04 18:16 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Photo Viewer

2013-12-04 18:15 - 2012-08-01 17:38 - 00000000 ____D C:\windows\SysWOW64\XPSViewer

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\windows\SysWOW64\migwiz

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Defender

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-12-04 18:15 - 2012-07-26 08:52 - 00000000 ____D C:\Program Files\Windows Journal

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\winrm

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\WCN

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\sysprep

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\slmgr

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\Printing_Admin_Scripts

2013-12-04 18:15 - 2012-07-26 06:38 - 00000000 ____D C:\windows\SysWOW64\oobe

2013-12-04 18:15 - 2012-07-26 06:38 - 00000000 ____D C:\windows\SysWOW64\Dism

2013-12-04 18:14 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ImmersiveControlPanel

2013-12-04 18:14 - 2012-07-26 09:12 - 00000000 ____D C:\windows\SysWOW64\Com

2013-12-04 18:14 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\migwiz

2013-12-04 18:14 - 2012-07-26 08:49 - 00000000 ____D C:\windows\system32\winrm

2013-12-04 18:14 - 2012-07-26 08:49 - 00000000 ____D C:\windows\system32\slmgr

2013-12-04 18:14 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\Sysprep

2013-12-04 18:14 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\oobe

2013-12-04 18:11 - 2012-07-26 08:49 - 00000000 ____D C:\windows\system32\WCN

2013-12-04 18:11 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\Dism

2013-12-04 18:10 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\SystemResetPlatform

2013-12-04 18:10 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\Com

2013-12-04 18:10 - 2012-07-26 08:49 - 00000000 ____D C:\windows\system32\Printing_Admin_Scripts

2013-12-04 18:08 - 2012-07-26 06:37 - 00000000 ____D C:\windows\servicing

2013-12-04 18:06 - 2012-07-26 09:12 - 00000000 ____D C:\windows\SysWOW64\MUI

2013-12-04 17:56 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\MUI

2013-12-04 17:54 - 2013-12-04 17:54 - 00000000 ____D C:\sources

2013-12-04 17:47 - 2013-12-04 17:45 - 00000000 ____D C:\AdwCleaner

2013-12-04 17:44 - 2013-12-04 17:45 - 01110034 _____ C:\Users\Eike Koopamann\Desktop\adwcleaner.exe

2013-12-04 17:44 - 2013-12-04 17:44 - 01110034 _____ C:\Users\Eike Koopamann\Downloads\adwcleaner.exe

2013-12-04 17:13 - 2013-12-04 06:27 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\mbar

2013-12-04 16:39 - 2013-12-04 06:29 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2013-12-04 16:38 - 2013-12-04 06:27 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-12-04 16:26 - 2012-08-01 17:55 - 00780976 _____ C:\windows\system32\perfh010.dat

2013-12-04 16:26 - 2012-08-01 17:55 - 00152608 _____ C:\windows\system32\perfc010.dat

2013-12-04 16:26 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat

2013-12-04 16:26 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat

2013-12-04 16:26 - 2012-07-26 08:28 - 04568320 _____ C:\windows\system32\PerfStringBackup.INI

2013-12-04 16:21 - 2013-01-30 03:47 - 00018966 _____ C:\windows\PFRO.log

2013-12-04 16:21 - 2012-07-26 09:12 - 00000000 ____D C:\windows\IME

2013-12-04 16:21 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI

2013-12-04 06:26 - 2013-12-04 06:26 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Eike Koopamann\Desktop\mbar-1.07.0.1007.exe

2013-12-03 23:30 - 2013-12-03 23:29 - 00014294 _____ C:\Users\Eike Koopamann\Downloads\Addition.txt

2013-12-03 23:30 - 2013-12-03 23:28 - 00029870 _____ C:\Users\Eike Koopamann\Downloads\FRST.txt

2013-12-03 23:28 - 2013-12-03 23:28 - 00000000 ____D C:\FRST

2013-12-03 23:27 - 2013-12-03 23:27 - 01959614 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64.exe

2013-12-03 22:38 - 2013-12-03 22:38 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-12-03 22:38 - 2013-12-03 18:28 - 00001942 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee

2013-12-03 18:28 - 2013-12-03 18:27 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Local\Adobe

2013-12-03 18:28 - 2013-08-16 15:07 - 00003772 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-30 19:22 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent

2013-11-29 19:14 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ToastData

2013-11-29 08:03 - 2012-07-26 08:21 - 00027869 _____ C:\windows\setupact.log

2013-11-27 21:41 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\NDF

2013-11-27 15:30 - 2013-11-27 15:25 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\28.11.2013

2013-11-26 11:26 - 2013-08-18 20:50 - 00000000 ____D C:\windows\system32\MRT

2013-11-26 11:23 - 2013-08-18 20:50 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-11-25 19:49 - 2013-11-25 19:49 - 00329024 _____ C:\windows\system32\FNTCACHE.DAT

2013-11-25 19:45 - 2013-08-13 20:57 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys

2013-11-19 21:19 - 2013-08-11 18:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-16 09:58 - 2013-11-16 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-16 09:33 - 2013-11-09 17:07 - 104513208 _____ C:\windows\SysWOW64\ᶩ꫋LÃ

2013-11-13 19:17 - 2013-08-21 17:15 - 00000000 ____D C:\Program Files (x86)\ElsterFormular

2013-11-13 19:17 - 2013-08-11 17:49 - 00000000 ____D C:\Users\Eike Koopamann

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_wpdcomp_01_11_00.Wdf

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_ccdcmbx64_01009.Wdf

2013-11-09 17:08 - 2013-11-09 17:08 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

2013-11-08 22:47 - 2013-11-08 18:43 - 00000000 ____D C:\windows\CD09642E061D4844BA37ED1480916404.TMP

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 _____ C:\autoexec.bat

2013-11-08 18:41 - 2013-11-08 18:41 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Eike Koopamann\Downloads\SpyHunter-Installer.exe

2013-11-08 17:56 - 2013-11-08 17:56 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Roaming\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 17:55 - 2013-11-08 17:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eike Koopamann\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-05 23:58 - 2013-11-19 21:21 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-05 23:58 - 2013-11-19 21:21 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
 

Some content of TEMP:

====================

C:\Users\Eike Koopamann\AppData\Local\Temp\avgnt.exe

C:\Users\Eike Koopamann\AppData\Local\Temp\Quarantine.exe

C:\Users\Eike Koopamann\AppData\Local\Temp\SHSetup.exe

C:\Users\Eike Koopamann\AppData\Local\Temp\uninst1.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-11-29 08:11
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Kann es sein, das das Problem schon behoben ist? Die blaue Schrift ist verschwunden und die Fenster kommen auch nicht mehr...

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

C:\Program Files\Enigma Software Group

reg: reg delete "HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}" /f

reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\sweetim"

reg: reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\webcakeupdater" /f

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-12-2013

Ran by Eike Koopamann at 2013-12-04 22:20:15 Run:1

Running from C:\Users\Eike Koopamann\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

C:\Program Files\Enigma Software Group

reg: reg delete "HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}" /f

reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\sweetim"

reg: reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\webcakeupdater" /f

         

*****************
 

esgiguard => Service deleted successfully.

C:\Program Files\Enigma Software Group => Moved successfully.
 

========= reg delete "HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}" /f =========
 

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.
 
 

========= End of Reg: =========
 
 

========= reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\sweetim" =========
 

Soll der Registrierungsschlssel HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\sweetim unwiderruflich gel”scht werden (J/N)? FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.
 
 

========= End of Reg: =========
 
 

========= reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\webcakeupdater" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

==== End of Fixlog ====

Neues FRST Log bitte, Haken setzen bei additions.txt

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-12-2013

Ran by Eike Koopamann (administrator) on EIKE on 05-12-2013 06:42:03

Running from C:\Users\Eike Koopamann\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4396.1016_x64__8wekyb3d8bbwe\LiveComm.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\McUICnt.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.2.9200.20523_x64__8wekyb3d8bbwe\glcnd.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Farbar) C:\Users\Eike Koopamann\Desktop\FRST64(1).exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor)

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] ()

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223242 2012-10-22] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM-x32\...\Run: [Intel AppUp(R) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
 

==================== Internet (Whitelisted) ====================
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - {92DBA33B-89A9-4441-965D-BE7A8C1BC452} URL = 

BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)

BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default

FF SearchEngineOrder.1: Google

FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: plugins - C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\Extensions\plugins@getwebcake.com.xpi

FF Extension: Adblock Plus - C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-06-29] (IvoSoft)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [83160 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

S3 RTL8192Ce; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                           )

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                           )

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31032 2012-11-29] (Synaptics Incorporated)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [198656 2012-07-26] (Microsoft Corporation)

S4 esgiguard; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-12-05 06:42 - 2013-12-05 06:42 - 00011807 _____ C:\Users\Eike Koopamann\Desktop\FRST.txt

2013-12-05 06:41 - 2013-12-05 06:41 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\Neuer Ordner

2013-12-04 21:56 - 2013-12-04 21:56 - 01959766 _____ (Farbar) C:\Users\Eike Koopamann\Desktop\FRST64(1).exe

2013-12-04 21:55 - 2013-12-04 21:56 - 01959766 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64(1).exe

2013-12-04 21:48 - 2013-12-04 21:48 - 00000000 ____D C:\windows\ERUNT

2013-12-04 21:47 - 2013-12-04 21:47 - 01034531 _____ (Thisisu) C:\Users\Eike Koopamann\Downloads\JRT.exe

2013-12-04 21:47 - 2013-12-04 21:47 - 01034531 _____ (Thisisu) C:\Users\Eike Koopamann\Desktop\JRT.exe

2013-12-04 17:54 - 2013-12-04 17:54 - 00000000 ____D C:\sources

2013-12-04 17:45 - 2013-12-04 17:47 - 00000000 ____D C:\AdwCleaner

2013-12-04 17:45 - 2013-12-04 17:44 - 01110034 _____ C:\Users\Eike Koopamann\Desktop\adwcleaner.exe

2013-12-04 17:44 - 2013-12-04 17:44 - 01110034 _____ C:\Users\Eike Koopamann\Downloads\adwcleaner.exe

2013-12-04 06:29 - 2013-12-04 16:39 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2013-12-04 06:27 - 2013-12-04 17:13 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\mbar

2013-12-04 06:27 - 2013-12-04 16:38 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-12-04 06:26 - 2013-12-04 06:26 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Eike Koopamann\Desktop\mbar-1.07.0.1007.exe

2013-12-03 23:29 - 2013-12-03 23:30 - 00014294 _____ C:\Users\Eike Koopamann\Downloads\Addition.txt

2013-12-03 23:28 - 2013-12-03 23:30 - 00029870 _____ C:\Users\Eike Koopamann\Downloads\FRST.txt

2013-12-03 23:28 - 2013-12-03 23:28 - 00000000 ____D C:\FRST

2013-12-03 23:27 - 2013-12-03 23:27 - 01959614 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64.exe

2013-12-03 22:38 - 2013-12-03 22:38 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 22:38 - 00001942 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee

2013-12-03 18:27 - 2013-12-03 18:28 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Local\Adobe

2013-11-27 15:25 - 2013-11-27 15:30 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\28.11.2013

2013-11-25 21:20 - 2013-10-02 00:37 - 02035712 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-25 21:20 - 2013-10-02 00:26 - 02304512 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-25 21:20 - 2013-08-23 08:22 - 02062848 _____ (Microsoft Corporation) C:\windows\system32\d3d11.dll

2013-11-25 21:20 - 2013-08-23 02:44 - 01711616 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d11.dll

2013-11-25 19:49 - 2013-11-25 19:49 - 00329024 _____ C:\windows\system32\FNTCACHE.DAT

2013-11-19 21:21 - 2013-11-05 23:58 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-19 21:21 - 2013-11-05 23:58 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-11-16 09:58 - 2013-11-16 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-16 09:38 - 2013-09-14 02:15 - 00059416 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2013-11-16 09:38 - 2013-09-13 23:36 - 00628736 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00084992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2013-11-16 09:38 - 2013-09-13 23:36 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2013-11-16 09:38 - 2013-09-13 23:34 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2013-11-16 09:38 - 2013-09-13 23:33 - 03279360 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 01622016 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00773120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00252928 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00142848 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2013-11-16 09:38 - 2013-09-13 23:33 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2013-11-16 09:38 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\windows\system32\Drivers\crashdmp.sys

2013-11-16 09:38 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\windows\system32\UIAutomationCore.dll

2013-11-16 09:38 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\windows\SysWOW64\UIAutomationCore.dll

2013-11-16 09:38 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fvevol.sys

2013-11-16 09:38 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tpm.sys

2013-11-16 09:38 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2013-11-16 09:38 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2013-11-16 09:38 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll

2013-11-16 09:38 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll

2013-11-16 09:38 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\WSDApi.dll

2013-11-16 09:38 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSDApi.dll

2013-11-16 09:37 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-16 09:37 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-16 09:37 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-16 09:37 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-11-16 09:36 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-11-16 09:36 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-11-16 09:36 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-11-16 09:36 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-11-16 09:36 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-11-16 09:36 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-11-16 09:36 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wfplwfs.sys

2013-11-16 09:36 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-16 09:36 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL

2013-11-16 09:36 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-16 09:36 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-16 09:36 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_wpdcomp_01_11_00.Wdf

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_ccdcmbx64_01009.Wdf

2013-11-09 17:08 - 2013-11-09 17:08 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

2013-11-09 17:07 - 2013-11-16 09:33 - 104513208 _____ C:\windows\SysWOW64\ᶩ꫋LÃ

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 _____ C:\autoexec.bat

2013-11-08 18:43 - 2013-11-08 22:47 - 00000000 ____D C:\windows\CD09642E061D4844BA37ED1480916404.TMP

2013-11-08 18:41 - 2013-11-08 18:41 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Eike Koopamann\Downloads\SpyHunter-Installer.exe

2013-11-08 17:56 - 2013-11-08 17:56 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Roaming\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 17:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-11-08 17:55 - 2013-11-08 17:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eike Koopamann\Downloads\mbam-setup-1.75.0.1300.exe
 

==================== One Month Modified Files and Folders =======
 

2013-12-05 06:42 - 2013-12-05 06:42 - 00011807 _____ C:\Users\Eike Koopamann\Desktop\FRST.txt

2013-12-05 06:41 - 2013-12-05 06:41 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\Neuer Ordner

2013-12-05 06:39 - 2013-08-11 17:48 - 01740640 _____ C:\windows\WindowsUpdate.log

2013-12-04 22:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru

2013-12-04 21:56 - 2013-12-04 21:56 - 01959766 _____ (Farbar) C:\Users\Eike Koopamann\Desktop\FRST64(1).exe

2013-12-04 21:56 - 2013-12-04 21:55 - 01959766 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64(1).exe

2013-12-04 21:48 - 2013-12-04 21:48 - 00000000 ____D C:\windows\ERUNT

2013-12-04 21:47 - 2013-12-04 21:47 - 01034531 _____ (Thisisu) C:\Users\Eike Koopamann\Downloads\JRT.exe

2013-12-04 21:47 - 2013-12-04 21:47 - 01034531 _____ (Thisisu) C:\Users\Eike Koopamann\Desktop\JRT.exe

2013-12-04 21:43 - 2013-08-16 15:07 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-12-04 18:18 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-12-04 18:16 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Photo Viewer

2013-12-04 18:15 - 2012-08-01 17:38 - 00000000 ____D C:\windows\SysWOW64\XPSViewer

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\windows\SysWOW64\migwiz

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Defender

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer

2013-12-04 18:15 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-12-04 18:15 - 2012-07-26 08:52 - 00000000 ____D C:\Program Files\Windows Journal

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\winrm

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\WCN

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\sysprep

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\slmgr

2013-12-04 18:15 - 2012-07-26 08:49 - 00000000 ____D C:\windows\SysWOW64\Printing_Admin_Scripts

2013-12-04 18:15 - 2012-07-26 06:38 - 00000000 ____D C:\windows\SysWOW64\oobe

2013-12-04 18:15 - 2012-07-26 06:38 - 00000000 ____D C:\windows\SysWOW64\Dism

2013-12-04 18:14 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ImmersiveControlPanel

2013-12-04 18:14 - 2012-07-26 09:12 - 00000000 ____D C:\windows\SysWOW64\Com

2013-12-04 18:14 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\migwiz

2013-12-04 18:14 - 2012-07-26 08:49 - 00000000 ____D C:\windows\system32\winrm

2013-12-04 18:14 - 2012-07-26 08:49 - 00000000 ____D C:\windows\system32\slmgr

2013-12-04 18:14 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\Sysprep

2013-12-04 18:14 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\oobe

2013-12-04 18:11 - 2012-07-26 08:49 - 00000000 ____D C:\windows\system32\WCN

2013-12-04 18:11 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\Dism

2013-12-04 18:10 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\SystemResetPlatform

2013-12-04 18:10 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\Com

2013-12-04 18:10 - 2012-07-26 08:49 - 00000000 ____D C:\windows\system32\Printing_Admin_Scripts

2013-12-04 18:08 - 2012-07-26 06:37 - 00000000 ____D C:\windows\servicing

2013-12-04 18:06 - 2012-07-26 09:12 - 00000000 ____D C:\windows\SysWOW64\MUI

2013-12-04 17:56 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\MUI

2013-12-04 17:54 - 2013-12-04 17:54 - 00000000 ____D C:\sources

2013-12-04 17:47 - 2013-12-04 17:45 - 00000000 ____D C:\AdwCleaner

2013-12-04 17:44 - 2013-12-04 17:45 - 01110034 _____ C:\Users\Eike Koopamann\Desktop\adwcleaner.exe

2013-12-04 17:44 - 2013-12-04 17:44 - 01110034 _____ C:\Users\Eike Koopamann\Downloads\adwcleaner.exe

2013-12-04 17:13 - 2013-12-04 06:27 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\mbar

2013-12-04 16:39 - 2013-12-04 06:29 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2013-12-04 16:38 - 2013-12-04 06:27 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-12-04 16:26 - 2012-08-01 17:55 - 00780976 _____ C:\windows\system32\perfh010.dat

2013-12-04 16:26 - 2012-08-01 17:55 - 00152608 _____ C:\windows\system32\perfc010.dat

2013-12-04 16:26 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat

2013-12-04 16:26 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat

2013-12-04 16:26 - 2012-07-26 08:28 - 04568320 _____ C:\windows\system32\PerfStringBackup.INI

2013-12-04 16:21 - 2013-01-30 03:47 - 00018966 _____ C:\windows\PFRO.log

2013-12-04 16:21 - 2012-07-26 09:12 - 00000000 ____D C:\windows\IME

2013-12-04 16:21 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI

2013-12-04 06:26 - 2013-12-04 06:26 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Eike Koopamann\Desktop\mbar-1.07.0.1007.exe

2013-12-03 23:30 - 2013-12-03 23:29 - 00014294 _____ C:\Users\Eike Koopamann\Downloads\Addition.txt

2013-12-03 23:30 - 2013-12-03 23:28 - 00029870 _____ C:\Users\Eike Koopamann\Downloads\FRST.txt

2013-12-03 23:28 - 2013-12-03 23:28 - 00000000 ____D C:\FRST

2013-12-03 23:27 - 2013-12-03 23:27 - 01959614 _____ (Farbar) C:\Users\Eike Koopamann\Downloads\FRST64.exe

2013-12-03 22:38 - 2013-12-03 22:38 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-12-03 22:38 - 2013-12-03 18:28 - 00001942 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-12-03 18:28 - 2013-12-03 18:28 - 00000000 ____D C:\ProgramData\McAfee

2013-12-03 18:28 - 2013-12-03 18:27 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Local\Adobe

2013-12-03 18:28 - 2013-08-16 15:07 - 00003772 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-30 19:22 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent

2013-11-29 19:14 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ToastData

2013-11-29 08:03 - 2012-07-26 08:21 - 00027869 _____ C:\windows\setupact.log

2013-11-27 21:41 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\NDF

2013-11-27 15:30 - 2013-11-27 15:25 - 00000000 ____D C:\Users\Eike Koopamann\Desktop\28.11.2013

2013-11-26 11:26 - 2013-08-18 20:50 - 00000000 ____D C:\windows\system32\MRT

2013-11-26 11:23 - 2013-08-18 20:50 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-11-25 19:49 - 2013-11-25 19:49 - 00329024 _____ C:\windows\system32\FNTCACHE.DAT

2013-11-25 19:45 - 2013-08-13 20:57 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys

2013-11-25 19:45 - 2013-08-13 20:57 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys

2013-11-19 21:19 - 2013-08-11 18:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-16 09:58 - 2013-11-16 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-16 09:33 - 2013-11-09 17:07 - 104513208 _____ C:\windows\SysWOW64\ᶩ꫋LÃ

2013-11-13 19:17 - 2013-08-21 17:15 - 00000000 ____D C:\Program Files (x86)\ElsterFormular

2013-11-13 19:17 - 2013-08-11 17:49 - 00000000 ____D C:\Users\Eike Koopamann

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_wpdcomp_01_11_00.Wdf

2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_ccdcmbx64_01009.Wdf

2013-11-09 17:08 - 2013-11-09 17:08 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

2013-11-08 22:47 - 2013-11-08 18:43 - 00000000 ____D C:\windows\CD09642E061D4844BA37ED1480916404.TMP

2013-11-08 18:45 - 2013-11-08 18:45 - 00000000 _____ C:\autoexec.bat

2013-11-08 18:41 - 2013-11-08 18:41 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Eike Koopamann\Downloads\SpyHunter-Installer.exe

2013-11-08 17:56 - 2013-11-08 17:56 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Users\Eike Koopamann\AppData\Roaming\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 17:56 - 2013-11-08 17:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 17:55 - 2013-11-08 17:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eike Koopamann\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-05 23:58 - 2013-11-19 21:21 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-05 23:58 - 2013-11-19 21:21 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
 

Some content of TEMP:

====================

C:\Users\Eike Koopamann\AppData\Local\Temp\avgnt.exe

C:\Users\Eike Koopamann\AppData\Local\Temp\Quarantine.exe

C:\Users\Eike Koopamann\AppData\Local\Temp\SHSetup.exe

C:\Users\Eike Koopamann\AppData\Local\Temp\uninst1.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-11-29 08:11
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-12-2013

Ran by Eike Koopamann at 2013-12-05 06:42:43

Running from C:\Users\Eike Koopamann\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152)

Avira Free Antivirus (x32 Version: 14.0.1.749)

Classic Shell (Version: 3.6.8)

ElsterFormular (x32 Version: 14.4.12044)

Intel AppUp(R) center (x32 Version: 3.8.0.41663.61)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2875)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149)

Intel® Trusted Connect Service Client (Version: 1.24.388.1)

LibreOffice 4.1.0.4 (x32 Version: 4.1.0.4)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

McAfee Security Scan Plus (Version: 3.8.130.10)

Microsoft Office (x32 Version: 15.0.4420.1017)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

MozBackup 1.5.1 (x32)

Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)

Mozilla Maintenance Service (x32 Version: 25.0.1)

Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)

Nokia Connectivity Cable Driver (Version: 7.1.32.69)

PDF24 Creator 5.7.0 (x32)

Premium Sound HD (Version: 1.12.6000)

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802)

Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6794)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136)

Realtek WLAN Driver (x32 Version: 2.00.0020)

Shared C Run-time for x64 (Version: 10.0.0)

Synaptics Pointing Device Driver (Version: 16.3.4.0)

TOSHIBA Desktop Assist (Version: 1.00.08.6402)

TOSHIBA eco Utility (Version: 2.0.0.6415)

TOSHIBA Function Key (Version: 1.00.6626.6410)

TOSHIBA Manuals (x32 Version: 10.10)

TOSHIBA Password Utility (x32 Version: 2.00.973)

TOSHIBA PC Health Monitor (Version: 1.8.17.640104)

TOSHIBA Recovery Media Creator (x32 Version: 2.2.1.54043006)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00)

TOSHIBA Service Station (Version: 2.4.4)

TOSHIBA System Driver (x32 Version: 1.00.0015)

TOSHIBA System Settings (x32 Version: 1.00.0002.32002)

Toshiba TEMPRO (x32 Version: 4.3.3)

TOSHIBA VIDEO PLAYER (Version: 5.1.0.21-A)

Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3)
 

==================== Restore Points  =========================
 

19-11-2013 18:06:04 Windows Update

26-11-2013 10:21:21 Windows Update

04-12-2013 15:17:51 Malwarebytes Anti-Rootkit Restore Point
 

==================== Hosts content: ==========================
 

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {0A1CB763-BDC3-40BF-87B4-F1AE0CAA5020} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)

Task: {1FCD2161-F8D6-4A23-A1DF-3742FE23B9BF} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-11-29] (Synaptics Incorporated)

Task: {8260E436-41C8-4649-9C17-44C4E45025A4} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)

Task: {C15F0BA4-27D9-4E4F-8A09-8D5E3E97F1A7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-03] (Adobe Systems Incorporated)

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {CEF8B262-C34A-4992-B98E-8B950462793E} - \Desk 365 RunAsStdUser No Task File

Task: {D05BB670-0127-4A61-84A2-A78EB39027B7} - System32\Tasks\Microsoft\Windows\Setup\Windows Upgrade Notification Task => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)

Task: {EE327E2B-FAFF-4880-B399-0CE2667FA2CC} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-01-29 20:09 - 2012-11-01 14:43 - 00175008 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4396.1016_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll

2012-10-26 00:24 - 2012-10-24 06:44 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-07-19 02:38 - 2012-07-19 02:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll

2012-07-19 02:38 - 2012-07-19 02:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll

2012-08-14 03:13 - 2012-08-14 03:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll

2013-08-28 21:16 - 2013-08-28 21:16 - 01179136 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.UI\9fbc5975a21c5638ba05f81b9febfaee\Windows.UI.ni.dll

2013-11-09 17:30 - 2013-11-09 17:30 - 00351232 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Data\967740f7ed74ebe361d82cba59a694b2\Windows.Data.ni.dll

2013-08-28 21:16 - 2013-08-28 21:16 - 00295936 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\14050be959443e89237e6c9136ea8e5e\Windows.Foundation.ni.dll

2013-08-11 10:19 - 2013-08-13 21:14 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2013-05-09 17:01 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2013-11-16 09:58 - 2013-11-16 09:58 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/04/2013 06:26:48 PM) (Source: ESENT) (User: )

Description: taskhostex (3128) Versuch, Datei "C:\Users\Eike Koopamann\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 

Error: (12/04/2013 06:33:27 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (12/03/2013 06:14:33 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (12/02/2013 05:07:01 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (12/02/2013 04:36:43 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/30/2013 08:09:39 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/29/2013 11:25:36 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/28/2013 05:27:27 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (11/28/2013 02:24:07 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: TCrdMain_Win8.exe, Version: 2.0.7.64, Zeitstempel: 0x5091827a

Name des fehlerhaften Moduls: SynCOM.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x50b86421

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000000001001f368

ID des fehlerhaften Prozesses: 0xdb0

Startzeit der fehlerhaften Anwendung: 0xTCrdMain_Win8.exe0

Pfad der fehlerhaften Anwendung: TCrdMain_Win8.exe1

Pfad des fehlerhaften Moduls: TCrdMain_Win8.exe2

Berichtskennung: TCrdMain_Win8.exe3

Vollständiger Name des fehlerhaften Pakets: TCrdMain_Win8.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: TCrdMain_Win8.exe5
 

Error: (11/27/2013 11:03:27 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 
 

System errors:

=============

Error: (12/04/2013 06:20:48 PM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)

Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x80080005
 

Error: (12/04/2013 06:20:48 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
 

Error: (12/04/2013 05:13:18 PM) (Source: mbamchameleon) (User: )

Description: \Device\HarddiskVolume4\PROGRAM FILES\MCAFEE SECURITY SCAN\3.8.130\SSSCHEDULER.EXE
 

Error: (12/04/2013 05:13:08 PM) (Source: mbamchameleon) (User: )

Description: C01C0005
 

Error: (12/04/2013 05:13:08 PM) (Source: mbamchameleon) (User: )

Description: C01C0005
 

Error: (12/04/2013 05:08:49 PM) (Source: mbamchameleon) (User: )

Description: \Device\HarddiskVolume4\PROGRAM FILES (X86)\AVIRA\ANTIVIR DESKTOP\AVWSC.EXE
 

Error: (12/04/2013 05:08:49 PM) (Source: mbamchameleon) (User: )

Description: \??\C:\Program Files (x86)\Avira\AntiVir Desktop\avwsc.exe
 

Error: (12/04/2013 04:58:48 PM) (Source: mbamchameleon) (User: )

Description: \Device\HarddiskVolume4\PROGRAM FILES (X86)\AVIRA\ANTIVIR DESKTOP\AVWSC.EXE
 

Error: (12/04/2013 04:58:48 PM) (Source: mbamchameleon) (User: )

Description: \??\C:\Program Files (x86)\Avira\AntiVir Desktop\avwsc.exe
 

Error: (12/04/2013 04:48:47 PM) (Source: mbamchameleon) (User: )

Description: \Device\HarddiskVolume4\PROGRAM FILES (X86)\AVIRA\ANTIVIR DESKTOP\AVWSC.EXE
 
 

Microsoft Office Sessions:

=========================

Error: (12/04/2013 06:26:48 PM) (Source: ESENT)(User: )

Description: taskhostex3128C:\Users\Eike Koopamann\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
 

Error: (12/04/2013 06:33:27 AM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (12/03/2013 06:14:33 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (12/02/2013 05:07:01 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (12/02/2013 04:36:43 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/30/2013 08:09:39 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/29/2013 11:25:36 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/28/2013 05:27:27 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (11/28/2013 02:24:07 PM) (Source: Application Error)(User: )

Description: TCrdMain_Win8.exe2.0.7.645091827aSynCOM.dll_unloaded0.0.0.050b86421c0000005000000001001f368db001ceec13a1814e2cC:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exeSynCOM.dll5b17c310-5830-11e3-be8b-24fd5215b36f
 

Error: (11/27/2013 11:03:27 AM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 38%

Total physical RAM: 3979.21 MB

Available physical RAM: 2431.66 MB

Total Pagefile: 4683.21 MB

Available Pagefile: 2866.72 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (TI31051200A) (Fixed) (Total:286.89 GB) (Free:249.4 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type

==================== End Of Log ============================

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.12.05.04
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16736

Eike Koopamann :: EIKE [Administrator]
 

05.12.2013 16:26:01

mbam-log-2013-12-05 (16-26-01).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 204950

Laufzeit: 4 Minute(n), 37 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 3

C:\Users\Eike Koopamann\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.22.0 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 8

C:\Users\Eike Koopamann\AppData\Local\Temp\A2F9373B-BAB0-7891-8A4B-5A2423DC6FD7\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\A2F9373B-BAB0-7891-8A4B-5A2423DC6FD7\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\A2F9373B-BAB0-7891-8A4B-5A2423DC6FD7\ccp.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\A2F9373B-BAB0-7891-8A4B-5A2423DC6FD7\CrxInstaller.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\A2F9373B-BAB0-7891-8A4B-5A2423DC6FD7\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\A2F9373B-BAB0-7891-8A4B-5A2423DC6FD7\MyDeltaTB.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\A2F9373B-BAB0-7891-8A4B-5A2423DC6FD7\NTRedirect.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Eike Koopamann\AppData\Local\Temp\A2F9373B-BAB0-7891-8A4B-5A2423DC6FD7\Setup.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Nur Blödsinn in TEMP.
Was ist mit ESET?

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=cfd0e1f5f6c872488d66e365b74a5b96

# engine=16163

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-12-06 01:47:14

# local_time=2013-12-06 02:47:14 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.2.9200 NT 

# compatibility_mode=1799 16775165 100 96 8941 157012539 1707 0

# compatibility_mode=5893 16776574 100 94 163875 33234055 0 0

# scanned=211012

# found=4

# cleaned=0

# scan_time=4932

sh=42BE14A1364480B439C0FC2592A4BB86E04F4219 ft=1 fh=23eba6a0d8026998 vn="probably a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Betcat\WebCakeIEClient.dll.vir"

sh=759D415B53185628CA25492523A5B2BC7E562D4A ft=1 fh=2db2a80633ac8466 vn="probably a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll.vir"

sh=1DDC39E810FA90F8B11DFE07640EC359F66FC1FC ft=1 fh=f2284be2c764232b vn="multiple threats" ac=I fn="C:\Users\Eike Koopamann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USVLQ78W\WebCakesetup[1].exe"

sh=96C0D8FAE0FA351F8ED8FFAAE02A7D6EB4BAD4AD ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.C application" ac=I fn="C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\extensions\plugins@getwebcake.com.xpi"

Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop:
SystemLook (32 bit) | SystemLook (64 bit)

Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

:folderfind *webcake* :filefind *webcake* :regfind webcake
Klicke nun auf den Button Look, um den Scan zu starten.
Der Suchlauf kann einige Zeit dauern.
Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
Die Ergebnisse werden auch auf dem Desktop als SystemLook.txt gespeichert.

Code:

SystemLook 30.07.11 by jpshortstuff

Log created at 18:13 on 06/12/2013 by Eike Koopamann

Administrator - Elevation successful
 

========== folderfind ==========
 

Searching for "*webcake*"

C:\Users\Eike Koopamann\AppData\Local\Temp\DM\avira-premium-security-suite.exe\cadc4507a4b34fa48e24a78ed57c3f98\bin\Webcake        d------        [17:01 11/08/2013]
 

========== filefind ==========
 

Searching for "*webcake*"

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Betcat\WebCakeIEClient.dll.vir        --a---- 202008 bytes        [08:20 09/11/2013]        [08:20 09/11/2013] 561A8D9A979E28644D33F48C32A24010

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Tepfel\WebCakeDesktop.Updater.exe.vir        --a---- 51992 bytes        [17:03 11/08/2013]        [01:24 10/08/2013] 7D66C7460240C5FA7DA4E775DF9FF328

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Tepfel\WebCakeDesktop.Updater.InstallState.vir        --a---- 5012 bytes        [17:03 11/08/2013]        [17:03 11/08/2013] 02470B8CB92C619455756E930E53AD86

C:\AdwCleaner\Quarantine\C\Users\Eike Koopamann\AppData\Roaming\Tepfel\WebCakeDesktop.exe.vir        --a---- 52504 bytes        [17:03 11/08/2013]        [01:24 10/08/2013] 918007C1311C833B58F50B59B454266D

C:\Users\Eike Koopamann\AppData\Local\Microsoft\Internet Explorer\DOMStore\7HOH9NBB\www-cdn.getwebcake[1].xml        --a---- 13 bytes        [09:15 11/08/2013]        [09:15 11/08/2013] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5

C:\Users\Eike Koopamann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USVLQ78W\WebCakesetup[1].exe        --a---- 1238592 bytes        [17:02 11/08/2013]        [17:02 11/08/2013] 3750C85D1D1840C9079C3920898A6556

C:\Users\Eike Koopamann\AppData\Local\Temp\DM\avira-premium-security-suite.exe\cadc4507a4b34fa48e24a78ed57c3f98\bin\css\webcake.css        --a---- 1044 bytes        [10:53 22/05/2013]        [10:53 22/05/2013] 8E157F344A2593909D3FA43A11FB7536

C:\Users\Eike Koopamann\AppData\Local\Temp\DM\avira-premium-security-suite.exe\cadc4507a4b34fa48e24a78ed57c3f98\software\Webcake.exe        --a---- 272128 bytes        [17:02 11/08/2013]        [17:02 11/08/2013] FB58CA29357D25ECD447E79F61B03B67

C:\Users\Eike Koopamann\AppData\Local\Temp\DM\avira-premium-security-suite.exe\cadc4507a4b34fa48e24a78ed57c3f98\temp\Webcakeinfo.dfe        --a---- 682 bytes        [17:01 11/08/2013]        [17:01 11/08/2013] 8AD08E84C4BA3F9CB0B88F93BFEA691F

C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\extensions\plugins@getwebcake.com.xpi        --a---- 18508 bytes        [18:21 30/11/2013]        [18:21 30/11/2013] F5B61190DCF079901623E83377ED11A5

C:\Windows\Prefetch\WEBCAKE-0944.EXE-307BD17E.pf        --a---- 54496 bytes        [17:03 11/08/2013]        [17:03 11/08/2013] 50C3FE61071146791B2A55C190317352
 

========== regfind ==========
 

Searching for "webcake"

[HKEY_CURRENT_USER\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.Updater.exe]

[HKEY_USERS\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.exe]

[HKEY_USERS\S-1-5-18\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.Updater.exe]
 

-= EOF =-

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\Eike Koopamann\AppData\Local\Microsoft\Internet Explorer\DOMStore\7HOH9NBB\www-cdn.getwebcakereg: reg delete"1].xml

C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\extensions\plugins@getwebcake.com.xpi

C:\Windows\Prefetch\WEBCAKE-0944.EXE-307BD17E.pf

reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.exe" /f

reg: reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.Updater.exe" /f

reg: reg delete "HKEY_USERS\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.exe" /f

reg: reg delete "HKEY_USERS\S-1-5-18\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.Updater.exe" /f

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Darf ich fragen, was mein Laptop für Probleme hat und wielange dauert so eine Prozedur?
Also die doppelt unterstrichenen Wörter sind zumindest schonmal weg.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-12-2013 01

Ran by Eike Koopamann at 2013-12-07 12:22:12 Run:2

Running from C:\Users\Eike Koopamann\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

C:\Users\Eike Koopamann\AppData\Local\Microsoft\Internet Explorer\DOMStore\7HOH9NBB\www-cdn.getwebcakereg: reg delete"1].xml

C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\extensions\plugins@getwebcake.com.xpi

C:\Windows\Prefetch\WEBCAKE-0944.EXE-307BD17E.pf

reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.exe" /f

reg: reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.Updater.exe" /f

reg: reg delete "HKEY_USERS\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.exe" /f

reg: reg delete "HKEY_USERS\S-1-5-18\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.Updater.exe" /f

         

*****************
 

"C:\Users\Eike Koopamann\AppData\Local\Microsoft\Internet Explorer\DOMStore\7HOH9NBB\www-cdn.getwebcakereg: reg delete1].xml" => File/Directory not found.
 

========= C:\Users\Eike Koopamann\AppData\Local\Microsoft\Internet Explorer\DOMStore\7HOH9NBB\www-cdn.getwebcakereg delete"1].xml =========
 
 
 

========= End of Reg: =========
 

C:\Users\Eike Koopamann\AppData\Roaming\Mozilla\Firefox\Profiles\nvxyvzwz.default\extensions\plugins@getwebcake.com.xpi => Moved successfully.

C:\Windows\Prefetch\WEBCAKE-0944.EXE-307BD17E.pf => Moved successfully.
 

========= reg delete "HKEY_CURRENT_USER\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.exe" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.Updater.exe" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKEY_USERS\S-1-5-21-3149299854-2721699910-2777857454-1001\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.exe" /f =========
 

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.
 
 

========= End of Reg: =========
 
 

========= reg delete "HKEY_USERS\S-1-5-18\Software\Microsoft\.NETFramework\SQM\Apps\WebCakeDesktop.Updater.exe" /f =========
 

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.
 
 

========= End of Reg: =========
 
 

==== End of Fixlog ====

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.12.07.06
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16736

Eike Koopamann :: EIKE [Administrator]
 

07.12.2013 19:23:40

mbam-log-2013-12-07 (19-23-40).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 205210

Laufzeit: 4 Minute(n), 26 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=cfd0e1f5f6c872488d66e365b74a5b96

# engine=16178

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-12-07 06:37:34

# local_time=2013-12-07 07:37:34 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.2.9200 NT 

# compatibility_mode=1799 16775165 100 96 29552 157116359 22319 0

# compatibility_mode=5893 16776574 100 94 264095 33337875 0 0

# scanned=31537

# found=3

# cleaned=0

# scan_time=368

sh=42BE14A1364480B439C0FC2592A4BB86E04F4219 ft=1 fh=23eba6a0d8026998 vn="probably a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Betcat\WebCakeIEClient.dll.vir"

sh=759D415B53185628CA25492523A5B2BC7E562D4A ft=1 fh=2db2a80633ac8466 vn="probably a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll.vir"

sh=96C0D8FAE0FA351F8ED8FFAAE02A7D6EB4BAD4AD ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.C application" ac=I fn="C:\FRST\Quarantine\plugins@getwebcake.com.xpi"

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=cfd0e1f5f6c872488d66e365b74a5b96

# engine=16178

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-12-07 09:53:44

# local_time=2013-12-07 10:53:44 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.2.9200 NT 

# compatibility_mode=1799 16775165 100 96 41322 157128129 34089 0

# compatibility_mode=5893 16776574 100 94 275865 33349645 0 0

# scanned=212433

# found=4

# cleaned=0

# scan_time=11658

sh=42BE14A1364480B439C0FC2592A4BB86E04F4219 ft=1 fh=23eba6a0d8026998 vn="probably a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Betcat\WebCakeIEClient.dll.vir"

sh=759D415B53185628CA25492523A5B2BC7E562D4A ft=1 fh=2db2a80633ac8466 vn="probably a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll.vir"

sh=96C0D8FAE0FA351F8ED8FFAAE02A7D6EB4BAD4AD ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.C application" ac=I fn="C:\FRST\Quarantine\plugins@getwebcake.com.xpi"

sh=1DDC39E810FA90F8B11DFE07640EC359F66FC1FC ft=1 fh=f2284be2c764232b vn="multiple threats" ac=I fn="C:\Users\Eike Koopamann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USVLQ78W\WebCakesetup[1].exe"

Nur Müllreste, bitte TFC ausführen:

TFC - Temp File Cleaner

Lade dir

TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

Öffne die TFC.exe.
Vista und Win 7 User mit Rechtsklick "als Administrator starten".
Schließe alle anderen Programme.
Drücke auf den Button Start.
Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Ich danke Dir für Deine Unterstützung!

Dann wären wir durch! :daumenhoc

Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden.

Helfen kann dir dabei delfix:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.