Trojaner-Board
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   PC fährt ständig runter (https://www.trojaner-board.de/148883-pc-faehrt-staendig-runter.html)

schrauber 07.02.2014 17:21
da is en bissl mehr Arbeit :)

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

whismerhill 07.02.2014 17:52
das habe ich befürchtet :balla: das mit der mehr Arbeit :lach:
bevor ich Combofix schicke ein kurzes Update von dem Runterfahrer-Pc (wobei das eigentlich quatsch ist..er fährt nicht runter, sondern stürzt einfach ab)..heute zwischen 15.30 Uhr und 16 Uhr war es wieder soweit..war leider nicht im Raum, als ich wieder zurück kam, war PC off..beim hochfahren dann Meldung, dass PC nicht ordnungsgemäß runtergefahren wurde und evtl. wegen Virengefahr etc etc..(die Eingabemaske, die fragt ob man im abgesicherten Modus etc. weitermachen möchte)..ansonsten läuft er rund..versteh ich nur nicht..

hier die Combo
Code:
ComboFix 14-02-05.02 - Marc 07.02.2014  17:35:28.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.49.1031.18.2046.1119 [GMT 1:00]
ausgeführt von:: c:\users\Marc\Downloads\ComboFix.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-01-07 bis 2014-02-07  ))))))))))))))))))))))))))))))
.
.
2014-02-07 16:43 . 2014-02-07 16:43        --------        d-----w-        c:\users\Supermama\AppData\Local\temp
2014-02-07 16:43 . 2014-02-07 16:43        --------        d-----w-        c:\users\Public\AppData\Local\temp
2014-02-07 16:43 . 2014-02-07 16:43        --------        d-----w-        c:\users\Lucky Luke\AppData\Local\temp
2014-02-07 16:43 . 2014-02-07 16:43        --------        d-----w-        c:\users\IUSR_NMPR\AppData\Local\temp
2014-02-07 16:43 . 2014-02-07 16:43        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-02-06 19:48 . 2014-02-06 19:49        --------        d-----w-        C:\FRST
2014-02-01 00:45 . 2014-02-01 00:45        --------        d-----w-        C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 00:44 . 2014-02-01 01:42        --------        d-----w-        C:\bcc267867ba709c6bf7f1ea357
2014-01-31 22:22 . 2014-02-01 00:04        --------        d-----w-        C:\8de10754d4fd5dcb8a1c806fef28
2014-01-27 16:03 . 2014-01-27 16:03        --------        d-----w-        c:\users\Marc\Interview_GESAMT_data
2014-01-23 20:41 . 2014-01-23 20:41        --------        d-----w-        c:\users\Marc\AppData\Roaming\DivX
2014-01-23 20:40 . 2014-01-23 20:41        --------        d-----w-        c:\program files\Common Files\DivX Shared
2014-01-23 20:39 . 2014-01-23 20:39        --------        d-----w-        c:\users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 20:37 . 2014-01-23 20:37        --------        d-----w-        c:\users\Marc\AppData\Roaming\FoxTab
2014-01-23 20:37 . 2014-01-23 20:37        --------        d-----w-        c:\program files\Foxtab
2014-01-23 20:05 . 2014-01-23 20:05        --------        d-----w-        c:\users\Marc\Interview_data
2014-01-11 15:36 . 2014-01-27 21:13        --------        d-----w-        c:\users\Marc\AppData\Roaming\Audacity
2014-01-11 15:34 . 2014-01-11 15:34        --------        d-----w-        c:\program files\Audacity
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-18 06:11 . 2013-12-18 06:11        354656        ----a-w-        c:\windows\system32\DivXControlPanelApplet.cpl
2013-12-11 20:05 . 2013-08-08 18:10        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2013-12-11 20:05 . 2013-08-08 18:10        692616        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2011-01-13 1232896]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"="FactoryMode" [X]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-06-14 178968]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 71176]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"UIExec"="c:\program files\1&1 Surf-Stick\UIExec.exe" [2010-09-30 139088]
"AVMWlanClient"="c:\program files\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"DivXMediaServer"="c:\program files\DivX\DivX Media Server\DivXMediaServer.exe" [2013-12-23 450560]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2013-11-15 1861968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-04-03 44168]
.
c:\users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2008-07-30 277736]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
mgisvr
veteboot
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-18 22:00]
.
2014-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-18 22:00]
.
2014-02-07 c:\windows\Tasks\User_Feed_Synchronization-{8FF0CDE9-A183-482B-A8CB-7957D06F595F}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\Marc\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\users\Marc\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: Interfaces\{652F5BCA-6159-4E8A-A1E7-EE95D0B5CD28}: NameServer = 192.168.178.1,217.237.151.115
FF - ProfilePath - c:\users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\
FF - prefs.js: browser.startup.homepage - www.ixquick.de
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2014-01-23 21:37; {5ebdca98-43b3-45bb-87e0-716029fb42ab}; c:\users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\extensions\{5ebdca98-43b3-45bb-87e0-716029fb42ab}
FF - ExtSQL: !HIDDEN! 2011-03-11 22:07; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: extensions.irspeeddial.aflt - fxtb103
FF - user.js: extensions.irspeeddial.instlRef -
FF - user.js: extensions.irspeeddial.cr - 458284709
FF - user.js: extensions.irspeeddial.cd - 2XzuyEtN2Y1L1Qzu0B0CtDyDyEtAtDtByE0FzytCzytByCyDtN0D0Tzu0SyByDyEtN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1Czu1G2Z1S
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-02-07 17:43
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft TabStrip Control 6.0 (SP4)"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft ImageList Control 6.0 (SP4)"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft ProgressBar Control 6.0 (SP4)"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft Toolbar Control 6.0 (SP4)"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft StatusBar Control 6.0 (SP4)"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft ListView Control 6.0 (SP4)"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="TreeView General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="TabStrip General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Tab Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="ImageList General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Image Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Toolbar General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Button Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="StatusBar General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Panel Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Progress Bar General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Slider General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Slider Appearance Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="ListView General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="ListView Sort Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="ListView Images Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="ListView Columns Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="ImageComboBox General Property Page Object"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft TreeView Control 6.0 (SP4)"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft ImageComboBox Control 6.0 (SP4)"
.
[HKEY_USERS\S-1-5-21-3822891451-4067332824-1385818742-1001_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}]
@DACL=(02 0000)
@="Microsoft Slider Control 6.0 (SP4)"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(472)
c:\users\Marc\AppData\Roaming\LavFilters\swscale-lav-2.dll
c:\windows\system32\pnidui.dll
.
Zeit der Fertigstellung: 2014-02-07  17:47:40
ComboFix-quarantined-files.txt  2014-02-07 16:47
ComboFix2.txt  2013-06-11 14:29
.
Vor Suchlauf: 22 Verzeichnis(se), 162.449.223.680 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 162.557.800.448 Bytes frei
.
- - End Of File - - E59D313630F355DCB003111884F27A40
8913823FF508CCF109DB74B636C301DA
Lg und Danke mal wieder zwischendurch
whis

schrauber 08.02.2014 13:19
Der runterfahr-PC ist der erste aus dem Thema? Schau mal bitte in die Ereignisanzeige ob da mehr Info steht.


für diesen:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

whismerhill 08.02.2014 14:21
Liste der Anhänge anzeigen (Anzahl: 1)
Hi Schrauber,
ja..es handelte sich um den ersten PC...Ereignisanzeige war nicht so aufschlussreich..jetzt weiss ich zwar wann er genau abgeschmiert ist..aber zu dem besagten Zeitpunkt wurde kein Ereignis gemeldet..Screenshot ist angehängt..
soll ich evtl. mit dem Programm Bluescreenview weitermachen?
hxxp://www.tippscout.de/windows-absturz-ursache_tipp_4568.html

hier logs zum 2. PC
Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.08.04

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.16982
Marc :: MARC-PC [Administrator]

08.02.2014 13:49:02
mbam-log-2014-02-08 (13-49-02).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 286700
Laufzeit: 7 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Digital Sites (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0J1L2U1C1H1Q0R2X1L1R1P0B1P -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 8
C:\Users\Marc\Downloads\7ZipSetup.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\Downloads\SoftonicDownloader_fuer_mp3directcut.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Supermama\Downloads\Adobe Flash Player 11.exe (PUP.Optional.Solimba) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\config.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\prod.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
AdwC-log
Code:
# AdwCleaner v3.018 - Bericht erstellt am 08/02/2014 um 14:26:35
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium  (32 bits)
# Benutzername : Marc - MARC-PC
# Gestartet von : C:\Users\Marc\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{5EBDCA98-43B3-45BB-87E0-716029FB42AB}
Datei Gelöscht : C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\user.js
Datei Gelöscht : C:\Users\Lucky Luke\AppData\Roaming\Mozilla\Firefox\Profiles\y0cm0236.default\user.js
Datei Gelöscht : C:\Users\Supermama\AppData\Roaming\Mozilla\Firefox\Profiles\a4ddhw0f.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Codec Package Packages

***** [ Browser ] *****

-\\ Internet Explorer v7.0.6000.16982


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\prefs.js ]


[ Datei : C:\Users\Lucky Luke\AppData\Roaming\Mozilla\Firefox\Profiles\y0cm0236.default\prefs.js ]


[ Datei : C:\Users\Supermama\AppData\Roaming\Mozilla\Firefox\Profiles\a4ddhw0f.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [2104 octets] - [08/02/2014 14:24:01]
AdwCleaner[S0].txt - [2025 octets] - [08/02/2014 14:26:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2085 octets] ##########
Rest in nächster Antwort :-)
Lg whis

whismerhill 08.02.2014 14:33
und hier noch JRT
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Marc on 08.02.2014 at 14:30:29,34
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2495F679-868B-4542-845F-2BADFDAADCA8}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2495F679-868B-4542-845F-2BADFDAADCA8}



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Marc\AppData\Roaming\mozilla\firefox\profiles\tfe7389y.default\prefs.js

user_pref("browser.startup.homepage", "www.ixquick.de");
Emptied folder: C:\Users\Marc\AppData\Roaming\mozilla\firefox\profiles\tfe7389y.default\minidumps [29 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.02.2014 at 14:32:54,22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und FRST

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-02-2014
Ran by Marc (administrator) on MARC-PC on 08-02-2014 14:36:26
Running from C:\Users\Marc\Downloads
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal



==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanNetService.exe
(Apple Computer, Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(OsdMaestro) C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Skype Technologies) C:\Program Files\Skype\Plugin Manager\skypePM.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Hewlett-Packard Company) C:\hp\KBD\kbd.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2007-04-18] (Hewlett-Packard Company)
HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
HKLM\...\Run: [OsdMaestro] - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [118784 2007-02-15] (OsdMaestro)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178968 2007-06-14] (Intel Corporation)
HKLM\...\Run: [StartCCC] - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [CCUTRAYICON] - FactoryMode
HKLM\...\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [71176 2007-05-24] (Hewlett-Packard)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [UIExec] - C:\Program Files\1&1 Surf-Stick\UIExec.exe [139088 2010-09-30] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Run: [SunJavaUpdateReg] - C:\Windows\system32\jureg.exe [54936 2007-04-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [DivXMediaServer] - C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-12-23] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2013-11-15] ()
HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44168 2007-04-03] (soft thinks)
HKU\S-1-5-21-3822891451-4067332824-1385818742-1001\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [15026056 2011-01-26] (Skype Technologies S.A.)
Startup: C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Supermama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {B5719E69-3067-4694-B05B-13687A8B9D40} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie7chrome
SearchScopes: HKCU - {42C5AAAE-C0EA-4047-857B-0EAAFAE8B84F} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {B5719E69-3067-4694-B05B-13687A8B9D40} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie7chrome
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [227328] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [94208] (Apple Computer, Inc.)
Tcpip\..\Interfaces\{652F5BCA-6159-4E8A-A1E7-EE95D0B5CD28}: [NameServer]192.168.178.1,217.237.151.115

FireFox:
========
FF ProfilePath: C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npdeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-09-02]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-01-30]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] ()
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [61440 2007-05-24] (Hewlett-Packard)
S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation)
S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation)
S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-08-31] ()
S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation)
S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [253264 2010-09-30] ()
S2 mgisvr; %systemroot%\system32\AR5523.dll [X]
S4 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [X]
S2 veteboot; %systemroot%\system32\diskeeper.dll [X]

==================== Drivers (Whitelisted) ====================

R2 ACEDRV07; C:\Windows\system32\drivers\ACEDRV07.sys [101376 2009-01-08] (Protect Software GmbH)
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [277736 2008-07-30] (Protect Software GmbH)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-10-09] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-10-09] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [22016 2006-11-02] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Marc\AppData\Local\Temp\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

NETSVC: mgisvr -> C:\Windows\system32\AR5523.dll ==> No File.
NETSVC: veteboot -> C:\Windows\system32\diskeeper.dll ==> No File.

==================== One Month Created Files and Folders ========

2014-02-08 14:32 - 2014-02-08 14:32 - 00001355 _____ () C:\Users\Marc\Desktop\JRT.txt
2014-02-08 14:30 - 2014-02-08 14:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-08 14:29 - 2014-02-08 14:30 - 01037530 _____ (Thisisu) C:\Users\Marc\Downloads\JRT.exe
2014-02-08 14:23 - 2014-02-08 14:26 - 00000000 ____D () C:\AdwCleaner
2014-02-08 14:23 - 2014-02-08 14:23 - 01166132 _____ () C:\Users\Marc\Downloads\adwcleaner.exe
2014-02-08 13:35 - 2014-02-08 13:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-07 17:47 - 2014-02-07 17:47 - 00014674 _____ () C:\ComboFix.txt
2014-02-07 17:30 - 2014-02-07 17:47 - 00000000 ____D () C:\ComboFix
2014-02-07 17:28 - 2014-02-07 17:29 - 05180173 ____R (Swearware) C:\Users\Marc\Downloads\ComboFix.exe
2014-02-06 20:48 - 2014-02-08 14:36 - 00013006 _____ () C:\Users\Marc\Downloads\FRST.txt
2014-02-06 20:48 - 2014-02-08 14:36 - 00000000 ____D () C:\FRST
2014-02-06 20:48 - 2014-02-06 20:49 - 00032060 _____ () C:\Users\Marc\Downloads\Addition.txt
2014-02-06 20:47 - 2014-02-06 20:47 - 01136640 _____ (Farbar) C:\Users\Marc\Downloads\FRST.exe
2014-02-01 01:45 - 2014-02-01 02:03 - 00196608 _____ () C:\Windows\SPInstall.etl
2014-02-01 01:45 - 2014-02-01 01:45 - 00000000 ____D () C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 01:44 - 2014-02-01 02:42 - 00000000 ____D () C:\bcc267867ba709c6bf7f1ea357
2014-02-01 01:20 - 2014-02-01 01:34 - 455611504 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB936330-X86-wave0.exe
2014-01-31 23:22 - 2014-02-01 01:04 - 00000000 ____D () C:\8de10754d4fd5dcb8a1c806fef28
2014-01-30 19:51 - 2014-01-30 19:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-27 17:03 - 2014-01-27 21:49 - 00022832 _____ () C:\Users\Marc\Interview_GESAMT.aup
2014-01-27 17:03 - 2014-01-27 17:03 - 00000000 ____D () C:\Users\Marc\Interview_GESAMT_data
2014-01-23 21:41 - 2014-01-23 21:41 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DivX
2014-01-23 21:40 - 2014-01-23 21:41 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-01-23 21:39 - 2014-01-27 18:38 - 00000005 _____ () C:\Users\Marc\AppData\Roaming\WBPU-TTL.DAT
2014-01-23 21:39 - 2014-01-23 21:39 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 21:38 - 2014-02-08 14:13 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DigitalSites
2014-01-23 21:38 - 2014-01-23 21:42 - 00000000 ____D () C:\ProgramData\DivX
2014-01-23 21:38 - 2014-01-23 21:42 - 00000000 ____D () C:\Program Files\DivX
2014-01-23 21:38 - 2014-01-23 21:38 - 00715038 _____ () C:\Windows\unins000.exe
2014-01-23 21:38 - 2014-01-23 21:38 - 00001782 _____ () C:\Windows\unins000.dat
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\LavFilters
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\CDXReader
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Xvid
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\OpenSource Flash Video Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Lame For Audacity
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Haali
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\ffdshow
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DSP-worx
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DirectVobSub
2014-01-23 21:38 - 2012-02-26 16:47 - 00079360 _____ () C:\Windows\system32\ff_vfw.dll
2014-01-23 21:38 - 2012-01-09 20:45 - 00178688 _____ () C:\Windows\system32\unrar.dll
2014-01-23 21:38 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\system32\lagarith.dll
2014-01-23 21:38 - 2011-05-30 14:42 - 00240640 _____ () C:\Windows\system32\xvidvfw.dll
2014-01-23 21:38 - 2011-05-23 10:52 - 00153088 _____ () C:\Windows\system32\xvid.ax
2014-01-23 21:38 - 2011-05-23 08:46 - 00645632 _____ () C:\Windows\system32\xvidcore.dll
2014-01-23 21:37 - 2014-01-27 18:38 - 00000147 _____ () C:\Users\Marc\AppData\Roaming\WB.CFG
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\FoxTab
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Program Files\Foxtab
2014-01-23 21:36 - 2014-01-23 21:36 - 00686024 _____ () C:\Users\Marc\Downloads\CodecPackage.exe
2014-01-23 21:05 - 2014-01-23 21:28 - 00062758 _____ () C:\Users\Marc\Interview.aup
2014-01-23 21:05 - 2014-01-23 21:05 - 00000000 ____D () C:\Users\Marc\Interview_data
2014-01-11 16:43 - 2014-01-11 16:43 - 01477844 _____ () C:\Users\Marc\test 1.wav
2014-01-11 16:36 - 2014-01-27 22:13 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Audacity
2014-01-11 16:34 - 2014-01-11 16:34 - 00000766 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-01-11 16:34 - 2014-01-11 16:34 - 00000000 ____D () C:\Program Files\Audacity
2014-01-11 16:29 - 2014-01-11 16:34 - 22308174 _____ (Audacity Team ) C:\Users\Marc\Desktop\audacity-win-2-0-4.exe

==================== One Month Modified Files and Folders =======

2014-02-08 14:36 - 2014-02-06 20:48 - 00013006 _____ () C:\Users\Marc\Downloads\FRST.txt
2014-02-08 14:36 - 2014-02-06 20:48 - 00000000 ____D () C:\FRST
2014-02-08 14:35 - 2011-01-26 16:46 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{8FF0CDE9-A183-482B-A8CB-7957D06F595F}.job
2014-02-08 14:32 - 2014-02-08 14:32 - 00001355 _____ () C:\Users\Marc\Desktop\JRT.txt
2014-02-08 14:31 - 2007-09-19 03:08 - 01937815 _____ () C:\Windows\WindowsUpdate.log
2014-02-08 14:30 - 2014-02-08 14:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-08 14:30 - 2014-02-08 14:29 - 01037530 _____ (Thisisu) C:\Users\Marc\Downloads\JRT.exe
2014-02-08 14:28 - 2011-02-07 22:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Skype
2014-02-08 14:27 - 2011-12-18 23:00 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-08 14:27 - 2007-09-10 11:31 - 00000000 ____D () C:\Windows\SMINST
2014-02-08 14:27 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-08 14:27 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-08 14:27 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-08 14:26 - 2014-02-08 14:23 - 00000000 ____D () C:\AdwCleaner
2014-02-08 14:26 - 2006-11-02 14:01 - 00032634 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-08 14:23 - 2014-02-08 14:23 - 01166132 _____ () C:\Users\Marc\Downloads\adwcleaner.exe
2014-02-08 14:15 - 2007-09-10 11:33 - 00157328 _____ () C:\Windows\PFRO.log
2014-02-08 14:13 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DigitalSites
2014-02-08 14:13 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-02-08 13:47 - 2011-12-18 23:00 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-08 13:42 - 2013-06-11 17:59 - 00000868 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 13:42 - 2013-06-11 17:59 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-08 13:39 - 2014-02-08 13:35 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 13:29 - 2011-02-07 22:40 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\skypePM
2014-02-07 17:47 - 2014-02-07 17:47 - 00014674 _____ () C:\ComboFix.txt
2014-02-07 17:47 - 2014-02-07 17:30 - 00000000 ____D () C:\ComboFix
2014-02-07 17:47 - 2013-06-11 13:54 - 00000000 ____D () C:\Qoobox
2014-02-07 17:43 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-02-07 17:29 - 2014-02-07 17:28 - 05180173 ____R (Swearware) C:\Users\Marc\Downloads\ComboFix.exe
2014-02-06 20:49 - 2014-02-06 20:48 - 00032060 _____ () C:\Users\Marc\Downloads\Addition.txt
2014-02-06 20:47 - 2014-02-06 20:47 - 01136640 _____ (Farbar) C:\Users\Marc\Downloads\FRST.exe
2014-02-06 20:45 - 2013-06-12 09:10 - 00000000 ____D () C:\Users\Marc\Desktop\Alles
2014-02-06 20:44 - 2011-07-08 12:23 - 00000000 ____D () C:\Users\Marc\Desktop\Sprachdemo
2014-02-01 02:44 - 2011-01-23 15:57 - 00000000 ____D () C:\Users\Supermama
2014-02-01 02:44 - 2008-01-07 23:01 - 00000000 ____D () C:\Users\Lucky Luke
2014-02-01 02:44 - 2007-12-05 23:24 - 00000000 ____D () C:\Users\Marc
2014-02-01 02:44 - 2007-09-10 11:04 - 00000000 ___HD () C:\Users\IUSR_NMPR
2014-02-01 02:44 - 2006-11-02 11:22 - 42467328 _____ () C:\Windows\system32\config\software_previous
2014-02-01 02:44 - 2006-11-02 11:22 - 21757952 _____ () C:\Windows\system32\config\system_previous
2014-02-01 02:43 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\MSN
2014-02-01 02:42 - 2014-02-01 01:44 - 00000000 ____D () C:\bcc267867ba709c6bf7f1ea357
2014-02-01 02:42 - 2010-12-27 12:15 - 00000000 ____D () C:\Program Files\1&1 Surf-Stick
2014-02-01 02:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-02-01 02:40 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-02-01 02:40 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Photo Gallery
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\IME
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-02-01 02:31 - 2006-11-02 11:22 - 41418752 _____ () C:\Windows\system32\config\components_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-02-01 02:26 - 2006-11-02 13:52 - 00127811 _____ () C:\Windows\setupact.log
2014-02-01 02:03 - 2014-02-01 01:45 - 00196608 _____ () C:\Windows\SPInstall.etl
2014-02-01 01:45 - 2014-02-01 01:45 - 00000000 ____D () C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 01:34 - 2014-02-01 01:20 - 455611504 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB936330-X86-wave0.exe
2014-02-01 01:04 - 2014-01-31 23:22 - 00000000 ____D () C:\8de10754d4fd5dcb8a1c806fef28
2014-01-31 18:50 - 2012-08-31 18:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-01-31 18:45 - 2006-11-02 11:33 - 01461736 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-30 19:51 - 2014-01-30 19:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-27 22:13 - 2014-01-11 16:36 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Audacity
2014-01-27 22:04 - 2008-01-18 00:53 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\vlc
2014-01-27 21:49 - 2014-01-27 17:03 - 00022832 _____ () C:\Users\Marc\Interview_GESAMT.aup
2014-01-27 18:38 - 2014-01-23 21:39 - 00000005 _____ () C:\Users\Marc\AppData\Roaming\WBPU-TTL.DAT
2014-01-27 18:38 - 2014-01-23 21:37 - 00000147 _____ () C:\Users\Marc\AppData\Roaming\WB.CFG
2014-01-27 17:03 - 2014-01-27 17:03 - 00000000 ____D () C:\Users\Marc\Interview_GESAMT_data
2014-01-27 16:44 - 2013-08-21 17:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-27 16:41 - 2006-11-02 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-01-23 21:42 - 2014-01-23 21:38 - 00000000 ____D () C:\ProgramData\DivX
2014-01-23 21:42 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DivX
2014-01-23 21:41 - 2014-01-23 21:41 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DivX
2014-01-23 21:41 - 2014-01-23 21:40 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-01-23 21:39 - 2014-01-23 21:39 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 21:38 - 2014-01-23 21:38 - 00715038 _____ () C:\Windows\unins000.exe
2014-01-23 21:38 - 2014-01-23 21:38 - 00001782 _____ () C:\Windows\unins000.dat
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\LavFilters
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\CDXReader
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Xvid
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\OpenSource Flash Video Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Lame For Audacity
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Haali
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\ffdshow
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DSP-worx
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DirectVobSub
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\FoxTab
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Program Files\Foxtab
2014-01-23 21:36 - 2014-01-23 21:36 - 00686024 _____ () C:\Users\Marc\Downloads\CodecPackage.exe
2014-01-23 21:28 - 2014-01-23 21:05 - 00062758 _____ () C:\Users\Marc\Interview.aup
2014-01-23 21:05 - 2014-01-23 21:05 - 00000000 ____D () C:\Users\Marc\Interview_data
2014-01-11 16:43 - 2014-01-11 16:43 - 01477844 _____ () C:\Users\Marc\test 1.wav
2014-01-11 16:34 - 2014-01-11 16:34 - 00000766 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-01-11 16:34 - 2014-01-11 16:34 - 00000000 ____D () C:\Program Files\Audacity
2014-01-11 16:34 - 2014-01-11 16:29 - 22308174 _____ (Audacity Team ) C:\Users\Marc\Desktop\audacity-win-2-0-4.exe
2014-01-11 16:29 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public

ZeroAccess:
C:\Users\Marc\AppData\Local\e4f44f4f
C:\Users\Marc\AppData\Local\e4f44f4f\@
C:\Users\Marc\AppData\Local\e4f44f4f\loader.tlb

Some content of TEMP:
====================
C:\Users\Marc\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys
[2006-11-02 09:52] - [2006-11-02 10:51] - 0208488 ____A (Microsoft Corporation) 11EF6C1CAEF76B685233450A126125D6



LastRegBack: 2014-02-08 14:33

==================== End Of Log ============================
--- --- ---

--- --- ---


Liebe Grüße und schönen Samstag
whis

schrauber 09.02.2014 09:10

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

whismerhill 09.02.2014 23:36
Hi Schrauber,

hier das ESET-Ding
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b3b5a9cfe76d544b8d856e9e7f82dd44
# engine=17006
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-09 10:32:38
# local_time=2014-02-09 11:32:38 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=1023 16777215 0 0 0 0 0 0
# compatibility_mode=5892 16776574 100 100 21130946 229517886 0 0
# scanned=212564
# found=1
# cleaned=0
# scan_time=5950
sh=61DBAE9F4E110F7D51150931FA7F92E52E4D9E5F ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IF3ROQAL\banner_frame[1].htm"
und hier Sec-Check
Code:
Results of screen317's Security Check version 0.99.79 
 Windows Vista  x86 (UAC is enabled) 
 Out of date service pack!!
 Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware Version 1.75.0.1300 
 CCleaner   
 Java 7 Update 21 
 Java version out of Date!
 Adobe Flash Player        11.9.900.117 
 Adobe Reader 10.1.4 Adobe Reader out of Date! 
 Mozilla Firefox (26.0)
````````Process Check: objlist.exe by Laurent```````` 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````
und hier FRST

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-02-2014 03
Ran by Marc (administrator) on MARC-PC on 09-02-2014 23:48:54
Running from C:\Users\Marc\Downloads
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WlanNetService.exe
(Apple Computer, Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(Hewlett-Packard Company) c:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(OsdMaestro) C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Advanced Micro Devices Inc.) c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Windows\system32\schtasks.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Skype Technologies) C:\Program Files\Skype\Plugin Manager\skypePM.exe
(Hewlett-Packard Company) C:\hp\kbd\kbd.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(OsdMaestro) C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Windows\system32\schtasks.exe
(Advanced Micro Devices Inc.) c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Company) C:\hp\kbd\kbd.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2007-04-18] (Hewlett-Packard Company)
HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
HKLM\...\Run: [OsdMaestro] - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [118784 2007-02-15] (OsdMaestro)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178968 2007-06-14] (Intel Corporation)
HKLM\...\Run: [StartCCC] - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [CCUTRAYICON] - FactoryMode
HKLM\...\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [71176 2007-05-24] (Hewlett-Packard)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [UIExec] - C:\Program Files\1&1 Surf-Stick\UIExec.exe [139088 2010-09-30] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Run: [SunJavaUpdateReg] - C:\Windows\system32\jureg.exe [54936 2007-04-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [DivXMediaServer] - C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-12-23] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2013-11-15] ()
HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44168 2007-04-03] (soft thinks)
HKU\S-1-5-21-3822891451-4067332824-1385818742-1001\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [15026056 2011-01-26] (Skype Technologies S.A.)
HKU\S-1-5-21-3822891451-4067332824-1385818742-1003\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
HKU\S-1-5-21-3822891451-4067332824-1385818742-1003\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
Startup: C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Supermama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {B5719E69-3067-4694-B05B-13687A8B9D40} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie7chrome
SearchScopes: HKCU - {42C5AAAE-C0EA-4047-857B-0EAAFAE8B84F} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {B5719E69-3067-4694-B05B-13687A8B9D40} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie7chrome
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [227328] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [94208] (Apple Computer, Inc.)
Tcpip\..\Interfaces\{652F5BCA-6159-4E8A-A1E7-EE95D0B5CD28}: [NameServer]192.168.178.1,217.237.151.115

FireFox:
========
FF ProfilePath: C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npdeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-09-02]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-01-30]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] ()
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [61440 2007-05-24] (Hewlett-Packard)
S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation)
S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation)
S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-08-31] ()
S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation)
S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [253264 2010-09-30] ()
S2 mgisvr; %systemroot%\system32\AR5523.dll [X]
S4 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [X]
S2 veteboot; %systemroot%\system32\diskeeper.dll [X]

==================== Drivers (Whitelisted) ====================

R2 ACEDRV07; C:\Windows\system32\drivers\ACEDRV07.sys [101376 2009-01-08] (Protect Software GmbH)
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [277736 2008-07-30] (Protect Software GmbH)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-10-09] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-10-09] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [22016 2006-11-02] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Marc\AppData\Local\Temp\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

NETSVC: mgisvr -> C:\Windows\system32\AR5523.dll ==> No File.
NETSVC: veteboot -> C:\Windows\system32\diskeeper.dll ==> No File.

==================== One Month Created Files and Folders ========

2014-02-09 23:48 - 2014-02-09 23:48 - 00000000 ____D () C:\Users\Marc\Downloads\FRST-OlderVersion
2014-02-09 23:39 - 2014-02-09 23:39 - 00987425 _____ () C:\Users\Marc\Desktop\SecurityCheck.exe
2014-02-09 21:41 - 2014-02-09 21:42 - 02347384 _____ (ESET) C:\Users\Marc\Downloads\esetsmartinstaller_enu.exe
2014-02-08 14:32 - 2014-02-08 14:32 - 00001355 _____ () C:\Users\Marc\Desktop\JRT.txt
2014-02-08 14:30 - 2014-02-08 14:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-08 14:29 - 2014-02-08 14:30 - 01037530 _____ (Thisisu) C:\Users\Marc\Downloads\JRT.exe
2014-02-08 14:23 - 2014-02-08 14:26 - 00000000 ____D () C:\AdwCleaner
2014-02-08 14:23 - 2014-02-08 14:23 - 01166132 _____ () C:\Users\Marc\Downloads\adwcleaner.exe
2014-02-08 13:35 - 2014-02-08 13:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-07 17:47 - 2014-02-07 17:47 - 00014674 _____ () C:\ComboFix.txt
2014-02-07 17:30 - 2014-02-07 17:47 - 00000000 ____D () C:\ComboFix
2014-02-07 17:28 - 2014-02-07 17:29 - 05180173 ____R (Swearware) C:\Users\Marc\Downloads\ComboFix.exe
2014-02-06 20:48 - 2014-02-09 23:48 - 00014713 _____ () C:\Users\Marc\Downloads\FRST.txt
2014-02-06 20:48 - 2014-02-09 23:48 - 00000000 ____D () C:\FRST
2014-02-06 20:48 - 2014-02-06 20:49 - 00032060 _____ () C:\Users\Marc\Downloads\Addition.txt
2014-02-06 20:47 - 2014-02-09 23:48 - 01138688 _____ (Farbar) C:\Users\Marc\Downloads\FRST.exe
2014-02-01 01:45 - 2014-02-01 02:03 - 00196608 _____ () C:\Windows\SPInstall.etl
2014-02-01 01:45 - 2014-02-01 01:45 - 00000000 ____D () C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 01:44 - 2014-02-01 02:42 - 00000000 ____D () C:\bcc267867ba709c6bf7f1ea357
2014-02-01 01:20 - 2014-02-01 01:34 - 455611504 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB936330-X86-wave0.exe
2014-01-31 23:22 - 2014-02-01 01:04 - 00000000 ____D () C:\8de10754d4fd5dcb8a1c806fef28
2014-01-30 19:51 - 2014-01-30 19:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-27 17:03 - 2014-01-27 21:49 - 00022832 _____ () C:\Users\Marc\Interview_GESAMT.aup
2014-01-27 17:03 - 2014-01-27 17:03 - 00000000 ____D () C:\Users\Marc\Interview_GESAMT_data
2014-01-23 21:41 - 2014-01-23 21:41 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DivX
2014-01-23 21:40 - 2014-01-23 21:41 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-01-23 21:39 - 2014-01-27 18:38 - 00000005 _____ () C:\Users\Marc\AppData\Roaming\WBPU-TTL.DAT
2014-01-23 21:39 - 2014-01-23 21:39 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 21:38 - 2014-02-08 14:13 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DigitalSites
2014-01-23 21:38 - 2014-01-23 21:42 - 00000000 ____D () C:\ProgramData\DivX
2014-01-23 21:38 - 2014-01-23 21:42 - 00000000 ____D () C:\Program Files\DivX
2014-01-23 21:38 - 2014-01-23 21:38 - 00715038 _____ () C:\Windows\unins000.exe
2014-01-23 21:38 - 2014-01-23 21:38 - 00001782 _____ () C:\Windows\unins000.dat
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\LavFilters
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\CDXReader
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Xvid
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\OpenSource Flash Video Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Lame For Audacity
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Haali
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\ffdshow
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DSP-worx
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DirectVobSub
2014-01-23 21:38 - 2012-02-26 16:47 - 00079360 _____ () C:\Windows\system32\ff_vfw.dll
2014-01-23 21:38 - 2012-01-09 20:45 - 00178688 _____ () C:\Windows\system32\unrar.dll
2014-01-23 21:38 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\system32\lagarith.dll
2014-01-23 21:38 - 2011-05-30 14:42 - 00240640 _____ () C:\Windows\system32\xvidvfw.dll
2014-01-23 21:38 - 2011-05-23 10:52 - 00153088 _____ () C:\Windows\system32\xvid.ax
2014-01-23 21:38 - 2011-05-23 08:46 - 00645632 _____ () C:\Windows\system32\xvidcore.dll
2014-01-23 21:37 - 2014-01-27 18:38 - 00000147 _____ () C:\Users\Marc\AppData\Roaming\WB.CFG
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\FoxTab
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Program Files\Foxtab
2014-01-23 21:36 - 2014-01-23 21:36 - 00686024 _____ () C:\Users\Marc\Downloads\CodecPackage.exe
2014-01-23 21:05 - 2014-01-23 21:28 - 00062758 _____ () C:\Users\Marc\Interview.aup
2014-01-23 21:05 - 2014-01-23 21:05 - 00000000 ____D () C:\Users\Marc\Interview_data
2014-01-11 16:43 - 2014-01-11 16:43 - 01477844 _____ () C:\Users\Marc\test 1.wav
2014-01-11 16:36 - 2014-01-27 22:13 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Audacity
2014-01-11 16:34 - 2014-01-11 16:34 - 00000766 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-01-11 16:34 - 2014-01-11 16:34 - 00000000 ____D () C:\Program Files\Audacity
2014-01-11 16:29 - 2014-01-11 16:34 - 22308174 _____ (Audacity Team ) C:\Users\Marc\Desktop\audacity-win-2-0-4.exe

==================== One Month Modified Files and Folders =======

2014-02-09 23:49 - 2014-02-06 20:48 - 00014713 _____ () C:\Users\Marc\Downloads\FRST.txt
2014-02-09 23:48 - 2014-02-09 23:48 - 00000000 ____D () C:\Users\Marc\Downloads\FRST-OlderVersion
2014-02-09 23:48 - 2014-02-06 20:48 - 00000000 ____D () C:\FRST
2014-02-09 23:48 - 2014-02-06 20:47 - 01138688 _____ (Farbar) C:\Users\Marc\Downloads\FRST.exe
2014-02-09 23:47 - 2011-12-18 23:00 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-09 23:39 - 2014-02-09 23:39 - 00987425 _____ () C:\Users\Marc\Desktop\SecurityCheck.exe
2014-02-09 22:52 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-09 22:52 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-09 21:42 - 2014-02-09 21:41 - 02347384 _____ (ESET) C:\Users\Marc\Downloads\esetsmartinstaller_enu.exe
2014-02-09 21:41 - 2007-09-19 03:08 - 01948585 _____ () C:\Windows\WindowsUpdate.log
2014-02-09 21:39 - 2013-07-13 14:19 - 00000000 ____D () C:\Users\Supermama\AppData\Roaming\vlc
2014-02-09 21:37 - 2012-02-25 19:51 - 00012800 _____ () C:\Users\Supermama\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-09 21:13 - 2006-11-02 11:33 - 01461736 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-09 20:10 - 2011-01-26 16:46 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{8FF0CDE9-A183-482B-A8CB-7957D06F595F}.job
2014-02-09 20:08 - 2011-12-18 23:00 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-09 20:05 - 2011-02-07 22:40 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\skypePM
2014-02-09 20:05 - 2011-02-07 22:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Skype
2014-02-09 20:05 - 2007-09-10 11:31 - 00000000 ____D () C:\Windows\SMINST
2014-02-09 19:52 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-08 14:41 - 2006-11-02 14:01 - 00032762 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-08 14:32 - 2014-02-08 14:32 - 00001355 _____ () C:\Users\Marc\Desktop\JRT.txt
2014-02-08 14:30 - 2014-02-08 14:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-08 14:30 - 2014-02-08 14:29 - 01037530 _____ (Thisisu) C:\Users\Marc\Downloads\JRT.exe
2014-02-08 14:26 - 2014-02-08 14:23 - 00000000 ____D () C:\AdwCleaner
2014-02-08 14:23 - 2014-02-08 14:23 - 01166132 _____ () C:\Users\Marc\Downloads\adwcleaner.exe
2014-02-08 14:15 - 2007-09-10 11:33 - 00157328 _____ () C:\Windows\PFRO.log
2014-02-08 14:15 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-02-08 14:13 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DigitalSites
2014-02-08 13:42 - 2013-06-11 17:59 - 00000868 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 13:42 - 2013-06-11 17:59 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-08 13:39 - 2014-02-08 13:35 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-07 17:47 - 2014-02-07 17:47 - 00014674 _____ () C:\ComboFix.txt
2014-02-07 17:47 - 2014-02-07 17:30 - 00000000 ____D () C:\ComboFix
2014-02-07 17:47 - 2013-06-11 13:54 - 00000000 ____D () C:\Qoobox
2014-02-07 17:43 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-02-07 17:29 - 2014-02-07 17:28 - 05180173 ____R (Swearware) C:\Users\Marc\Downloads\ComboFix.exe
2014-02-06 20:49 - 2014-02-06 20:48 - 00032060 _____ () C:\Users\Marc\Downloads\Addition.txt
2014-02-06 20:45 - 2013-06-12 09:10 - 00000000 ____D () C:\Users\Marc\Desktop\Alles
2014-02-06 20:44 - 2011-07-08 12:23 - 00000000 ____D () C:\Users\Marc\Desktop\Sprachdemo
2014-02-01 02:44 - 2011-01-23 15:57 - 00000000 ____D () C:\Users\Supermama
2014-02-01 02:44 - 2008-01-07 23:01 - 00000000 ____D () C:\Users\Lucky Luke
2014-02-01 02:44 - 2007-12-05 23:24 - 00000000 ____D () C:\Users\Marc
2014-02-01 02:44 - 2007-09-10 11:04 - 00000000 ___HD () C:\Users\IUSR_NMPR
2014-02-01 02:44 - 2006-11-02 11:22 - 42467328 _____ () C:\Windows\system32\config\software_previous
2014-02-01 02:44 - 2006-11-02 11:22 - 21757952 _____ () C:\Windows\system32\config\system_previous
2014-02-01 02:43 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\MSN
2014-02-01 02:42 - 2014-02-01 01:44 - 00000000 ____D () C:\bcc267867ba709c6bf7f1ea357
2014-02-01 02:42 - 2010-12-27 12:15 - 00000000 ____D () C:\Program Files\1&1 Surf-Stick
2014-02-01 02:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-02-01 02:40 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-02-01 02:40 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Photo Gallery
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\IME
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-02-01 02:31 - 2006-11-02 11:22 - 41418752 _____ () C:\Windows\system32\config\components_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-02-01 02:26 - 2006-11-02 13:52 - 00127811 _____ () C:\Windows\setupact.log
2014-02-01 02:03 - 2014-02-01 01:45 - 00196608 _____ () C:\Windows\SPInstall.etl
2014-02-01 01:45 - 2014-02-01 01:45 - 00000000 ____D () C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 01:34 - 2014-02-01 01:20 - 455611504 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB936330-X86-wave0.exe
2014-02-01 01:04 - 2014-01-31 23:22 - 00000000 ____D () C:\8de10754d4fd5dcb8a1c806fef28
2014-01-31 18:50 - 2012-08-31 18:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-01-30 19:51 - 2014-01-30 19:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-27 22:13 - 2014-01-11 16:36 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Audacity
2014-01-27 22:04 - 2008-01-18 00:53 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\vlc
2014-01-27 21:49 - 2014-01-27 17:03 - 00022832 _____ () C:\Users\Marc\Interview_GESAMT.aup
2014-01-27 18:38 - 2014-01-23 21:39 - 00000005 _____ () C:\Users\Marc\AppData\Roaming\WBPU-TTL.DAT
2014-01-27 18:38 - 2014-01-23 21:37 - 00000147 _____ () C:\Users\Marc\AppData\Roaming\WB.CFG
2014-01-27 17:03 - 2014-01-27 17:03 - 00000000 ____D () C:\Users\Marc\Interview_GESAMT_data
2014-01-27 16:44 - 2013-08-21 17:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-27 16:41 - 2006-11-02 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-01-23 21:42 - 2014-01-23 21:38 - 00000000 ____D () C:\ProgramData\DivX
2014-01-23 21:42 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DivX
2014-01-23 21:41 - 2014-01-23 21:41 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DivX
2014-01-23 21:41 - 2014-01-23 21:40 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-01-23 21:39 - 2014-01-23 21:39 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 21:38 - 2014-01-23 21:38 - 00715038 _____ () C:\Windows\unins000.exe
2014-01-23 21:38 - 2014-01-23 21:38 - 00001782 _____ () C:\Windows\unins000.dat
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\LavFilters
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\CDXReader
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Xvid
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\OpenSource Flash Video Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Lame For Audacity
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Haali
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\ffdshow
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DSP-worx
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DirectVobSub
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\FoxTab
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Program Files\Foxtab
2014-01-23 21:36 - 2014-01-23 21:36 - 00686024 _____ () C:\Users\Marc\Downloads\CodecPackage.exe
2014-01-23 21:28 - 2014-01-23 21:05 - 00062758 _____ () C:\Users\Marc\Interview.aup
2014-01-23 21:05 - 2014-01-23 21:05 - 00000000 ____D () C:\Users\Marc\Interview_data
2014-01-11 16:43 - 2014-01-11 16:43 - 01477844 _____ () C:\Users\Marc\test 1.wav
2014-01-11 16:34 - 2014-01-11 16:34 - 00000766 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-01-11 16:34 - 2014-01-11 16:34 - 00000000 ____D () C:\Program Files\Audacity
2014-01-11 16:34 - 2014-01-11 16:29 - 22308174 _____ (Audacity Team ) C:\Users\Marc\Desktop\audacity-win-2-0-4.exe
2014-01-11 16:29 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public

ZeroAccess:
C:\Users\Marc\AppData\Local\e4f44f4f
C:\Users\Marc\AppData\Local\e4f44f4f\@
C:\Users\Marc\AppData\Local\e4f44f4f\loader.tlb

Some content of TEMP:
====================
C:\Users\Marc\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys
[2006-11-02 09:52] - [2006-11-02 10:51] - 0208488 ____A (Microsoft Corporation) 11EF6C1CAEF76B685233450A126125D6



LastRegBack: 2014-02-09 20:07

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


soweit läuft alles gut, DANKE!..lediglich die Anzeige ist immer noch verzerrt..bei den Schriftzeilen fehlt der untere Rand und egal welche Anzeige ich wähle bekomm ich nicht sauber hin? irgendeine Idee?..Internet ist wieder flott! DANKE

Zusammenfassung:
Erster PC..soll ich mit Programm Bluescreenviewer (siehe post gestern 14:21 Uhr) weiter nach Ursache für Abstürze suchen oder hast du noch ne gute Idee um rauszubekommen was da los ist?

Zweiter PC...wenn Fund gelöscht und dann soweit sauber..wie kann ich ihn so updaten, dasss Sicherheitslücken geschlossen werden..evtl geht ja direkt auf ServicePack 2..Servicepack1 nimmt er ja leider nie..hab ich bereits ca 30 mal versucht..immer erfolglos..
Vielen lieben Dank Schrauber für Deine Hilfe und einen guten Wochenstart
Lg whis

schrauber 10.02.2014 17:36
PC1: Ja, oder zippe die Dumpfile und hänge sie hier an.

PC2:
Java und Adobe updaten. Versuch mal den Offline Installer vom SP2. WIndows muss unbedingt updated werden.


Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ZeroAccess:
C:\Users\Marc\AppData\Local\e4f44f4f
C:\Users\Marc\AppData\Local\e4f44f4f\@
C:\Users\Marc\AppData\Local\e4f44f4f\loader.tlb

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Frisches FRST log bitte.

whismerhill 11.02.2014 19:10
Hi Schrauber..

zunächst mal
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 10-02-2014 01
Ran by Marc at 2014-02-11 19:04:53 Run:1
Running from C:\Users\Marc\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
ZeroAccess:
C:\Users\Marc\AppData\Local\e4f44f4f
C:\Users\Marc\AppData\Local\e4f44f4f\@
C:\Users\Marc\AppData\Local\e4f44f4f\loader.tlb
*****************

C:\Users\Marc\AppData\Local\e4f44f4f => Moved successfully.
"C:\Users\Marc\AppData\Local\e4f44f4f\@" => File/Directory not found.
"C:\Users\Marc\AppData\Local\e4f44f4f\loader.tlb" => File/Directory not found.

==== End of Fixlog ====
und dann noch

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-02-2014 01
Ran by Marc (administrator) on MARC-PC on 11-02-2014 19:05:50
Running from C:\Users\Marc\Desktop
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WlanNetService.exe
(Apple Computer, Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(Hewlett-Packard Company) c:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(OsdMaestro) C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Windows\system32\schtasks.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Advanced Micro Devices Inc.) c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Skype Technologies) C:\Program Files\Skype\Plugin Manager\skypePM.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Hewlett-Packard Company) C:\hp\kbd\kbd.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2007-04-18] (Hewlett-Packard Company)
HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
HKLM\...\Run: [OsdMaestro] - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [118784 2007-02-15] (OsdMaestro)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178968 2007-06-14] (Intel Corporation)
HKLM\...\Run: [StartCCC] - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [CCUTRAYICON] - FactoryMode
HKLM\...\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [71176 2007-05-24] (Hewlett-Packard)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [UIExec] - C:\Program Files\1&1 Surf-Stick\UIExec.exe [139088 2010-09-30] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Run: [SunJavaUpdateReg] - C:\Windows\system32\jureg.exe [54936 2007-04-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [DivXMediaServer] - C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-12-23] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2013-11-15] ()
HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44168 2007-04-03] (soft thinks)
HKU\S-1-5-21-3822891451-4067332824-1385818742-1001\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [15026056 2011-01-26] (Skype Technologies S.A.)
Startup: C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Supermama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {B5719E69-3067-4694-B05B-13687A8B9D40} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie7chrome
SearchScopes: HKCU - {42C5AAAE-C0EA-4047-857B-0EAAFAE8B84F} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {B5719E69-3067-4694-B05B-13687A8B9D40} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie7chrome
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [227328] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [94208] (Apple Computer, Inc.)
Tcpip\..\Interfaces\{652F5BCA-6159-4E8A-A1E7-EE95D0B5CD28}: [NameServer]192.168.178.1,217.237.151.115

FireFox:
========
FF ProfilePath: C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-09-02]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-01-30]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] ()
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [61440 2007-05-24] (Hewlett-Packard)
S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation)
S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation)
S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-08-31] ()
S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation)
S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [253264 2010-09-30] ()
S2 mgisvr; %systemroot%\system32\AR5523.dll [X]
S4 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [X]
S2 veteboot; %systemroot%\system32\diskeeper.dll [X]

==================== Drivers (Whitelisted) ====================

R2 ACEDRV07; C:\Windows\system32\drivers\ACEDRV07.sys [101376 2009-01-08] (Protect Software GmbH)
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [277736 2008-07-30] (Protect Software GmbH)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-10-09] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-10-09] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [22016 2006-11-02] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Marc\AppData\Local\Temp\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

NETSVC: mgisvr -> C:\Windows\system32\AR5523.dll ==> No File.
NETSVC: veteboot -> C:\Windows\system32\diskeeper.dll ==> No File.

==================== One Month Created Files and Folders ========

2014-02-11 19:05 - 2014-02-11 19:05 - 00012990 _____ () C:\Users\Marc\Desktop\FRST.txt
2014-02-11 19:04 - 2014-02-11 19:04 - 00000000 ____D () C:\Users\Marc\Desktop\FRST-OlderVersion
2014-02-11 18:33 - 2014-02-11 19:01 - 365230920 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB948465-X86.exe
2014-02-11 18:21 - 2014-02-11 18:21 - 00921000 _____ (Oracle Corporation) C:\Users\Marc\Downloads\jxpiinstall(3).exe
2014-02-11 18:09 - 2014-02-11 18:23 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-11 18:09 - 2014-02-11 18:09 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-11 18:09 - 2014-02-11 18:09 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-11 17:58 - 2014-02-11 18:25 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 17:52 - 2014-02-11 17:57 - 00004238 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log
2014-02-11 17:48 - 2014-02-11 17:48 - 00921000 _____ (Oracle Corporation) C:\Users\Marc\Downloads\jxpiinstall(2).exe
2014-02-09 23:48 - 2014-02-09 23:48 - 00000000 ____D () C:\Users\Marc\Downloads\FRST-OlderVersion
2014-02-09 23:39 - 2014-02-09 23:39 - 00987425 _____ () C:\Users\Marc\Desktop\SecurityCheck.exe
2014-02-09 21:41 - 2014-02-09 21:42 - 02347384 _____ (ESET) C:\Users\Marc\Downloads\esetsmartinstaller_enu.exe
2014-02-08 14:32 - 2014-02-08 14:32 - 00001355 _____ () C:\Users\Marc\Desktop\JRT.txt
2014-02-08 14:30 - 2014-02-08 14:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-08 14:29 - 2014-02-08 14:30 - 01037530 _____ (Thisisu) C:\Users\Marc\Downloads\JRT.exe
2014-02-08 14:23 - 2014-02-08 14:26 - 00000000 ____D () C:\AdwCleaner
2014-02-08 14:23 - 2014-02-08 14:23 - 01166132 _____ () C:\Users\Marc\Downloads\adwcleaner.exe
2014-02-08 13:35 - 2014-02-08 13:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-07 17:47 - 2014-02-07 17:47 - 00014674 _____ () C:\ComboFix.txt
2014-02-07 17:30 - 2014-02-07 17:47 - 00000000 ____D () C:\ComboFix
2014-02-07 17:28 - 2014-02-07 17:29 - 05180173 ____R (Swearware) C:\Users\Marc\Downloads\ComboFix.exe
2014-02-06 20:48 - 2014-02-11 19:05 - 00000000 ____D () C:\FRST
2014-02-06 20:48 - 2014-02-09 23:49 - 00030708 _____ () C:\Users\Marc\Downloads\FRST.txt
2014-02-06 20:48 - 2014-02-06 20:49 - 00032060 _____ () C:\Users\Marc\Downloads\Addition.txt
2014-02-06 20:47 - 2014-02-11 19:04 - 01139712 _____ (Farbar) C:\Users\Marc\Desktop\FRST.exe
2014-02-01 01:45 - 2014-02-01 02:03 - 00196608 _____ () C:\Windows\SPInstall.etl
2014-02-01 01:45 - 2014-02-01 01:45 - 00000000 ____D () C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 01:44 - 2014-02-01 02:42 - 00000000 ____D () C:\bcc267867ba709c6bf7f1ea357
2014-02-01 01:20 - 2014-02-01 01:34 - 455611504 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB936330-X86-wave0.exe
2014-01-31 23:22 - 2014-02-01 01:04 - 00000000 ____D () C:\8de10754d4fd5dcb8a1c806fef28
2014-01-30 19:51 - 2014-01-30 19:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-27 17:03 - 2014-01-27 21:49 - 00022832 _____ () C:\Users\Marc\Interview_GESAMT.aup
2014-01-27 17:03 - 2014-01-27 17:03 - 00000000 ____D () C:\Users\Marc\Interview_GESAMT_data
2014-01-23 21:41 - 2014-01-23 21:41 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DivX
2014-01-23 21:40 - 2014-01-23 21:41 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-01-23 21:39 - 2014-01-27 18:38 - 00000005 _____ () C:\Users\Marc\AppData\Roaming\WBPU-TTL.DAT
2014-01-23 21:39 - 2014-01-23 21:39 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 21:38 - 2014-02-08 14:13 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DigitalSites
2014-01-23 21:38 - 2014-01-23 21:42 - 00000000 ____D () C:\ProgramData\DivX
2014-01-23 21:38 - 2014-01-23 21:42 - 00000000 ____D () C:\Program Files\DivX
2014-01-23 21:38 - 2014-01-23 21:38 - 00715038 _____ () C:\Windows\unins000.exe
2014-01-23 21:38 - 2014-01-23 21:38 - 00001782 _____ () C:\Windows\unins000.dat
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\LavFilters
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\CDXReader
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Xvid
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\OpenSource Flash Video Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Lame For Audacity
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Haali
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\ffdshow
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DSP-worx
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DirectVobSub
2014-01-23 21:38 - 2012-02-26 16:47 - 00079360 _____ () C:\Windows\system32\ff_vfw.dll
2014-01-23 21:38 - 2012-01-09 20:45 - 00178688 _____ () C:\Windows\system32\unrar.dll
2014-01-23 21:38 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\system32\lagarith.dll
2014-01-23 21:38 - 2011-05-30 14:42 - 00240640 _____ () C:\Windows\system32\xvidvfw.dll
2014-01-23 21:38 - 2011-05-23 10:52 - 00153088 _____ () C:\Windows\system32\xvid.ax
2014-01-23 21:38 - 2011-05-23 08:46 - 00645632 _____ () C:\Windows\system32\xvidcore.dll
2014-01-23 21:37 - 2014-01-27 18:38 - 00000147 _____ () C:\Users\Marc\AppData\Roaming\WB.CFG
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\FoxTab
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Program Files\Foxtab
2014-01-23 21:36 - 2014-01-23 21:36 - 00686024 _____ () C:\Users\Marc\Downloads\CodecPackage.exe
2014-01-23 21:05 - 2014-01-23 21:28 - 00062758 _____ () C:\Users\Marc\Interview.aup
2014-01-23 21:05 - 2014-01-23 21:05 - 00000000 ____D () C:\Users\Marc\Interview_data

==================== One Month Modified Files and Folders =======

2014-02-11 19:05 - 2014-02-11 19:05 - 00012990 _____ () C:\Users\Marc\Desktop\FRST.txt
2014-02-11 19:05 - 2014-02-06 20:48 - 00000000 ____D () C:\FRST
2014-02-11 19:05 - 2011-01-26 16:46 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{8FF0CDE9-A183-482B-A8CB-7957D06F595F}.job
2014-02-11 19:04 - 2014-02-11 19:04 - 00000000 ____D () C:\Users\Marc\Desktop\FRST-OlderVersion
2014-02-11 19:04 - 2014-02-06 20:47 - 01139712 _____ (Farbar) C:\Users\Marc\Desktop\FRST.exe
2014-02-11 19:01 - 2014-02-11 18:33 - 365230920 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB948465-X86.exe
2014-02-11 18:47 - 2011-12-18 23:00 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-11 18:39 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-11 18:39 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-11 18:25 - 2014-02-11 17:58 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 18:23 - 2014-02-11 18:09 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-11 18:21 - 2014-02-11 18:21 - 00921000 _____ (Oracle Corporation) C:\Users\Marc\Downloads\jxpiinstall(3).exe
2014-02-11 18:09 - 2014-02-11 18:09 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-11 18:09 - 2014-02-11 18:09 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-11 17:57 - 2014-02-11 17:52 - 00004238 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log
2014-02-11 17:52 - 2007-09-10 11:15 - 00000000 ____D () C:\Program Files\Java
2014-02-11 17:48 - 2014-02-11 17:48 - 00921000 _____ (Oracle Corporation) C:\Users\Marc\Downloads\jxpiinstall(2).exe
2014-02-11 17:46 - 2006-11-02 11:33 - 01461736 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-11 17:45 - 2007-09-19 03:08 - 01960997 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 17:42 - 2011-02-07 22:40 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\skypePM
2014-02-11 17:42 - 2011-02-07 22:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Skype
2014-02-11 17:41 - 2011-12-18 23:00 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-11 17:41 - 2007-09-10 11:31 - 00000000 ____D () C:\Windows\SMINST
2014-02-11 17:39 - 2007-09-10 11:33 - 00158126 _____ () C:\Windows\PFRO.log
2014-02-11 17:39 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-09 23:59 - 2006-11-02 14:01 - 00032638 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-09 23:49 - 2014-02-06 20:48 - 00030708 _____ () C:\Users\Marc\Downloads\FRST.txt
2014-02-09 23:48 - 2014-02-09 23:48 - 00000000 ____D () C:\Users\Marc\Downloads\FRST-OlderVersion
2014-02-09 23:39 - 2014-02-09 23:39 - 00987425 _____ () C:\Users\Marc\Desktop\SecurityCheck.exe
2014-02-09 21:42 - 2014-02-09 21:41 - 02347384 _____ (ESET) C:\Users\Marc\Downloads\esetsmartinstaller_enu.exe
2014-02-09 21:39 - 2013-07-13 14:19 - 00000000 ____D () C:\Users\Supermama\AppData\Roaming\vlc
2014-02-09 21:37 - 2012-02-25 19:51 - 00012800 _____ () C:\Users\Supermama\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-08 14:32 - 2014-02-08 14:32 - 00001355 _____ () C:\Users\Marc\Desktop\JRT.txt
2014-02-08 14:30 - 2014-02-08 14:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-08 14:30 - 2014-02-08 14:29 - 01037530 _____ (Thisisu) C:\Users\Marc\Downloads\JRT.exe
2014-02-08 14:26 - 2014-02-08 14:23 - 00000000 ____D () C:\AdwCleaner
2014-02-08 14:23 - 2014-02-08 14:23 - 01166132 _____ () C:\Users\Marc\Downloads\adwcleaner.exe
2014-02-08 14:15 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-02-08 14:13 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DigitalSites
2014-02-08 13:42 - 2013-06-11 17:59 - 00000868 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 13:42 - 2013-06-11 17:59 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-08 13:39 - 2014-02-08 13:35 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-07 17:47 - 2014-02-07 17:47 - 00014674 _____ () C:\ComboFix.txt
2014-02-07 17:47 - 2014-02-07 17:30 - 00000000 ____D () C:\ComboFix
2014-02-07 17:47 - 2013-06-11 13:54 - 00000000 ____D () C:\Qoobox
2014-02-07 17:43 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-02-07 17:29 - 2014-02-07 17:28 - 05180173 ____R (Swearware) C:\Users\Marc\Downloads\ComboFix.exe
2014-02-06 20:49 - 2014-02-06 20:48 - 00032060 _____ () C:\Users\Marc\Downloads\Addition.txt
2014-02-06 20:45 - 2013-06-12 09:10 - 00000000 ____D () C:\Users\Marc\Desktop\Alles
2014-02-06 20:44 - 2011-07-08 12:23 - 00000000 ____D () C:\Users\Marc\Desktop\Sprachdemo
2014-02-01 02:44 - 2011-01-23 15:57 - 00000000 ____D () C:\Users\Supermama
2014-02-01 02:44 - 2008-01-07 23:01 - 00000000 ____D () C:\Users\Lucky Luke
2014-02-01 02:44 - 2007-12-05 23:24 - 00000000 ____D () C:\Users\Marc
2014-02-01 02:44 - 2007-09-10 11:04 - 00000000 ___HD () C:\Users\IUSR_NMPR
2014-02-01 02:44 - 2006-11-02 11:22 - 42467328 _____ () C:\Windows\system32\config\software_previous
2014-02-01 02:44 - 2006-11-02 11:22 - 21757952 _____ () C:\Windows\system32\config\system_previous
2014-02-01 02:43 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\MSN
2014-02-01 02:42 - 2014-02-01 01:44 - 00000000 ____D () C:\bcc267867ba709c6bf7f1ea357
2014-02-01 02:42 - 2010-12-27 12:15 - 00000000 ____D () C:\Program Files\1&1 Surf-Stick
2014-02-01 02:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-02-01 02:40 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-02-01 02:40 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Photo Gallery
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\IME
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-02-01 02:31 - 2006-11-02 11:22 - 41418752 _____ () C:\Windows\system32\config\components_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-02-01 02:26 - 2006-11-02 13:52 - 00127811 _____ () C:\Windows\setupact.log
2014-02-01 02:03 - 2014-02-01 01:45 - 00196608 _____ () C:\Windows\SPInstall.etl
2014-02-01 01:45 - 2014-02-01 01:45 - 00000000 ____D () C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 01:34 - 2014-02-01 01:20 - 455611504 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB936330-X86-wave0.exe
2014-02-01 01:04 - 2014-01-31 23:22 - 00000000 ____D () C:\8de10754d4fd5dcb8a1c806fef28
2014-01-31 18:50 - 2012-08-31 18:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-01-30 19:51 - 2014-01-30 19:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-27 22:13 - 2014-01-11 16:36 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Audacity
2014-01-27 22:04 - 2008-01-18 00:53 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\vlc
2014-01-27 21:49 - 2014-01-27 17:03 - 00022832 _____ () C:\Users\Marc\Interview_GESAMT.aup
2014-01-27 18:38 - 2014-01-23 21:39 - 00000005 _____ () C:\Users\Marc\AppData\Roaming\WBPU-TTL.DAT
2014-01-27 18:38 - 2014-01-23 21:37 - 00000147 _____ () C:\Users\Marc\AppData\Roaming\WB.CFG
2014-01-27 17:03 - 2014-01-27 17:03 - 00000000 ____D () C:\Users\Marc\Interview_GESAMT_data
2014-01-27 16:44 - 2013-08-21 17:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-27 16:41 - 2006-11-02 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-01-23 21:42 - 2014-01-23 21:38 - 00000000 ____D () C:\ProgramData\DivX
2014-01-23 21:42 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DivX
2014-01-23 21:41 - 2014-01-23 21:41 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DivX
2014-01-23 21:41 - 2014-01-23 21:40 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-01-23 21:39 - 2014-01-23 21:39 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 21:38 - 2014-01-23 21:38 - 00715038 _____ () C:\Windows\unins000.exe
2014-01-23 21:38 - 2014-01-23 21:38 - 00001782 _____ () C:\Windows\unins000.dat
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\LavFilters
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\CDXReader
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Xvid
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\OpenSource Flash Video Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Lame For Audacity
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Haali
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\ffdshow
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DSP-worx
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DirectVobSub
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\FoxTab
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Program Files\Foxtab
2014-01-23 21:36 - 2014-01-23 21:36 - 00686024 _____ () C:\Users\Marc\Downloads\CodecPackage.exe
2014-01-23 21:28 - 2014-01-23 21:05 - 00062758 _____ () C:\Users\Marc\Interview.aup
2014-01-23 21:05 - 2014-01-23 21:05 - 00000000 ____D () C:\Users\Marc\Interview_data

Some content of TEMP:
====================
C:\Users\Marc\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys
[2006-11-02 09:52] - [2006-11-02 10:51] - 0208488 ____A (Microsoft Corporation) 11EF6C1CAEF76B685233450A126125D6



LastRegBack: 2014-02-11 17:46

==================== End Of Log ============================
--- --- ---


mit den Updates war ich noch nicht erfolgreich..weder adobe noch Java wollte zuende installieren..ich versuch mal SP2..vielleicht geht da was und danach JAVA..

zu PC1..konnte keine minidump finden..war nur eine von 2013 drin..hab jetzt bei Systemesteuerung -- System -- Erweitert --Starten und Wiederherstellen den Haken bei Automatischer Neustart rausgenommen und hoffe, dass beim nächsten Absturz dann was in den Windows-Ordner %SystemRoot% Memory.dmp drin liegt..dann geb ich Bescheid...

ansonsten noch ne Idee zur Verzerrten Darstellung?
Lg und vielen Dank bis hierher
whis

schrauber 12.02.2014 18:01
Pc ist jetzt soweit sauber.

Zitat:
ansonsten noch ne Idee zur Verzerrten Darstellung?
welche Anzeige genau ist verzerrt?

whismerhill 13.02.2014 20:50
Lieber Schrauber,

Erstmal herzlichen Dank für deine Hilfe und Mühen. Da sich auch SP2 (man muß zwingend SP1 vorher installieren) nicht draufspielen läßt und Adobe und Java wegen fehlender MS-Software streiken, hab ich nun endgültig beschlossen den Vista-D**** Platt zu machen und auf Windows7 zu wechseln...insofern hat sich damit dieses Problem hoffentlich erledigt..PC 1 rödelt soweit stabil vor sich her und mal sehen ob und wann der wieder abschmiert, aber da würde ich mich einfach nochmal melden, falls der PC eine Minidump tatsächlich anlegt (und ich es auch finde :pfeiff:)

Mit der Anzeige meinte ich die generelle Ansicht ..also alles was auf Monitor zu sehen ist..hab schon alle Auflösungen ausprobiert, aber jegliche Schrift ist immer am unteren Rand abgeschnitten..vielleicht löst sich das Problem ja mit dem neuen Betriebssystem..
Liebe Grüße, Danke nochmal und kannst diesen thread jetzt schließen
Whis

whismerhill 14.02.2014 11:59
Liste der Anhänge anzeigen (Anzahl: 3)
So, alles Makulatur..bin schon wieder da und mit PC 1..heute um 11:39 Uhr ist er wieder ohne Vorwarnung runtergefahren..In der Ereignisanzeige hat er dies zwar vermerkt (siehe Anhang Bild_1)..das war es aber auch schon..konnte zudem keinen Eintrag bei Minidump finden..vielleicht such ich aber auch an der falschen Stelle...wobei ich dachte, dass ich alles jetzt richtig eingestellt habe (siehe Bild_2)..kannst Du mir Schritt für Schritt sagen, was ich jetzt am besten mache..dieses Abstürzen nervt gewaltig, da ich ja nicht alle 5 min auf speichern gehen kann...

Lg und Danke
whis

PS Hab mal im gesamten Windows/(C): nen Suchlauf nach "*.DMP" laufen lassen und er hat nichts gefunden von heute..(jüngster Eintrag ist vom 31. Januar siehe Bild_3)

im Minidump-Ordner ist nur ein einziger Eintrag aus dem Juli 2013..

schrauber 15.02.2014 15:17
Such mal bitte auf C: komplett, also die ganze Platte.

whismerhill 16.02.2014 11:37
mach ich..ich bin allerdings erst wieder am Samstag vor dem PC..melde mich dann bei dir..nur dass du Bescheid weisst..
Danke und schöne Woche
whis

schrauber 17.02.2014 10:16
ok :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:19 Uhr.
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131