Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Firefox öffnet ein neuen Tab mit Werbung (https://www.trojaner-board.de/149700-firefox-oeffnet-neuen-tab-werbung.html)

Glantir 13.02.2014 00:00
Firefox öffnet ein neuen Tab mit Werbung
 
Hey, wie der Titel schon sagt öffnet Firefox bei mir öfters mal ein neuen Tab (kein Popup sondern einen komplett neuen Tab) mit Werbung (oder auch mit leerem Inhalt weil NoScript alles blockt).

Hab über google was ähnliches in dem Forum gefunden, aber man soll ja für ähnliche/gleiche Probleme trotzdem einen neuen Thread öffnen :)

Weiß nicht ob da ein schädling dran schuld ist oder irgendwelche Einstellugen im Firefox :\
Hoffe ihr könnt mir weiter helfen!

cosinus 13.02.2014 00:20
Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Glantir 13.02.2014 01:19
FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2014 01
Ran by Daniel (administrator) on DANIEL-PC on 13-02-2014 01:15:39
Running from C:\Users\Daniel\Downloads
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\ProgramData\InternetUpdater\InternetUpdaterService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Updater) C:\ProgramData\Updater\updater.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) E:\Programme\Itunes\iTunesHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(WatchDog) C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe
(WatchDog) C:\ProgramData\RHelpers\FireFoxHelper\FireFoxHelper.exe
(WatchDog) C:\ProgramData\RHelpers\IEHelper\IeHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() E:\Programme\Aion RainMeter\AionRainMeter.exe
(NCSoft) e:\games\gameforgelive\games\deu_deu\aion\download\bin64\AION.bin
(TeamSpeak Systems GmbH) E:\Programme\TS3\ts3client_win64.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Farbar) C:\Users\Daniel\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13423688 2013-02-26] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [976672 2013-03-24] (NVIDIA Corporation)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [8292120 2013-11-14] (Logitech Inc.)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [XboxStat] - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Updater] - C:\ProgramData\Updater\Updater.exe [486264 2013-12-18] (Updater)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-12] (AVAST Software)
HKLM-x32\...\Run: [iTunesHelper] - E:\Programme\Itunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKU\S-1-5-21-4130903053-2028285206-3446340904-1000\...\Run: [Updater] - C:\ProgramData\Updater\updater.exe [486264 2013-12-18] (Updater)
HKU\S-1-5-21-4130903053-2028285206-3446340904-1000\...\MountPoints2: {092e3ccc-6aef-11e3-8583-806e6f6e6963} - F:\Run.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP3FAA2C35-B0CE-48DC-8D4B-3A495B2223D4&SSPV=
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP3FAA2C35-B0CE-48DC-8D4B-3A495B2223D4&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP3FAA2C35-B0CE-48DC-8D4B-3A495B2223D4&q={searchTerms}&SSPV=
BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll (CANON INC.)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Websteroids - {44ed99e2-16a6-4b89-80d6-5b21cf42e78b} - C:\ProgramData\Websteroids\IE\common.dll (Creative Island Media, LLC)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default
FF Homepage: hxxp://www.pcgames.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1207148.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - E:\Programme\Itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Websteroids - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\Extensions\support@websteroidsapp.com [2014-01-31]
FF Extension: YouTube Center - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\Extensions\jid1-cwbvBTE216jjpg@jetpack.xpi [2014-02-05]
FF Extension: NoScript - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-31]
FF Extension: Adblock Plus - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-31]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-23]

Chrome:
=======
CHR HomePage: hxxp://www.facebook.de/
CHR RestoreOnStartup: "https://www.facebook.com/"
CHR DefaultSearchKeyword: conduit.search
CHR DefaultSearchProvider: Conduit Search
CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP3FAA2C35-B0CE-48DC-8D4B-3A495B2223D4&q={searchTerms}&SSPV=
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-11]
CHR Extension: (Google Drive) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-11]
CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-11]
CHR Extension: (Google-Suche) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-11]
CHR Extension: (avast! Online Security) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-23]
CHR Extension: (Websteroids) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb [2014-01-14]
CHR Extension: (Google Wallet) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-11]
CHR Extension: (Google Mail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-11]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-01-23]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-12] (AVAST Software)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 InternetUpdater; C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [40448 2013-12-06] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-11] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-08] ()

==================== Drivers (Whitelisted) ====================

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21584 2013-02-19] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-01-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-12] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-12] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-12] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-23] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S1 UsbCharger; C:\Windows\System32\DRIVERS\UsbCharger.sys [21584 2013-05-06] ()
S3 gdrv; \??\C:\Windows\gdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-13 01:14 - 2014-02-13 01:14 - 02152448 _____ (Farbar) C:\Users\Daniel\Downloads\FRST64(1).exe
2014-02-12 23:00 - 2014-02-12 23:00 - 00602112 _____ (OldTimer Tools) C:\Users\Daniel\Downloads\OTL.exe
2014-02-11 22:20 - 2014-02-11 22:20 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\OpenOffice
2014-02-11 22:13 - 2014-02-11 22:13 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2014-02-11 22:12 - 2014-02-11 22:12 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2014-02-11 22:11 - 2014-02-11 22:11 - 00000000 ____D () C:\Users\Daniel\Desktop\OpenOffice 4.0.1 (de) Installation Files
2014-02-11 16:31 - 2014-02-11 16:33 - 163606685 _____ () C:\Users\Daniel\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2014-02-11 16:27 - 2014-02-11 16:27 - 00015934 _____ () C:\Users\Daniel\Downloads\Prüfungsübersicht.xlsx
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Canon
2014-02-10 19:12 - 2012-04-16 05:00 - 00392192 _____ (CANON INC.) C:\Windows\system32\CNMXLMBA.DLL
2014-02-10 19:10 - 2014-02-10 19:10 - 00002025 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk
2014-02-10 19:10 - 2014-02-10 19:10 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-02-10 19:10 - 2014-02-10 19:10 - 00000000 ____D () C:\Program Files\Common Files\CANON
2014-02-10 19:08 - 2014-02-10 19:08 - 00000000 ____D () C:\Program Files\Canon
2014-02-10 19:07 - 2014-02-10 19:07 - 00002360 _____ () C:\Users\Public\Desktop\Canon iP7200 series Online-Handbuch.lnk
2014-02-10 19:07 - 2014-02-10 19:07 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-02-10 19:07 - 2014-02-10 19:07 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-02-10 19:06 - 2014-02-10 19:06 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-02-10 19:06 - 2014-02-10 19:06 - 00000000 ____D () C:\Windows\system32\STRING
2014-02-10 19:06 - 2012-04-16 05:00 - 00389120 _____ (CANON INC.) C:\Windows\system32\CNMLMBA.DLL
2014-02-10 19:06 - 2012-03-28 18:01 - 00359936 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL
2014-02-10 19:06 - 2012-03-28 18:01 - 00039424 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL
2014-02-10 19:05 - 2014-02-10 19:24 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-02-10 19:05 - 2014-02-10 19:11 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-02-10 19:05 - 2014-02-10 19:05 - 00000000 ___HD () C:\ProgramData\CanonIJETV
2014-02-09 23:25 - 2014-02-09 23:25 - 00292720 _____ () C:\Windows\Minidump\020914-18080-01.dmp
2014-02-09 05:21 - 2014-02-09 05:21 - 00292960 _____ () C:\Windows\Minidump\020914-16551-01.dmp
2014-02-07 08:48 - 2014-02-07 08:48 - 00268928 _____ () C:\Windows\Minidump\020714-14289-01.dmp
2014-02-05 09:43 - 2014-02-05 09:43 - 00292584 _____ () C:\Windows\Minidump\020514-16770-01.dmp
2014-02-04 19:59 - 2014-02-06 17:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-04 04:18 - 2014-02-04 04:18 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Blizzard Entertainment
2014-02-04 01:16 - 2014-02-04 01:16 - 00000714 _____ () C:\Users\Public\Desktop\StarCraft II.lnk
2014-02-04 01:16 - 2014-02-04 01:16 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-02-04 01:15 - 2014-02-04 01:15 - 00000000 ____D () C:\ProgramData\Battle.net
2014-02-04 01:13 - 2014-02-04 01:13 - 54085656 _____ (Blizzard Entertainment) C:\Users\Daniel\Downloads\StarCraft-II-Setup-deDE.exe
2014-02-03 15:23 - 2014-02-03 15:23 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:27 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:22 - 00001538 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\Program Files\iTunes
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\Program Files\iPod
2014-02-03 15:22 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\ProgramData\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files\Bonjour
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-02-03 15:12 - 2014-02-03 15:14 - 148904784 _____ (Apple Inc.) C:\Users\Daniel\Downloads\iTunes64Setup.exe
2014-02-02 18:22 - 2014-02-02 18:22 - 00292560 _____ () C:\Windows\Minidump\020214-14461-01.dmp
2014-01-31 16:12 - 2014-01-31 16:12 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-31 16:12 - 2014-01-31 16:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-01-31 16:11 - 2014-01-31 16:11 - 23867560 _____ (Mozilla) C:\Users\Daniel\Downloads\Firefox_Setup_26.0 (1).exe
2014-01-30 11:29 - 2014-02-12 18:00 - 00000470 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-01-30 11:29 - 2014-02-12 02:07 - 00000444 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job
2014-01-30 11:29 - 2014-01-30 11:29 - 00003262 _____ () C:\Windows\System32\Tasks\ParetoLogic Update Version3
2014-01-30 11:29 - 2014-01-30 11:29 - 00003136 _____ () C:\Windows\System32\Tasks\ParetoLogic Registration3
2014-01-30 11:29 - 2014-01-30 11:29 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\ParetoLogic
2014-01-30 11:29 - 2014-01-30 11:29 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2014-01-30 11:29 - 2014-01-30 11:29 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\DriverCure
2014-01-30 11:28 - 2014-02-12 02:47 - 00000384 _____ () C:\Windows\Tasks\PC Health Advisor.job
2014-01-30 11:28 - 2014-02-07 02:24 - 00000402 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job
2014-01-30 11:28 - 2014-01-30 11:29 - 00003306 _____ () C:\Windows\System32\Tasks\PC Health Advisor
2014-01-30 11:28 - 2014-01-30 11:29 - 00003274 _____ () C:\Windows\System32\Tasks\PC Health Advisor Defrag
2014-01-30 11:28 - 2014-01-30 11:28 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Daniel\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-01-30 11:28 - 2014-01-30 11:28 - 00000000 ____D () C:\ProgramData\ParetoLogic
2014-01-30 11:28 - 2014-01-30 11:28 - 00000000 ____D () C:\Program Files (x86)\ParetoLogic
2014-01-30 11:25 - 2014-01-30 11:25 - 00292936 _____ () C:\Windows\Minidump\013014-15802-01.dmp
2014-01-24 14:57 - 2014-02-05 14:56 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Aion RainMeter
2014-01-24 14:57 - 2014-01-24 14:57 - 00000707 _____ () C:\Users\Public\Desktop\Aion RainMeter.lnk
2014-01-24 14:32 - 2014-01-24 14:32 - 06913098 _____ (Rainy.ws ) C:\Users\Daniel\Downloads\AionRainMeterSetup.exe
2014-01-23 00:18 - 2014-02-12 13:07 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-01-23 00:18 - 2014-02-12 13:06 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-01-23 00:18 - 2014-02-12 13:06 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-01-23 00:18 - 2014-02-12 13:06 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-01-23 00:18 - 2014-02-12 13:06 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-01-23 00:18 - 2014-02-12 13:06 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-01-23 00:18 - 2014-02-12 13:06 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-01-23 00:18 - 2014-02-12 13:06 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-23 00:18 - 2014-01-23 00:18 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-01-23 00:18 - 2014-01-23 00:18 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-01-23 00:18 - 2014-01-23 00:18 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-01-23 00:18 - 2014-01-23 00:18 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\AVAST Software
2014-01-23 00:17 - 2014-01-23 00:17 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-01-23 00:17 - 2014-01-23 00:17 - 00000000 ____D () C:\Program Files\AVAST Software
2014-01-23 00:13 - 2014-01-23 00:14 - 91412976 _____ (AVAST Software) C:\Users\Daniel\Downloads\avast_free_antivirus_setup.exe
2014-01-22 23:56 - 2014-02-13 01:15 - 00016344 _____ () C:\Users\Daniel\Downloads\FRST.txt
2014-01-22 23:56 - 2014-02-13 01:15 - 00000000 ____D () C:\FRST
2014-01-22 23:56 - 2014-01-22 23:57 - 00020011 _____ () C:\Users\Daniel\Downloads\Addition.txt
2014-01-22 23:56 - 2014-01-22 23:56 - 02077184 _____ (Farbar) C:\Users\Daniel\Downloads\FRST64.exe
2014-01-22 16:32 - 2014-01-22 16:37 - 335081758 _____ () C:\Users\Daniel\Downloads\Erstsemester-CD.zip
2014-01-21 18:00 - 2014-01-21 18:02 - 129598176 _____ () C:\Users\Daniel\Downloads\avira_free344_antivirus_de.exe
2014-01-19 23:07 - 2014-01-19 23:07 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-01-18 13:29 - 2014-01-18 13:29 - 00292936 _____ () C:\Windows\Minidump\011814-16504-01.dmp

==================== One Month Modified Files and Folders =======

2014-02-13 01:15 - 2014-01-22 23:56 - 00016344 _____ () C:\Users\Daniel\Downloads\FRST.txt
2014-02-13 01:15 - 2014-01-22 23:56 - 00000000 ____D () C:\FRST
2014-02-13 01:14 - 2014-02-13 01:14 - 02152448 _____ (Farbar) C:\Users\Daniel\Downloads\FRST64(1).exe
2014-02-13 01:05 - 2014-01-11 17:54 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-12 23:00 - 2014-02-12 23:00 - 00602112 _____ (OldTimer Tools) C:\Users\Daniel\Downloads\OTL.exe
2014-02-12 18:11 - 2014-01-11 17:54 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-12 18:00 - 2014-01-30 11:29 - 00000470 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-02-12 14:00 - 2013-12-22 10:57 - 02053239 _____ () C:\Windows\WindowsUpdate.log
2014-02-12 13:34 - 2009-07-14 18:58 - 00699726 _____ () C:\Windows\system32\perfh007.dat
2014-02-12 13:34 - 2009-07-14 18:58 - 00149364 _____ () C:\Windows\system32\perfc007.dat
2014-02-12 13:34 - 2009-07-14 06:13 - 01621742 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 13:34 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-12 13:34 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-12 13:27 - 2013-12-22 15:28 - 00292860 _____ () C:\Windows\PFRO.log
2014-02-12 13:27 - 2013-12-22 14:25 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-12 13:27 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-12 13:27 - 2009-07-14 05:51 - 00040915 _____ () C:\Windows\setupact.log
2014-02-12 13:26 - 2013-12-22 15:32 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\foobar2000
2014-02-12 13:07 - 2014-01-23 00:18 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-02-12 13:06 - 2014-01-23 00:18 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-02-12 13:06 - 2014-01-23 00:18 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-02-12 13:06 - 2014-01-23 00:18 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-02-12 13:06 - 2014-01-23 00:18 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-02-12 13:06 - 2014-01-23 00:18 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-02-12 13:06 - 2014-01-23 00:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-02-12 13:06 - 2014-01-23 00:18 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-12 13:04 - 2009-07-14 05:45 - 00294712 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-12 02:47 - 2014-01-30 11:28 - 00000384 _____ () C:\Windows\Tasks\PC Health Advisor.job
2014-02-12 02:07 - 2014-01-30 11:29 - 00000444 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job
2014-02-12 02:07 - 2013-12-22 14:30 - 00064024 _____ () C:\Users\Daniel\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-11 22:20 - 2014-02-11 22:20 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\OpenOffice
2014-02-11 22:13 - 2014-02-11 22:13 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2014-02-11 22:12 - 2014-02-11 22:12 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2014-02-11 22:11 - 2014-02-11 22:11 - 00000000 ____D () C:\Users\Daniel\Desktop\OpenOffice 4.0.1 (de) Installation Files
2014-02-11 18:15 - 2013-12-25 23:23 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\vlc
2014-02-11 16:33 - 2014-02-11 16:31 - 163606685 _____ () C:\Users\Daniel\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2014-02-11 16:27 - 2014-02-11 16:27 - 00015934 _____ () C:\Users\Daniel\Downloads\Prüfungsübersicht.xlsx
2014-02-10 19:24 - 2014-02-10 19:05 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Canon
2014-02-10 19:11 - 2014-02-10 19:05 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-02-10 19:10 - 2014-02-10 19:10 - 00002025 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk
2014-02-10 19:10 - 2014-02-10 19:10 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-02-10 19:10 - 2014-02-10 19:10 - 00000000 ____D () C:\Program Files\Common Files\CANON
2014-02-10 19:08 - 2014-02-10 19:08 - 00000000 ____D () C:\Program Files\Canon
2014-02-10 19:07 - 2014-02-10 19:07 - 00002360 _____ () C:\Users\Public\Desktop\Canon iP7200 series Online-Handbuch.lnk
2014-02-10 19:07 - 2014-02-10 19:07 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-02-10 19:07 - 2014-02-10 19:07 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-02-10 19:06 - 2014-02-10 19:06 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-02-10 19:06 - 2014-02-10 19:06 - 00000000 ____D () C:\Windows\system32\STRING
2014-02-10 19:05 - 2014-02-10 19:05 - 00000000 ___HD () C:\ProgramData\CanonIJETV
2014-02-10 18:46 - 2013-12-22 16:58 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-10 18:46 - 2013-12-22 16:58 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-09 23:25 - 2014-02-09 23:25 - 00292720 _____ () C:\Windows\Minidump\020914-18080-01.dmp
2014-02-09 23:25 - 2013-12-29 19:09 - 480071950 _____ () C:\Windows\MEMORY.DMP
2014-02-09 23:25 - 2013-12-29 19:09 - 00000000 ____D () C:\Windows\Minidump
2014-02-09 05:21 - 2014-02-09 05:21 - 00292960 _____ () C:\Windows\Minidump\020914-16551-01.dmp
2014-02-08 14:28 - 2014-01-10 17:34 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Awesomium
2014-02-07 08:48 - 2014-02-07 08:48 - 00268928 _____ () C:\Windows\Minidump\020714-14289-01.dmp
2014-02-07 02:24 - 2014-01-30 11:28 - 00000402 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job
2014-02-06 19:36 - 2013-12-22 14:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-06 17:57 - 2014-02-04 19:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-05 14:56 - 2014-01-24 14:57 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Aion RainMeter
2014-02-05 09:43 - 2014-02-05 09:43 - 00292584 _____ () C:\Windows\Minidump\020514-16770-01.dmp
2014-02-05 01:38 - 2014-01-13 23:49 - 00000420 _____ () C:\Users\Daniel\Desktop\Neues Textdokument.txt
2014-02-04 04:18 - 2014-02-04 04:18 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Blizzard Entertainment
2014-02-04 01:16 - 2014-02-04 01:16 - 00000714 _____ () C:\Users\Public\Desktop\StarCraft II.lnk
2014-02-04 01:16 - 2014-02-04 01:16 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-02-04 01:15 - 2014-02-04 01:15 - 00000000 ____D () C:\ProgramData\Battle.net
2014-02-04 01:13 - 2014-02-04 01:13 - 54085656 _____ (Blizzard Entertainment) C:\Users\Daniel\Downloads\StarCraft-II-Setup-deDE.exe
2014-02-03 15:27 - 2014-02-03 15:22 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Apple Computer
2014-02-03 15:23 - 2014-02-03 15:23 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:22 - 00001538 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\Program Files\iTunes
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\Program Files\iPod
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\ProgramData\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files\Bonjour
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-02-03 15:14 - 2014-02-03 15:12 - 148904784 _____ (Apple Inc.) C:\Users\Daniel\Downloads\iTunes64Setup.exe
2014-02-02 18:22 - 2014-02-02 18:22 - 00292560 _____ () C:\Windows\Minidump\020214-14461-01.dmp
2014-01-31 16:13 - 2013-12-22 14:50 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Mozilla
2014-01-31 16:12 - 2014-01-31 16:12 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-31 16:12 - 2014-01-31 16:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-01-31 16:11 - 2014-01-31 16:11 - 23867560 _____ (Mozilla) C:\Users\Daniel\Downloads\Firefox_Setup_26.0 (1).exe
2014-01-30 11:29 - 2014-01-30 11:29 - 00003262 _____ () C:\Windows\System32\Tasks\ParetoLogic Update Version3
2014-01-30 11:29 - 2014-01-30 11:29 - 00003136 _____ () C:\Windows\System32\Tasks\ParetoLogic Registration3
2014-01-30 11:29 - 2014-01-30 11:29 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\ParetoLogic
2014-01-30 11:29 - 2014-01-30 11:29 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2014-01-30 11:29 - 2014-01-30 11:29 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\DriverCure
2014-01-30 11:29 - 2014-01-30 11:28 - 00003306 _____ () C:\Windows\System32\Tasks\PC Health Advisor
2014-01-30 11:29 - 2014-01-30 11:28 - 00003274 _____ () C:\Windows\System32\Tasks\PC Health Advisor Defrag
2014-01-30 11:28 - 2014-01-30 11:28 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Daniel\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-01-30 11:28 - 2014-01-30 11:28 - 00000000 ____D () C:\ProgramData\ParetoLogic
2014-01-30 11:28 - 2014-01-30 11:28 - 00000000 ____D () C:\Program Files (x86)\ParetoLogic
2014-01-30 11:25 - 2014-01-30 11:25 - 00292936 _____ () C:\Windows\Minidump\013014-15802-01.dmp
2014-01-29 12:44 - 2013-12-22 23:17 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-29 12:35 - 2013-12-22 23:17 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-29 12:31 - 2013-12-22 14:57 - 00000000 ____D () C:\ProgramData\Origin
2014-01-24 14:57 - 2014-01-24 14:57 - 00000707 _____ () C:\Users\Public\Desktop\Aion RainMeter.lnk
2014-01-24 14:32 - 2014-01-24 14:32 - 06913098 _____ (Rainy.ws ) C:\Users\Daniel\Downloads\AionRainMeterSetup.exe
2014-01-23 15:35 - 2013-12-22 16:56 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Adobe
2014-01-23 00:18 - 2014-01-23 00:18 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-01-23 00:18 - 2014-01-23 00:18 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-01-23 00:18 - 2014-01-23 00:18 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-01-23 00:18 - 2014-01-23 00:18 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\AVAST Software
2014-01-23 00:17 - 2014-01-23 00:17 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-01-23 00:17 - 2014-01-23 00:17 - 00000000 ____D () C:\Program Files\AVAST Software
2014-01-23 00:14 - 2014-01-23 00:13 - 91412976 _____ (AVAST Software) C:\Users\Daniel\Downloads\avast_free_antivirus_setup.exe
2014-01-22 23:57 - 2014-01-22 23:56 - 00020011 _____ () C:\Users\Daniel\Downloads\Addition.txt
2014-01-22 23:56 - 2014-01-22 23:56 - 02077184 _____ (Farbar) C:\Users\Daniel\Downloads\FRST64.exe
2014-01-22 16:37 - 2014-01-22 16:32 - 335081758 _____ () C:\Users\Daniel\Downloads\Erstsemester-CD.zip
2014-01-21 18:02 - 2014-01-21 18:00 - 129598176 _____ () C:\Users\Daniel\Downloads\avira_free344_antivirus_de.exe
2014-01-19 23:07 - 2014-01-19 23:07 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-01-18 13:29 - 2014-01-18 13:29 - 00292936 _____ () C:\Windows\Minidump\011814-16504-01.dmp

Some content of TEMP:
====================
C:\Users\Daniel\AppData\Local\Temp\avgnt.exe
C:\Users\Daniel\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Daniel\AppData\Local\Temp\nse8288.exe
C:\Users\Daniel\AppData\Local\Temp\nse9C72.exe
C:\Users\Daniel\AppData\Local\Temp\nse9DF9.exe
C:\Users\Daniel\AppData\Local\Temp\nsj842E.exe
C:\Users\Daniel\AppData\Local\Temp\nsj9B0A.exe
C:\Users\Daniel\AppData\Local\Temp\nso8622.exe
C:\Users\Daniel\AppData\Local\Temp\nsq99C0.exe
C:\Users\Daniel\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Daniel\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStInst.exe
C:\Users\Daniel\AppData\Local\Temp\Offercast_AVIRAV7_.exe
C:\Users\Daniel\AppData\Local\Temp\setup{1D2DAFD5-99DD-4DCD-A604-D64A95AD07E2}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{201C71EC-5DF0-4BA4-B877-9A14FC5ECCB0}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{21B362EA-7A47-4F7A-8254-13E5F6B75FE4}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{32614286-191F-4700-BEA1-FCA1C448730E}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{44C37ADB-D756-4205-817C-F040C1E826AC}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{8B6DC9A7-C454-4A5D-8E9B-ACFAF2EAA94E}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{C2F6172C-3104-49EB-8A72-0D095C4D3DDC}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{E4EF9942-3A4C-432E-9C8C-B7B2FA699395}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{F41B15CD-6C06-4CBE-A9B4-B9D683B6C3E5}.exe
C:\Users\Daniel\AppData\Local\Temp\sonarinst.exe
C:\Users\Daniel\AppData\Local\Temp\uninstall.exe
C:\Users\Daniel\AppData\Local\Temp\_is4163.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-08 12:22

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---



FRST Additions Logfile:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-02-2014 01
Ran by Daniel at 2014-02-13 01:20:29
Running from C:\Users\Daniel\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
AION Free-to-Play (x32 Version:  - Gameforge)
Aion RainMeter version 1.93 (x32 Version: 1.93 - Rainy.ws)
Apple Application Support (x32 Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Assassin's Creed IV Black Flag (x32 Version:  - Ubisoft Montreal)
avast! Free Antivirus (x32 Version: 9.0.2013 - Avast Software)
Battlefield 4™ (x32 Version: 1.1.0.0 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.3.0 - EA Digital Illusions CE AB)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Canon Easy-WebPrint EX (x32 Version: 1.4.0.0 - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (x32 Version: 4.0.0 - Canon Inc.)
Canon iP7200 series Benutzerregistrierung (x32 Version:  - Canon Inc.‎)
Canon iP7200 series On-screen Manual (x32 Version: 7.5.0 - Canon Inc.)
Canon iP7200 series Printer Driver (Version:  - Canon Inc.)
Canon My Image Garden (x32 Version: 1.0.0 - Canon Inc.)
Canon My Image Garden Design Files (x32 Version: 1.0.0 - Canon Inc.)
Canon My Printer (x32 Version: 3.0.0 - Canon Inc.)
Canon Quick Menu (x32 Version: 2.0.0 - Canon Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dark Souls: Prepare to Die Edition (x32 Version:  - FromSoftware)
Deus Ex: Human Revolution (x32 Version:  - Eidos Montreal)
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
Fallout: New Vegas (x32 Version:  - Obsidian Entertainment)
FileParade Bundle (x32 Version: 1.0.0.0 - FileParade Bundle)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fraps (x32 Version:  - )
Gameforge Live 1.9.0 "Legend" (x32 Version: 1.9.0 - Gameforge)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.6.0.1033 - Intel Corporation) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
Internet Updater (x32 Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION
iTunes (Version: 11.1.4.62 - Apple Inc.)
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.51 (Version: 8.51.5 - Logitech Inc.)
Microsoft .NET Framework 4.5.1 RC (Version: 4.5.50861 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 RC (Version: 4.5.50861 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Xbox 360 Accessories 1.2 (Version: 1.20.146.0 - Microsoft)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (x32 Version:  - Pavel Cvrcek)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 24.3.0 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (x32 Version: 24.3.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
NVIDIA 3D Vision Controller-Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
ON_OFF Charge 2 B13.0506.1 (x32 Version: 1.00.0000 - GIGABYTE)
ON_OFF Charge 2 B13.0506.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
OpenOffice 4.0.1 (x32 Version: 4.01.9714 - Apache Software Foundation)
Origin (x32 Version: 9.3.11.2762 - Electronic Arts, Inc.)
ParetoLogic PC Health Advisor (x32 Version: 3.1.0.0 - ParetoLogic, Inc.)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
PunkBuster Services (x32 Version: 0.991 - Even Balance, Inc.)
Realtek Ethernet Controller Driver (x32 Version: 7.65.1025.2012 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6849 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Star Wars: The Force Unleashed Ultimate Sith Edition (x32 Version:  - LucasArts)
StarCraft II (x32 Version:  - Blizzard Entertainment)
The Elder Scrolls Online Beta (x32 Version: 0.3.4 - )
Updater (x32 Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
Uplay (x32 Version: 4.0 - Ubisoft)
VLC media player 2.1.1 (Version: 2.1.1 - VideoLAN)
Websteroids (x32 Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Xilisoft DVD Ripper Platinum (x32 Version: 7.7.3.20131014 - Xilisoft)

==================== Restore Points  =========================

21-01-2014 21:00:02 Geplanter Prüfpunkt
22-01-2014 23:17:42 avast! antivirus system restore point
03-02-2014 12:20:16 Geplanter Prüfpunkt
03-02-2014 14:15:50 Installed iTunes
11-02-2014 21:12:17 OpenOffice 4.0.1 wird installiert
12-02-2014 12:05:55 avast! antivirus system restore point

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0267F538-6214-47F7-944F-5BFCA5ACE5F6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-11] (Google Inc.)
Task: {1E7B8ACC-D29C-417B-8E8A-73C33A3B1178} - System32\Tasks\ParetoLogic Registration3 => Rundll32.exe "C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll" RunUns
Task: {2EEA0410-BE4C-4B1F-8FB9-C2C98158B4E0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-11] (Google Inc.)
Task: {551B34F3-ABBD-4E2A-9E28-3CFFDE928898} - System32\Tasks\PC Health Advisor => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-30] (ParetoLogic, Inc.)
Task: {A1830868-233F-44AE-9CB6-439E464DEE4A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {B072A673-A58C-41DE-9DAE-07B282C077A9} - System32\Tasks\PC Health Advisor Defrag => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-30] (ParetoLogic, Inc.)
Task: {C67A90FE-95F2-4E60-A24B-E27B0137CFF5} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-02-12] (AVAST Software)
Task: {CE663FEC-3F45-4CBA-9D3A-775894BB87AE} - System32\Tasks\ParetoLogic Update Version3 => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-30] (ParetoLogic Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ParetoLogic Registration3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll
Task: C:\Windows\Tasks\ParetoLogic Update Version3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe
Task: C:\Windows\Tasks\PC Health Advisor Defrag.job => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe
Task: C:\Windows\Tasks\PC Health Advisor.job => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe

==================== Loaded Modules (whitelisted) =============

2013-12-23 21:30 - 2013-12-10 03:15 - 00093984 _____ () C:\Program Files\NVIDIA Corporation\ShadowPlay\gamecaster64.dll
2013-12-23 21:30 - 2013-12-10 03:15 - 00874784 _____ () C:\Program Files\NVIDIA Corporation\ShadowPlay\twitchsdk64.dll
2014-01-24 14:57 - 2014-02-05 14:56 - 05938176 _____ () E:\Programme\Aion RainMeter\AionRainMeter.exe
2014-01-12 05:03 - 2014-01-12 05:03 - 00002560 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\SecureEngineSDK64.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 01471488 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\CryPhysics.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 01068032 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\CryMovie.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 04084224 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\XRenderD3D9.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 00028160 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\CryInput.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 00431616 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\CrySoundSystem.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 00649728 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\CryFont.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 00681472 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\CryEntitySystem.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 02126848 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\CryAnimation.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 02671104 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\Cry3DEngine.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 01413120 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\LIBEAY32.dll
2014-01-12 05:03 - 2014-01-12 05:03 - 00326144 _____ () e:\games\gameforgelive\games\deu_deu\aion\download\bin64\TextEngine.dll
2013-10-23 13:15 - 2013-10-23 13:15 - 00302056 _____ () E:\Programme\TS3\soundbackends\directsound_win64.dll
2013-10-23 13:15 - 2013-10-23 13:15 - 00320488 _____ () E:\Programme\TS3\soundbackends\windowsaudiosession_win64.dll
2013-10-23 13:15 - 2013-10-23 13:15 - 00565224 _____ () E:\Programme\TS3\plugins\clientquery_plugin.dll
2013-10-23 13:15 - 2013-10-23 13:15 - 00700904 _____ () E:\Programme\TS3\plugins\teamspeak_control_plugin.dll
2014-02-12 13:04 - 2014-02-12 08:49 - 02172928 _____ () C:\Program Files\AVAST Software\Avast\defs\14021200\algo.dll
2014-02-12 22:49 - 2014-02-12 18:52 - 02180096 _____ () C:\Program Files\AVAST Software\Avast\defs\14021202\algo.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-02-10 19:12 - 2012-03-28 13:49 - 00140456 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2013-12-06 02:30 - 2013-12-06 02:30 - 00040448 _____ () C:\ProgramData\InternetUpdater\InternetUpdaterService.exe
2013-12-22 23:17 - 2014-01-08 09:53 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-23 00:18 - 2014-01-23 00:18 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-12-22 14:33 - 2013-04-11 15:29 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-01-31 16:12 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-10 18:46 - 2014-02-10 18:46 - 16287624 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll
2014-02-04 19:59 - 2014-02-04 19:59 - 03019376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-02-04 19:59 - 2014-02-04 19:59 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-02-04 19:59 - 2014-02-04 19:59 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/13/2014 01:00:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 01:00:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 01:00:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 01:00:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 00:30:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 00:30:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 00:30:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 00:30:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 00:00:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.

Error: (02/13/2014 00:00:25 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1100)SUS20ClientDataStore: Die Kopfzeile der Protokolldatei C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log konnte nicht gelesen werden. Fehler -546.


System errors:
=============
Error: (02/12/2014 01:28:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (02/12/2014 01:28:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (02/12/2014 01:28:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (02/12/2014 01:28:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (02/12/2014 01:28:09 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (02/12/2014 01:28:09 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (02/12/2014 01:27:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (02/12/2014 01:27:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (02/12/2014 01:27:59 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (02/12/2014 01:27:31 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
UsbCharger


Microsoft Office Sessions:
=========================
Error: (02/13/2014 01:00:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 01:00:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 01:00:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 01:00:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 00:30:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 00:30:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 00:30:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 00:30:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 00:00:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546

Error: (02/13/2014 00:00:25 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1100SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log-546


==================== Memory info ===========================

Percentage of memory in use: 68%
Total physical RAM: 8136.63 MB
Available physical RAM: 2532.05 MB
Total Pagefile: 16271.39 MB
Available Pagefile: 11676.22 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:300.52 GB) (Free:251.45 GB) NTFS
Drive d: () (Fixed) (Total:232.79 GB) (Free:138.43 GB) NTFS
Drive e: () (Fixed) (Total:1562.5 GB) (Free:1327.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 043DB8B7)
Partition 1: (Not Active) - (Size=301 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-521303752704) - (Type=07 NTFS)

==================== End Of Log ============================
--- --- ---




EDIT: Hab vor ein Paar tagen wo es anfing mit Avast nen durchlauf machen lassen und ohne Funde
Edit2: Vor Avast hab ich Anti Vir benutzt, aber das hat sich zwischen durch immer wieder abgeschaltet und ließ sich nur nach neu start wieder aktivieren....

Glantir 26.02.2014 17:20
Hey ich kann mir vorstellen das es etwas dauert die logs durch zu sehen, aber hoffe man hat mich hier nicht vergessen :\

cosinus 27.02.2014 00:37
Sry, dein Beitrag ist "durchgerutscht". Du kannst und darfst nach drei Tagen hier erinnern :D

Was ist mit meiner Frage nachbisherigen Funden oder gab es noch nichts?

Glantir 27.02.2014 01:49
Habe Avast und Windows Defender nochmal durchlaufen lassen, beide finden nichts.

cosinus 27.02.2014 01:59
Dann hast du hoffentlich und wahrscheinlich auch nur Werbung. Aber einen Routine-Check sollten wir machen:


Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Glantir 27.02.2014 13:36
Er hatte tatsächlich as gefunden, lasse es nochmal durchlaufen zur sicherheit, aber hier ist schonmal der log

Code:
Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.02.27.03

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Daniel :: DANIEL-PC [administrator]

27.02.2014 13:12:46
mbar-log-2014-02-27 (13-12-46).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 230342
Time elapsed: 15 minute(s), 34 second(s)

Memory Processes Detected: 1
C:\ProgramData\Updater\updater.exe (Trojan.Agent) -> 1432 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 2
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Updater (Trojan.Agent) -> Data: C:\ProgramData\Updater\updater.exe -> Delete on reboot.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|Updater (Trojan.Agent) -> Data: C:\ProgramData\Updater\Updater.exe -> Delete on reboot.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\ProgramData\Updater\updater.exe (Trojan.Agent) -> Delete on reboot.

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus 27.02.2014 14:52
Log nach dem zweiten Lauf?

Glantir 27.02.2014 14:54
Diesmal keinen Fund, aber Firefox startet immer noch neue Tabs mit Werbung -.- ....

Code:
Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.02.27.04

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Daniel :: DANIEL-PC [administrator]

27.02.2014 13:34:31
mbar-log-2014-02-27 (13-34-31).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 230009
Time elapsed: 5 minute(s), 58 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus 27.02.2014 14:56
Adware/Junkware/Toolbars entfernen


1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Glantir 27.02.2014 22:11
Adw log:
Code:
# AdwCleaner v3.020 - Bericht erstellt am 27/02/2014 um 21:49:29
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium  (64 bits)
# Benutzername : Daniel - DANIEL-PC
# Gestartet von : C:\Users\Daniel\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : InternetUpdater

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\InternetUpdater
Ordner Gelöscht : C:\ProgramData\ParetoLogic
Ordner Gelöscht : C:\ProgramData\RHelpers
Ordner Gelöscht : C:\ProgramData\Websteroids
Ordner Gelöscht : C:\Program Files (x86)\ParetoLogic
Ordner Gelöscht : C:\Program Files (x86)\sweetpacks bundle uninstaller
Ordner Gelöscht : C:\Program Files (x86)\Common Files\ParetoLogic
Ordner Gelöscht : C:\Users\Daniel\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Users\Daniel\AppData\Roaming\DriverCure
Ordner Gelöscht : C:\Users\Daniel\AppData\Roaming\ParetoLogic
Ordner Gelöscht : C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
Ordner Gelöscht : E:\Eigene Dokumente\Optimizer Pro
Ordner Gelöscht : C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\Extensions\support@websteroidsapp.com
Ordner Gelöscht : C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb
Datei Gelöscht : C:\Users\Daniel\AppData\Local\Temp\Uninstall.exe
Datei Gelöscht : C:\Windows\Tasks\paretologic registration3.job
Datei Gelöscht : C:\Windows\System32\Tasks\paretologic registration3
Datei Gelöscht : C:\Windows\Tasks\paretologic update version3.job
Datei Gelöscht : C:\Windows\System32\Tasks\paretologic update version3
Datei Gelöscht : C:\Windows\Tasks\PC Health Advisor Defrag.job
Datei Gelöscht : C:\Windows\System32\Tasks\PC Health Advisor Defrag
Datei Gelöscht : C:\Windows\Tasks\PC Health Advisor.job
Datei Gelöscht : C:\Windows\System32\Tasks\PC Health Advisor

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ParetoLogic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\ParetoLogic
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3CBF3EBB-235D-4c29-A68B-2BB1F428586E}

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\prefs.js ]


-\\ Google Chrome v31.0.1650.63

[ Datei : C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht : search_url
Gelöscht : suggest_url
Gelöscht : keyword

*************************

AdwCleaner[R0].txt - [4993 octets] - [27/02/2014 21:48:59]
AdwCleaner[S0].txt - [4416 octets] - [27/02/2014 21:49:29]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4476 octets] ##########
JRT Log:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Daniel on 27.02.2014 at 22:01:19,24
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\dynconie.dynconieobject
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\dynconie.dynconieobject.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2830488C-079B-45C2-88B6-AFE4EAA2DF85}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{781CA792-9B6E-400B-B36F-15C097D2CA54}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{2830488C-079B-45C2-88B6-AFE4EAA2DF85}



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Daniel\AppData\Roaming\mozilla\firefox\profiles\hpxu987o.default\minidumps [16 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Daniel\appdata\local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.02.2014 at 22:04:09,63
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-02-2014 02
Ran by Daniel (administrator) on DANIEL-PC on 27-02-2014 22:06:02
Running from C:\Users\Daniel\Downloads
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) E:\Programme\Itunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\system32\cmd.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13423688 2013-02-26] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [Nvtmru] - "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"  -f "C:\ProgramData\NVIDIA\Updatus\NvTmru\nvtmru.dat"
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [8292120 2013-11-14] (Logitech Inc.)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1179576 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [XboxStat] - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-12] (AVAST Software)
HKLM-x32\...\Run: [iTunesHelper] - E:\Programme\Itunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKU\S-1-5-21-4130903053-2028285206-3446340904-1000\...\MountPoints2: {092e3ccc-6aef-11e3-8583-806e6f6e6963} - F:\Run.exe

==================== Internet (Whitelisted) ====================

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll (CANON INC.)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default
FF Homepage: hxxp://www.pcgames.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1207148.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - E:\Programme\Itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Center - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\Extensions\jid1-cwbvBTE216jjpg@jetpack.xpi [2014-02-05]
FF Extension: NoScript - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-31]
FF Extension: Adblock Plus - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\hpxu987o.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-31]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-23]

Chrome:
=======
CHR HomePage: hxxp://www.facebook.de/
CHR RestoreOnStartup: "https://www.facebook.com/"
CHR DefaultSearchProvider: Conduit Search
CHR DefaultSearchURL: hxxp://www.google.com
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-11]
CHR Extension: (Google Drive) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-11]
CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-11]
CHR Extension: (Google-Suche) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-11]
CHR Extension: (avast! Online Security) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-23]
CHR Extension: (Google Wallet) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-11]
CHR Extension: (Google Mail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-11]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-01-23]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-12] (AVAST Software)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-11] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-08] ()

==================== Drivers (Whitelisted) ====================

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21584 2013-02-19] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-01-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-12] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-12] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-12] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-23] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S1 UsbCharger; C:\Windows\System32\DRIVERS\UsbCharger.sys [21584 2013-05-06] ()
S3 gdrv; \??\C:\Windows\gdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-27 22:05 - 2014-02-27 22:05 - 00000000 ____D () C:\Users\Daniel\Downloads\FRST-OlderVersion
2014-02-27 22:04 - 2014-02-27 22:04 - 00001429 _____ () C:\Users\Daniel\Desktop\JRT.txt
2014-02-27 21:58 - 2014-02-27 21:58 - 00000000 ____D () C:\Windows\ERUNT
2014-02-27 21:53 - 2014-02-27 21:57 - 01037734 _____ (Thisisu) C:\Users\Daniel\Downloads\JRT.exe
2014-02-27 21:48 - 2014-02-27 21:49 - 00000000 ____D () C:\AdwCleaner
2014-02-27 21:46 - 2014-02-27 21:47 - 01244192 _____ () C:\Users\Daniel\Downloads\adwcleaner.exe
2014-02-27 13:12 - 2014-02-27 13:34 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-02-27 13:12 - 2014-02-27 13:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-27 13:11 - 2014-02-27 13:40 - 00000000 ____D () C:\Users\Daniel\Desktop\mbar
2014-02-27 13:11 - 2014-02-27 13:33 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-27 13:10 - 2014-02-27 13:10 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Daniel\Downloads\mbar-1.07.0.1009.exe
2014-02-18 20:42 - 2014-02-08 17:18 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-02-18 20:36 - 2014-02-18 20:36 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-02-18 20:31 - 2014-02-08 19:34 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-02-18 20:31 - 2014-02-08 19:34 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00483104 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00408352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00378656 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00333600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-02-18 20:31 - 2014-02-08 19:34 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-02-18 19:21 - 2013-12-27 19:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-02-18 19:21 - 2013-12-27 19:42 - 00033056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-02-12 23:00 - 2014-02-12 23:00 - 00602112 _____ (OldTimer Tools) C:\Users\Daniel\Downloads\OTL.exe
2014-02-11 22:20 - 2014-02-11 22:20 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\OpenOffice
2014-02-11 22:13 - 2014-02-11 22:13 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2014-02-11 22:12 - 2014-02-11 22:12 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2014-02-11 22:11 - 2014-02-11 22:11 - 00000000 ____D () C:\Users\Daniel\Desktop\OpenOffice 4.0.1 (de) Installation Files
2014-02-11 16:31 - 2014-02-11 16:33 - 163606685 _____ () C:\Users\Daniel\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2014-02-11 16:27 - 2014-02-11 16:27 - 00015934 _____ () C:\Users\Daniel\Downloads\Prüfungsübersicht.xlsx
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Canon
2014-02-10 19:12 - 2012-04-16 05:00 - 00392192 _____ (CANON INC.) C:\Windows\system32\CNMXLMBA.DLL
2014-02-10 19:10 - 2014-02-10 19:10 - 00002025 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk
2014-02-10 19:10 - 2014-02-10 19:10 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-02-10 19:10 - 2014-02-10 19:10 - 00000000 ____D () C:\Program Files\Common Files\CANON
2014-02-10 19:08 - 2014-02-10 19:08 - 00000000 ____D () C:\Program Files\Canon
2014-02-10 19:07 - 2014-02-10 19:07 - 00002360 _____ () C:\Users\Public\Desktop\Canon iP7200 series Online-Handbuch.lnk
2014-02-10 19:07 - 2014-02-10 19:07 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-02-10 19:07 - 2014-02-10 19:07 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-02-10 19:06 - 2014-02-10 19:06 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-02-10 19:06 - 2014-02-10 19:06 - 00000000 ____D () C:\Windows\system32\STRING
2014-02-10 19:06 - 2012-04-16 05:00 - 00389120 _____ (CANON INC.) C:\Windows\system32\CNMLMBA.DLL
2014-02-10 19:06 - 2012-03-28 18:01 - 00359936 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL
2014-02-10 19:06 - 2012-03-28 18:01 - 00039424 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL
2014-02-10 19:05 - 2014-02-10 19:24 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-02-10 19:05 - 2014-02-10 19:11 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-02-10 19:05 - 2014-02-10 19:05 - 00000000 ___HD () C:\ProgramData\CanonIJETV
2014-02-09 23:25 - 2014-02-09 23:25 - 00292720 _____ () C:\Windows\Minidump\020914-18080-01.dmp
2014-02-09 05:21 - 2014-02-09 05:21 - 00292960 _____ () C:\Windows\Minidump\020914-16551-01.dmp
2014-02-07 08:48 - 2014-02-07 08:48 - 00268928 _____ () C:\Windows\Minidump\020714-14289-01.dmp
2014-02-05 09:43 - 2014-02-05 09:43 - 00292584 _____ () C:\Windows\Minidump\020514-16770-01.dmp
2014-02-04 19:59 - 2014-02-06 17:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-04 04:18 - 2014-02-04 04:18 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Blizzard Entertainment
2014-02-04 01:16 - 2014-02-04 01:16 - 00000714 _____ () C:\Users\Public\Desktop\StarCraft II.lnk
2014-02-04 01:16 - 2014-02-04 01:16 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-02-04 01:15 - 2014-02-04 01:15 - 00000000 ____D () C:\ProgramData\Battle.net
2014-02-04 01:13 - 2014-02-04 01:13 - 54085656 _____ (Blizzard Entertainment) C:\Users\Daniel\Downloads\StarCraft-II-Setup-deDE.exe
2014-02-03 15:23 - 2014-02-03 15:23 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:27 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:22 - 00001538 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\Program Files\iTunes
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\Program Files\iPod
2014-02-03 15:22 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\ProgramData\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files\Bonjour
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-02-03 15:12 - 2014-02-03 15:14 - 148904784 _____ (Apple Inc.) C:\Users\Daniel\Downloads\iTunes64Setup.exe
2014-02-02 18:22 - 2014-02-02 18:22 - 00292560 _____ () C:\Windows\Minidump\020214-14461-01.dmp
2014-01-31 16:12 - 2014-01-31 16:12 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-31 16:12 - 2014-01-31 16:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-01-31 16:11 - 2014-01-31 16:11 - 23867560 _____ (Mozilla) C:\Users\Daniel\Downloads\Firefox_Setup_26.0 (1).exe
2014-01-30 11:28 - 2014-01-30 11:28 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Daniel\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-01-30 11:25 - 2014-01-30 11:25 - 00292936 _____ () C:\Windows\Minidump\013014-15802-01.dmp

==================== One Month Modified Files and Folders =======

2014-02-27 22:06 - 2014-01-22 23:56 - 00013884 _____ () C:\Users\Daniel\Downloads\FRST.txt
2014-02-27 22:06 - 2014-01-22 23:56 - 00000000 ____D () C:\FRST
2014-02-27 22:05 - 2014-02-27 22:05 - 00000000 ____D () C:\Users\Daniel\Downloads\FRST-OlderVersion
2014-02-27 22:05 - 2014-01-22 23:56 - 02155520 _____ (Farbar) C:\Users\Daniel\Downloads\FRST64.exe
2014-02-27 22:04 - 2014-02-27 22:04 - 00001429 _____ () C:\Users\Daniel\Desktop\JRT.txt
2014-02-27 22:01 - 2014-01-23 00:18 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-27 22:01 - 2014-01-11 17:54 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-27 22:00 - 2013-12-22 14:25 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-27 22:00 - 2013-12-22 10:57 - 01482110 _____ () C:\Windows\WindowsUpdate.log
2014-02-27 22:00 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-27 22:00 - 2009-07-14 05:51 - 00044360 _____ () C:\Windows\setupact.log
2014-02-27 21:58 - 2014-02-27 21:58 - 00000000 ____D () C:\Windows\ERUNT
2014-02-27 21:57 - 2014-02-27 21:53 - 01037734 _____ (Thisisu) C:\Users\Daniel\Downloads\JRT.exe
2014-02-27 21:57 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-27 21:57 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-27 21:49 - 2014-02-27 21:48 - 00000000 ____D () C:\AdwCleaner
2014-02-27 21:48 - 2013-12-22 15:32 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\foobar2000
2014-02-27 21:47 - 2014-02-27 21:46 - 01244192 _____ () C:\Users\Daniel\Downloads\adwcleaner.exe
2014-02-27 21:11 - 2014-01-11 17:54 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-27 13:40 - 2014-02-27 13:11 - 00000000 ____D () C:\Users\Daniel\Desktop\mbar
2014-02-27 13:34 - 2014-02-27 13:12 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-02-27 13:33 - 2014-02-27 13:11 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-27 13:31 - 2014-01-13 00:41 - 00000000 ____D () C:\ProgramData\Updater
2014-02-27 13:31 - 2013-12-22 15:28 - 00293176 _____ () C:\Windows\PFRO.log
2014-02-27 13:31 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\addins
2014-02-27 13:12 - 2014-02-27 13:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-27 13:10 - 2014-02-27 13:10 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Daniel\Downloads\mbar-1.07.0.1009.exe
2014-02-26 17:10 - 2009-07-14 18:58 - 00699726 _____ () C:\Windows\system32\perfh007.dat
2014-02-26 17:10 - 2009-07-14 18:58 - 00149364 _____ () C:\Windows\system32\perfc007.dat
2014-02-26 17:10 - 2009-07-14 06:13 - 01621742 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-18 20:42 - 2013-12-22 14:24 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-02-18 20:36 - 2014-02-18 20:36 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-02-18 19:21 - 2013-12-23 21:31 - 00000000 ____D () C:\Users\Daniel\AppData\Local\NVIDIA Corporation
2014-02-16 13:06 - 2014-01-11 17:54 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-16 13:06 - 2014-01-11 17:54 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-16 12:27 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-15 14:22 - 2013-12-22 23:17 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-15 14:05 - 2013-12-22 23:17 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-15 12:38 - 2013-12-22 14:57 - 00000000 ____D () C:\ProgramData\Origin
2014-02-13 01:20 - 2014-01-22 23:56 - 00023581 _____ () C:\Users\Daniel\Downloads\Addition.txt
2014-02-12 23:00 - 2014-02-12 23:00 - 00602112 _____ (OldTimer Tools) C:\Users\Daniel\Downloads\OTL.exe
2014-02-12 13:07 - 2014-01-23 00:18 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-02-12 13:06 - 2014-01-23 00:18 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-02-12 13:06 - 2014-01-23 00:18 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-02-12 13:06 - 2014-01-23 00:18 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-02-12 13:06 - 2014-01-23 00:18 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-02-12 13:06 - 2014-01-23 00:18 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-02-12 13:06 - 2014-01-23 00:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-02-12 13:04 - 2009-07-14 05:45 - 00294712 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-12 02:07 - 2013-12-22 14:30 - 00064024 _____ () C:\Users\Daniel\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-11 22:20 - 2014-02-11 22:20 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\OpenOffice
2014-02-11 22:13 - 2014-02-11 22:13 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2014-02-11 22:12 - 2014-02-11 22:12 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2014-02-11 22:11 - 2014-02-11 22:11 - 00000000 ____D () C:\Users\Daniel\Desktop\OpenOffice 4.0.1 (de) Installation Files
2014-02-11 18:15 - 2013-12-25 23:23 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\vlc
2014-02-11 16:33 - 2014-02-11 16:31 - 163606685 _____ () C:\Users\Daniel\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2014-02-11 16:27 - 2014-02-11 16:27 - 00015934 _____ () C:\Users\Daniel\Downloads\Prüfungsübersicht.xlsx
2014-02-10 19:24 - 2014-02-10 19:05 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Canon
2014-02-10 19:11 - 2014-02-10 19:05 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-02-10 19:10 - 2014-02-10 19:10 - 00002025 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk
2014-02-10 19:10 - 2014-02-10 19:10 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-02-10 19:10 - 2014-02-10 19:10 - 00000000 ____D () C:\Program Files\Common Files\CANON
2014-02-10 19:08 - 2014-02-10 19:08 - 00000000 ____D () C:\Program Files\Canon
2014-02-10 19:07 - 2014-02-10 19:07 - 00002360 _____ () C:\Users\Public\Desktop\Canon iP7200 series Online-Handbuch.lnk
2014-02-10 19:07 - 2014-02-10 19:07 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-02-10 19:07 - 2014-02-10 19:07 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-02-10 19:06 - 2014-02-10 19:06 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-02-10 19:06 - 2014-02-10 19:06 - 00000000 ____D () C:\Windows\system32\STRING
2014-02-10 19:05 - 2014-02-10 19:05 - 00000000 ___HD () C:\ProgramData\CanonIJETV
2014-02-10 18:46 - 2013-12-22 16:58 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-10 18:46 - 2013-12-22 16:58 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-09 23:25 - 2014-02-09 23:25 - 00292720 _____ () C:\Windows\Minidump\020914-18080-01.dmp
2014-02-09 23:25 - 2013-12-29 19:09 - 480071950 _____ () C:\Windows\MEMORY.DMP
2014-02-09 23:25 - 2013-12-29 19:09 - 00000000 ____D () C:\Windows\Minidump
2014-02-09 05:21 - 2014-02-09 05:21 - 00292960 _____ () C:\Windows\Minidump\020914-16551-01.dmp
2014-02-08 19:34 - 2014-02-18 20:31 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-02-08 19:34 - 2014-02-18 20:31 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00483104 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00408352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00378656 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00333600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-02-08 19:34 - 2014-02-18 20:31 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-02-08 19:34 - 2013-12-22 14:24 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-02-08 19:34 - 2013-12-22 14:24 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-02-08 19:34 - 2013-10-27 09:12 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-02-08 19:34 - 2013-10-27 09:12 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-02-08 19:34 - 2013-10-27 09:12 - 14669032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-02-08 19:34 - 2013-10-27 09:12 - 03090184 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-02-08 19:34 - 2013-10-27 09:12 - 02713728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-02-08 19:34 - 2013-10-27 09:12 - 00947296 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-02-08 19:34 - 2013-10-27 09:12 - 00024544 _____ () C:\Windows\system32\nvinfo.pb
2014-02-08 18:42 - 2013-12-22 14:24 - 06712608 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-02-08 18:42 - 2013-12-22 14:24 - 03498272 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-02-08 18:42 - 2013-12-22 14:24 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-02-08 18:42 - 2013-12-22 14:24 - 00923936 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-02-08 18:42 - 2013-12-22 14:24 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-02-08 18:42 - 2013-12-22 14:24 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-02-08 17:18 - 2014-02-18 20:42 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-02-08 14:28 - 2014-01-10 17:34 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Awesomium
2014-02-07 08:48 - 2014-02-07 08:48 - 00268928 _____ () C:\Windows\Minidump\020714-14289-01.dmp
2014-02-06 19:36 - 2013-12-22 14:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-06 17:57 - 2014-02-04 19:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-05 18:52 - 2013-12-22 14:24 - 03573739 _____ () C:\Windows\system32\nvcoproc.bin
2014-02-05 14:56 - 2014-01-24 14:57 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Aion RainMeter
2014-02-05 09:43 - 2014-02-05 09:43 - 00292584 _____ () C:\Windows\Minidump\020514-16770-01.dmp
2014-02-05 01:38 - 2014-01-13 23:49 - 00000420 _____ () C:\Users\Daniel\Desktop\Neues Textdokument.txt
2014-02-04 04:18 - 2014-02-04 04:18 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Blizzard Entertainment
2014-02-04 01:16 - 2014-02-04 01:16 - 00000714 _____ () C:\Users\Public\Desktop\StarCraft II.lnk
2014-02-04 01:16 - 2014-02-04 01:16 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-02-04 01:15 - 2014-02-04 01:15 - 00000000 ____D () C:\ProgramData\Battle.net
2014-02-04 01:13 - 2014-02-04 01:13 - 54085656 _____ (Blizzard Entertainment) C:\Users\Daniel\Downloads\StarCraft-II-Setup-deDE.exe
2014-02-03 15:27 - 2014-02-03 15:22 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Apple Computer
2014-02-03 15:23 - 2014-02-03 15:23 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:22 - 00001538 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\Program Files\iTunes
2014-02-03 15:22 - 2014-02-03 15:22 - 00000000 ____D () C:\Program Files\iPod
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\ProgramData\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files\Bonjour
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-02-03 15:15 - 2014-02-03 15:15 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-02-03 15:14 - 2014-02-03 15:12 - 148904784 _____ (Apple Inc.) C:\Users\Daniel\Downloads\iTunes64Setup.exe
2014-02-02 18:22 - 2014-02-02 18:22 - 00292560 _____ () C:\Windows\Minidump\020214-14461-01.dmp
2014-01-31 16:13 - 2013-12-22 14:50 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Mozilla
2014-01-31 16:12 - 2014-01-31 16:12 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-31 16:12 - 2014-01-31 16:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-01-31 16:11 - 2014-01-31 16:11 - 23867560 _____ (Mozilla) C:\Users\Daniel\Downloads\Firefox_Setup_26.0 (1).exe
2014-01-30 11:28 - 2014-01-30 11:28 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Daniel\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-01-30 11:25 - 2014-01-30 11:25 - 00292936 _____ () C:\Windows\Minidump\013014-15802-01.dmp

Some content of TEMP:
====================
C:\Users\Daniel\AppData\Local\Temp\avgnt.exe
C:\Users\Daniel\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Daniel\AppData\Local\Temp\nse8288.exe
C:\Users\Daniel\AppData\Local\Temp\nse9C72.exe
C:\Users\Daniel\AppData\Local\Temp\nse9DF9.exe
C:\Users\Daniel\AppData\Local\Temp\nsj842E.exe
C:\Users\Daniel\AppData\Local\Temp\nsj9B0A.exe
C:\Users\Daniel\AppData\Local\Temp\nso8622.exe
C:\Users\Daniel\AppData\Local\Temp\nsq99C0.exe
C:\Users\Daniel\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Daniel\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStInst.exe
C:\Users\Daniel\AppData\Local\Temp\Offercast_AVIRAV7_.exe
C:\Users\Daniel\AppData\Local\Temp\Quarantine.exe
C:\Users\Daniel\AppData\Local\Temp\setup{03EB5D48-AB2A-44C0-AA64-34054B602B30}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{11C528F0-9774-4AD1-9886-630DD54D6037}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{18271891-B5D0-489A-992B-A85C679D6B01}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{1D2DAFD5-99DD-4DCD-A604-D64A95AD07E2}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{201C71EC-5DF0-4BA4-B877-9A14FC5ECCB0}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{21B362EA-7A47-4F7A-8254-13E5F6B75FE4}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{32614286-191F-4700-BEA1-FCA1C448730E}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{43261B58-7157-425A-B78A-97C4B5A0F63F}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{44C37ADB-D756-4205-817C-F040C1E826AC}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{868F8513-2135-45EE-9160-9F7E351CF159}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{8B6DC9A7-C454-4A5D-8E9B-ACFAF2EAA94E}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{9A16A251-4818-4D7A-9E36-2CDB4C80674D}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{C2F6172C-3104-49EB-8A72-0D095C4D3DDC}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{E409D8C8-28A6-441F-9D85-55A62D4B1129}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{E4EF9942-3A4C-432E-9C8C-B7B2FA699395}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{F41B15CD-6C06-4CBE-A9B4-B9D683B6C3E5}.exe
C:\Users\Daniel\AppData\Local\Temp\sonarinst.exe
C:\Users\Daniel\AppData\Local\Temp\_is4163.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-19 11:03

==================== End Of Log ============================
--- --- ---

--- --- ---


Und der Addition
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-02-2014 02
Ran by Daniel at 2014-02-27 22:06:44
Running from C:\Users\Daniel\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version:  - Gameforge)
Aion RainMeter version 1.93 (HKLM-x32\...\{284CFEE9-720C-43C6-A276-1945CA4F6DDF}_is1) (Version: 1.93 - Rainy.ws)
Apple Application Support (HKLM-x32\...\{A922C4B7-50E0-4787-A94C-59DBF3C65DBE}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Assassin's Creed IV Black Flag (HKLM-x32\...\Steam App 242050) (Version:  - Ubisoft Montreal)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2013 - Avast Software)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.1.0.1 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.0 - EA Digital Illusions CE AB)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.4.0.0 - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.0.0 - Canon Inc.)
Canon iP7200 series Benutzerregistrierung (HKLM-x32\...\Canon iP7200 series Benutzerregistrierung) (Version:  - Canon Inc.‎)
Canon iP7200 series On-screen Manual (HKLM-x32\...\Canon iP7200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)
Canon iP7200 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP7200_series) (Version:  - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dark Souls: Prepare to Die Edition (HKLM-x32\...\Steam App 211420) (Version:  - FromSoftware)
Deus Ex: Human Revolution (HKLM-x32\...\Steam App 28050) (Version:  - Eidos Montreal)
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version:  - Obsidian Entertainment)
FileParade Bundle (HKLM-x32\...\FileParade Bundle) (Version: 1.0.0.0 - FileParade Bundle) <==== ATTENTION
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Gameforge Live 1.9.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.9.0 - Gameforge)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 31.0.1650.63 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.6.0.1033 - Intel Corporation) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
Internet Updater (HKLM-x32\...\InternetUpdater) (Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION
iTunes (HKLM\...\{0D924CB2-2EA4-4044-BAF7-770202D6BD0D}) (Version: 11.1.4.62 - Apple Inc.)
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.51 (HKLM\...\Logitech Gaming Software) (Version: 8.51.5 - Logitech Inc.)
Microsoft .NET Framework 4.5.1 RC (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50861 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 RC (Version: 4.5.50861 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.3.0 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.3.0 (x86 de)) (Version: 24.3.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3489 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 334.89 (Version: 334.89 - NVIDIA Corporation) Hidden
NVIDIA Update 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
ON_OFF Charge 2 B13.0506.1 (HKLM-x32\...\InstallShield_{6B4ED6F7-BB88-4945-B0C6-01410E1BAC3A}) (Version: 1.00.0000 - GIGABYTE)
ON_OFF Charge 2 B13.0506.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.65.1025.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6849 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden
Star Wars: The Force Unleashed Ultimate Sith Edition (HKLM-x32\...\Steam App 32430) (Version:  - LucasArts)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
The Elder Scrolls Online Beta (HKLM-x32\...\The Elder Scrolls Online Beta_is1) (Version: 0.3.4 - )
Updater (HKLM-x32\...\{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}) (Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
Uplay (HKLM-x32\...\Uplay) (Version: 4.0 - Ubisoft)
VLC media player 2.1.1 (HKLM\...\VLC media player) (Version: 2.1.1 - VideoLAN)
Websteroids (HKLM-x32\...\Websteroids) (Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Xilisoft DVD Ripper Platinum (HKLM-x32\...\Xilisoft DVD Ripper Platinum) (Version: 7.7.3.20131014 - Xilisoft)

==================== Restore Points  =========================

22-01-2014 23:17:42 avast! antivirus system restore point
03-02-2014 12:20:16 Geplanter Prüfpunkt
03-02-2014 14:15:50 Installed iTunes
11-02-2014 21:12:17 OpenOffice 4.0.1 wird installiert
12-02-2014 12:05:55 avast! antivirus system restore point
18-02-2014 18:22:06 DirectX wurde installiert
27-02-2014 12:30:34 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0267F538-6214-47F7-944F-5BFCA5ACE5F6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-11] (Google Inc.)
Task: {1E7B8ACC-D29C-417B-8E8A-73C33A3B1178} - \ParetoLogic Registration3 No Task File
Task: {2EEA0410-BE4C-4B1F-8FB9-C2C98158B4E0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-11] (Google Inc.)
Task: {551B34F3-ABBD-4E2A-9E28-3CFFDE928898} - \PC Health Advisor No Task File
Task: {A1830868-233F-44AE-9CB6-439E464DEE4A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {B072A673-A58C-41DE-9DAE-07B282C077A9} - \PC Health Advisor Defrag No Task File
Task: {C67A90FE-95F2-4E60-A24B-E27B0137CFF5} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-02-12] (AVAST Software)
Task: {CE663FEC-3F45-4CBA-9D3A-775894BB87AE} - \ParetoLogic Update Version3 No Task File
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-12-22 14:24 - 2014-02-08 18:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-02-10 19:12 - 2012-03-28 13:49 - 00140456 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2013-12-22 23:17 - 2014-01-08 09:53 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-02-27 13:07 - 2014-02-27 08:12 - 02186240 _____ () C:\Program Files\AVAST Software\Avast\defs\14022700\algo.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-01-23 00:18 - 2014-01-23 00:18 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-12-22 14:33 - 2013-04-11 15:29 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-01-31 16:12 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 22%
Total physical RAM: 8136.63 MB
Available physical RAM: 6278.33 MB
Total Pagefile: 16271.39 MB
Available Pagefile: 14207.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:300.52 GB) (Free:248.89 GB) NTFS
Drive d: () (Fixed) (Total:232.79 GB) (Free:138.42 GB) NTFS
Drive e: () (Fixed) (Total:1562.5 GB) (Free:1322.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 043DB8CE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 043DB8B7)
Partition 1: (Not Active) - (Size=301 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-521303752704) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus 28.02.2014 01:27
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Daniel\AppData\Local\Temp\avgnt.exe
C:\Users\Daniel\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Daniel\AppData\Local\Temp\nse8288.exe
C:\Users\Daniel\AppData\Local\Temp\nse9C72.exe
C:\Users\Daniel\AppData\Local\Temp\nse9DF9.exe
C:\Users\Daniel\AppData\Local\Temp\nsj842E.exe
C:\Users\Daniel\AppData\Local\Temp\nsj9B0A.exe
C:\Users\Daniel\AppData\Local\Temp\nso8622.exe
C:\Users\Daniel\AppData\Local\Temp\nsq99C0.exe
C:\Users\Daniel\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Daniel\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStInst.exe
C:\Users\Daniel\AppData\Local\Temp\Offercast_AVIRAV7_.exe
C:\Users\Daniel\AppData\Local\Temp\Quarantine.exe
C:\Users\Daniel\AppData\Local\Temp\setup{03EB5D48-AB2A-44C0-AA64-34054B602B30}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{11C528F0-9774-4AD1-9886-630DD54D6037}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{18271891-B5D0-489A-992B-A85C679D6B01}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{1D2DAFD5-99DD-4DCD-A604-D64A95AD07E2}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{201C71EC-5DF0-4BA4-B877-9A14FC5ECCB0}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{21B362EA-7A47-4F7A-8254-13E5F6B75FE4}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{32614286-191F-4700-BEA1-FCA1C448730E}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{43261B58-7157-425A-B78A-97C4B5A0F63F}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{44C37ADB-D756-4205-817C-F040C1E826AC}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{868F8513-2135-45EE-9160-9F7E351CF159}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{8B6DC9A7-C454-4A5D-8E9B-ACFAF2EAA94E}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{9A16A251-4818-4D7A-9E36-2CDB4C80674D}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{C2F6172C-3104-49EB-8A72-0D095C4D3DDC}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{E409D8C8-28A6-441F-9D85-55A62D4B1129}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{E4EF9942-3A4C-432E-9C8C-B7B2FA699395}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{F41B15CD-6C06-4CBE-A9B4-B9D683B6C3E5}.exe
C:\Users\Daniel\AppData\Local\Temp\sonarinst.exe
C:\Users\Daniel\AppData\Local\Temp\_is4163.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Glantir 28.02.2014 02:22
Da der Log.
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-02-2014 02
Ran by Daniel at 2014-02-28 02:20:48 Run:1
Running from C:\Users\Daniel\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Daniel\AppData\Local\Temp\avgnt.exe
C:\Users\Daniel\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Daniel\AppData\Local\Temp\nse8288.exe
C:\Users\Daniel\AppData\Local\Temp\nse9C72.exe
C:\Users\Daniel\AppData\Local\Temp\nse9DF9.exe
C:\Users\Daniel\AppData\Local\Temp\nsj842E.exe
C:\Users\Daniel\AppData\Local\Temp\nsj9B0A.exe
C:\Users\Daniel\AppData\Local\Temp\nso8622.exe
C:\Users\Daniel\AppData\Local\Temp\nsq99C0.exe
C:\Users\Daniel\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Daniel\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStInst.exe
C:\Users\Daniel\AppData\Local\Temp\Offercast_AVIRAV7_.exe
C:\Users\Daniel\AppData\Local\Temp\Quarantine.exe
C:\Users\Daniel\AppData\Local\Temp\setup{03EB5D48-AB2A-44C0-AA64-34054B602B30}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{11C528F0-9774-4AD1-9886-630DD54D6037}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{18271891-B5D0-489A-992B-A85C679D6B01}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{1D2DAFD5-99DD-4DCD-A604-D64A95AD07E2}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{201C71EC-5DF0-4BA4-B877-9A14FC5ECCB0}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{21B362EA-7A47-4F7A-8254-13E5F6B75FE4}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{32614286-191F-4700-BEA1-FCA1C448730E}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{43261B58-7157-425A-B78A-97C4B5A0F63F}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{44C37ADB-D756-4205-817C-F040C1E826AC}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{868F8513-2135-45EE-9160-9F7E351CF159}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{8B6DC9A7-C454-4A5D-8E9B-ACFAF2EAA94E}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{9A16A251-4818-4D7A-9E36-2CDB4C80674D}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{C2F6172C-3104-49EB-8A72-0D095C4D3DDC}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{E409D8C8-28A6-441F-9D85-55A62D4B1129}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{E4EF9942-3A4C-432E-9C8C-B7B2FA699395}.exe
C:\Users\Daniel\AppData\Local\Temp\setup{F41B15CD-6C06-4CBE-A9B4-B9D683B6C3E5}.exe
C:\Users\Daniel\AppData\Local\Temp\sonarinst.exe
C:\Users\Daniel\AppData\Local\Temp\_is4163.exe
       
*****************

HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
C:\Users\Daniel\AppData\Local\Temp\avgnt.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\MSETUP4.EXE => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nse8288.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nse9C72.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nse9DF9.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nsj842E.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nsj9B0A.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nso8622.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nsq99C0.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nv3DVStreaming.dll => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nvSCPAPI.dll => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nvStereoApiI.dll => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\nvStInst.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\Offercast_AVIRAV7_.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{03EB5D48-AB2A-44C0-AA64-34054B602B30}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{11C528F0-9774-4AD1-9886-630DD54D6037}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{18271891-B5D0-489A-992B-A85C679D6B01}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{1D2DAFD5-99DD-4DCD-A604-D64A95AD07E2}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{201C71EC-5DF0-4BA4-B877-9A14FC5ECCB0}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{21B362EA-7A47-4F7A-8254-13E5F6B75FE4}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{32614286-191F-4700-BEA1-FCA1C448730E}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{43261B58-7157-425A-B78A-97C4B5A0F63F}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{44C37ADB-D756-4205-817C-F040C1E826AC}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{868F8513-2135-45EE-9160-9F7E351CF159}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{8B6DC9A7-C454-4A5D-8E9B-ACFAF2EAA94E}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{9A16A251-4818-4D7A-9E36-2CDB4C80674D}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{C2F6172C-3104-49EB-8A72-0D095C4D3DDC}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{E409D8C8-28A6-441F-9D85-55A62D4B1129}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{E4EF9942-3A4C-432E-9C8C-B7B2FA699395}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\setup{F41B15CD-6C06-4CBE-A9B4-B9D683B6C3E5}.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\sonarinst.exe => Moved successfully.
C:\Users\Daniel\AppData\Local\Temp\_is4163.exe => Moved successfully.

==== End of Fixlog ====

cosinus 28.02.2014 09:49
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Glantir 28.02.2014 11:13
Hier mal der Malware log
Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.28.05

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Daniel :: DANIEL-PC [Administrator]

28.02.2014 11:08:49
mbam-log-2014-02-28 (11-08-49).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 210818
Laufzeit: 1 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 5
HKCR\AppID\{384997EE-E3BE-49C4-9ECA-C62B7C08128A} (PUP.Optional.DynConIE.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C} (PUP.Optional.WebSteroids.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6} (PUP.Optional.DynConIE.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Classes\AppID\DynConIE.DLL (PUP.Optional.DynConIE.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 1763663264748404735 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Daniel\AppData\Local\Temp\CT3323737 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 2
C:\Users\Daniel\Downloads\Fraps_TSV21Q2S8.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Daniel\AppData\Local\Temp\CT3323737\ddt.csf (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Der hatte immer noch 9 funde oO. mal eben neu starten und dann den ESET anwerfen

cosinus 28.02.2014 11:24
Das sind eh nur Adware-Reste

Glantir 28.02.2014 12:57
Und das ESET log (hat etwas länger gedauert der suchlauf ^^

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e619ae4ac6fefd4899a28e3bf85ba42a
# engine=17262
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-28 11:18:44
# local_time=2014-02-28 12:18:44 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=774 16777213 71 77 1381872 1383136 0 0
# compatibility_mode=5893 16776573 100 94 0 145991995 0 0
# scanned=190791
# found=3
# cleaned=0
# scan_time=3342
sh=662B9923F7C796C1766AF1488302447F9216061A ft=1 fh=fff34c570ca51c53 vn="a variant of MSIL/Adware.PullUpdate.A application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\InternetUpdater\InternetUpdaterService.exe.vir"
sh=1AB5FE7F5654ECBB42397AE222C0B8159081D6C6 ft=1 fh=2b551abc4ed949a7 vn="a variant of MSIL/Adware.PullUpdate.A application" ac=I fn="C:\ProgramData\Updater\Uninstall.exe"
sh=1AB5FE7F5654ECBB42397AE222C0B8159081D6C6 ft=1 fh=2b551abc4ed949a7 vn="a variant of MSIL/Adware.PullUpdate.A application" ac=I fn="C:\Users\All Users\Updater\Uninstall.exe"

cosinus 28.02.2014 13:06
TFC - Temp File Cleaner

Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
  • Öffne die TFC.exe.
    Vista und Win 7 User mit Rechtsklick "als Administrator starten".
  • Schließe alle anderen Programme.
  • Drücke auf den Button Start.
  • Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.




Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Glantir 28.02.2014 13:16
Bisher sieht alles gut aus, also keine weiteren Werbe Tabs bisher

viele danke für die gute Hilfe :)

cosinus 28.02.2014 13:42
Dann wären wir durch! :daumenhoc


Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden.

Helfen kann dir dabei delfix:


Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.






Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:24 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131