Trojaner-Board - Trojaner-, Virus-Fund: TR/Crypt.ZPACK, TR/Matsnu.A, BDS/Androm.FRMN

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Trojaner-, Virus-Fund: TR/Crypt.ZPACK, TR/Matsnu.A, BDS/Androm.FRMN (https://www.trojaner-board.de/161964-trojaner-virus-fund-tr-crypt-zpack-tr-matsnu-a-bds-androm-frmn.html)

Trojaner-, Virus-Fund: TR/Crypt.ZPACK, TR/Matsnu.A, BDS/Androm.FRMN

Hallo,

Ich habe letztens durch Klicken auf einen E-Mail-Anhang *AscheaufmeinHaupt* einen Trojaner bzw. Virus (oder mehrere) eingefangen. Habe darauf folgend, eine ganze Menge Viren durch Avira, Malware Bytes, AVG Antivir losbekommen. Ich bin mir aber sicher, dass noch welche drauf sind.
Kann ich noch machen?

Anbei erst einmal die Logfiles:

frst:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014

Ran by Nutzer (administrator) on FRANK on 18-12-2014 00:56:58

Running from C:\Users\Nutzer\Desktop

Loaded Profile: Nutzer (Available profiles: Nutzer & Administrator)

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 10

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Security\WDDriveAutoUnlock.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Farbar) C:\Users\Nutzer\Desktop\FRST(1).exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-04] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [DriveUtilitiesHelper] => C:\Program Files\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe [1852264 2014-05-23] (Western Digital Technologies, Inc.)

HKLM\...\Run: [WD Drive Unlocker] => C:\Program Files\Western Digital\WD Security\WDDriveAutoUnlock.exe [1694048 2014-05-23] (Western Digital Technologies, Inc.)

HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe [5562736 2014-07-22] (Western Digital Technologies, Inc.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)

HKLM\...\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [448856 2014-11-17] (DivX, LLC)

HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3653136 2014-11-09] (AVG Technologies CZ, s.r.o.)

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\...\Run: [uhwlenki] => C:\Users\Nutzer\AppData\Local\Temp\Menvybwmn\qoyfdoenki.exe <===== ATTENTION

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\...\RunOnce: [Adobe Speed Launcher] => 1418860458

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\...\MountPoints2: F - F:\LaunchU3.exe -a

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\...\MountPoints2: {40e91443-ef27-11df-8812-002421f525da} - F:\AUTOSTARTER.EXE

ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3704150980-58891897-2341478771-1000 -> {A96C7C46-0E39-47F0-8FA7-AD5DE565AC63} URL = hxxp://search.avg.com/?d=4e1d8473&i=23&tp=chrome&q={searchTerms}&lng={language}&nt=1

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKU\S-1-5-21-3704150980-58891897-2341478771-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()

FF Plugin: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)

FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)

FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3704150980-58891897-2341478771-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\searchplugins\google-maps.xml

FF Extension: Adblock Plus - C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-07]

FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-12-09]

FF HKLM\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn

FF HKU\S-1-5-21-3704150980-58891897-2341478771-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\extensions\cliqz@cliqz.com
 

Chrome: 

=======
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S4 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-03-27] (LSI Corporation)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-04] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-04] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-04] (Avira Operations GmbH & Co. KG)

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3488784 2014-11-09] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-11-09] (AVG Technologies CZ, s.r.o.)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

S4 BingDesktopUpdate; C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)

S4 Bluetooth Device Manager; C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe [3473672 2009-07-23] (Motorola, Inc.)

S4 Bluetooth Media Service; C:\Program Files\Motorola\Bluetooth\audiosrv.exe [709384 2009-07-23] (Motorola, Inc.)

S4 Bluetooth OBEX Service; C:\Program Files\Motorola\Bluetooth\obexsrv.exe [474888 2009-07-23] (Motorola, Inc.)

S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-11-29] (BitRaider, LLC)

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2013-12-19] (BitRaider, LLC)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1674928 2014-10-29] (Microsoft Corporation)

S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-06-23] (Creative Labs) [File not signed]

S4 Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-06-23] (Creative Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [423424 2011-10-19] (Creative Technology Ltd) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2009-10-26] (Macrovision Europe Ltd.) [File not signed]

R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19702048 2014-04-30] (NVIDIA Corporation)

R2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2014-12-02] (Western Digital Technologies, Inc.)

R2 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [296312 2014-05-23] (Western Digital Technologies, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 ACRUSBTM; C:\windows\system32\drivers\ACRUSBTM.SYS [28672 2007-08-02] () [File not signed]

S3 ArcSoftKsUFilter; C:\windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17920 2008-04-25] (ArcSoft, Inc.)

R1 Avgdiskx; C:\windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\windows\System32\DRIVERS\avgidsdriverx.sys [213784 2014-10-29] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHX; C:\windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSShim; C:\windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx86; C:\windows\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)

R0 Avglogx; C:\windows\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx86; C:\windows\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-09] (Avira Operations GmbH & Co. KG)

R0 Avgrkx86; C:\windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgtdix; C:\windows\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)

R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-10-09] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [37384 2014-10-09] (Avira Operations GmbH & Co. KG)

S3 BRDriver; C:\ProgramData\BitRaider\BRDriver.sys [64808 2013-10-19] (BitRaider)

S3 BTMCOM; C:\windows\System32\Drivers\btmcom.sys [40448 2009-07-10] (Motorola, Inc.)

S3 btmhid; C:\windows\system32\DRIVERS\btmhid.sys [27008 2009-06-29] (Motorola, Inc.)

S3 BTMUSB; C:\windows\System32\Drivers\btmusb.sys [516608 2009-07-13] (Motorola, Inc.)

S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()

S3 enecirhid; C:\windows\system32\DRIVERS\enecirhid.sys [11776 2009-05-19] (ENE TECHNOLOGY INC.)

S3 enecirhidma; C:\windows\system32\DRIVERS\enecirhidma.sys [5632 2008-04-24] (ENE TECHNOLOGY INC.)

S3 LGBusEnum; C:\windows\System32\drivers\LGBusEnum.sys [19720 2009-11-24] (Logitech Inc.)

S3 LGSHidFilt; C:\windows\System32\DRIVERS\LGSHidFilt.Sys [42480 2013-01-17] (Logitech Inc.)

S3 LGSUsbFilt; C:\windows\System32\DRIVERS\LGSUsbFilt.Sys [32496 2013-01-17] (Logitech Inc.)

S3 LGVirHid; C:\windows\System32\drivers\LGVirHid.sys [14856 2009-11-24] (Logitech Inc.)

S3 LUsbFilt; C:\windows\System32\Drivers\LUsbFilt.Sys [30360 2011-09-02] (Logitech, Inc.)

R3 NETwNs32; C:\windows\System32\DRIVERS\NETwNs32.sys [7530736 2013-11-26] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [17240 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\windows\System32\drivers\nvvad32v.sys [34080 2014-03-31] (NVIDIA Corporation)

R2 SecDrv; C:\windows\system32\drivers\SECDRV.SYS [163644 2012-04-22] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed]

S0 sfdrv01; C:\windows\System32\drivers\sfdrv01.sys [50688 2005-08-10] (Protection Technology) [File not signed]

R0 sfhlp02; C:\windows\System32\drivers\sfhlp02.sys [6656 2005-05-16] (Protection Technology) [File not signed]

S0 sfsync02; C:\windows\System32\drivers\sfsync02.sys [19968 2005-08-10] (Protection Technology) [File not signed]

S0 sfvfs02; C:\windows\System32\drivers\sfvfs02.sys [66048 2005-09-29] (Protection Technology) [File not signed]

S4 sptd; C:\windows\System32\Drivers\sptd.sys [691696 2010-11-13] (Duplex Secure Ltd.)

R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)

S3 SWDUMon; C:\windows\System32\DRIVERS\SWDUMon.sys [13464 2014-06-21] ()

R2 TurboB; C:\windows\System32\DRIVERS\TurboB.sys [14808 2009-08-06] ()

S3 XENfiltv; C:\windows\System32\drivers\XENfiltv.sys [17920 2009-07-31] (Creative Technology Ltd.)

S3 BRDriver_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver.sys [X]

S3 cdiskdun; \??\C:\Users\Nutzer\AppData\Local\Temp\cdiskdun.sys [X]

S3 smserial; system32\DRIVERS\smserial.sys [X]

S3 XDva399; \??\C:\windows\system32\XDva399.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-18 00:56 - 2014-12-18 00:57 - 00020181 _____ () C:\Users\Nutzer\Desktop\FRST.txt

2014-12-18 00:49 - 2014-12-18 00:49 - 00000634 _____ () C:\Users\Nutzer\Desktop\defogger_disable.log

2014-12-18 00:49 - 2014-12-18 00:49 - 00000020 _____ () C:\Users\Nutzer\defogger_reenable

2014-12-18 00:48 - 2014-12-18 00:48 - 00050477 _____ () C:\Users\Nutzer\Desktop\Defogger.exe

2014-12-18 00:42 - 2014-12-18 00:57 - 00000000 ___DC () C:\FRST

2014-12-18 00:42 - 2014-12-18 00:42 - 01113600 _____ (Farbar) C:\Users\Nutzer\Desktop\FRST(1).exe

2014-12-18 00:30 - 2014-12-18 00:30 - 00000000 _____ () C:\Users\Nutzer\Downloads\FRST.exe

2014-12-17 17:06 - 2014-12-18 00:23 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Thunderbird

2014-12-17 13:49 - 2014-12-17 13:49 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\AVG2015

2014-12-17 13:47 - 2014-12-17 13:47 - 00000961 _____ () C:\Users\Public\Desktop\AVG 2015.lnk

2014-12-17 13:47 - 2014-12-17 13:47 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\TuneUp Software

2014-12-17 13:47 - 2014-12-17 13:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2014-12-17 13:46 - 2014-12-17 13:48 - 00000000 ____D () C:\ProgramData\AVG2015

2014-12-17 13:46 - 2014-12-17 13:46 - 00000000 __HDC () C:\$AVG

2014-12-17 13:32 - 2014-12-17 13:50 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Avg2015

2014-12-17 13:32 - 2014-12-17 13:32 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\MFAData

2014-12-17 13:25 - 2014-12-17 13:31 - 157569304 _____ (AVG Technologies) C:\Users\Nutzer\Downloads\avg_free_x86_all_2015_5577a8546.exe

2014-12-17 13:02 - 2014-12-17 13:02 - 00000000 ___HD () C:\windows\PIF

2014-12-17 12:56 - 2014-12-17 23:56 - 00010095 _____ () C:\Users\Nutzer\Downloads\hijackthis.log

2014-12-17 11:45 - 2014-12-17 13:06 - 00000000 ____D () C:\Users\Nutzer\Downloads\backups

2014-12-17 11:34 - 2014-12-17 12:56 - 00000000 ____D () C:\Users\Nutzer\Downloads\swtor

2014-12-17 11:27 - 2014-12-17 11:27 - 00119904 _____ () C:\Users\Nutzer\AppData\Local\GDIPFONTCACHEV1.DAT

2014-12-16 00:54 - 2014-12-16 00:54 - 02166272 _____ () C:\Users\Nutzer\Downloads\adwcleaner_4.105.exe

2014-12-16 00:30 - 2014-12-16 00:30 - 00001070 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-16 00:30 - 2014-12-16 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-16 00:29 - 2014-12-16 00:30 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-12-16 00:29 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-12-16 00:29 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2014-12-16 00:29 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-12-16 00:04 - 2014-12-16 00:04 - 00001105 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-12-15 21:43 - 2014-12-15 21:45 - 00000000 ____D () C:\ProgramData\oiv

2014-12-11 14:21 - 2014-12-11 14:24 - 62506964 _____ () C:\Users\Nutzer\Desktop\Walk in the snø!.wav

2014-12-11 12:56 - 2014-12-12 14:28 - 00000000 ____D () C:\Users\Nutzer\Documents\YouTube To MP3

2014-12-11 12:56 - 2014-12-11 12:56 - 00001192 _____ () C:\Users\Public\Desktop\YouTube To MP3.lnk

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\Apowersoft

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apowersoft

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\Program Files\Apowersoft

2014-12-11 12:55 - 2014-12-11 12:55 - 08646688 _____ (Apowersoft ) C:\Users\Nutzer\Downloads\youtube-to-mp3.exe

2014-12-11 09:13 - 2014-11-21 08:18 - 00042496 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-12-11 09:13 - 2014-11-21 08:17 - 14364672 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 01762816 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 01181696 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00523264 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00080384 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 13758976 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 02861568 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 02054656 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 01441280 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-12-11 09:13 - 2014-11-21 08:16 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00493056 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00391168 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00357888 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00109056 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00033280 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-12-11 09:13 - 2014-11-21 07:54 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-12-11 09:13 - 2014-11-21 07:24 - 00361984 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2014-12-11 09:13 - 2014-11-21 06:59 - 00071680 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2014-12-11 09:13 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll

2014-12-09 13:36 - 2014-12-09 13:36 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-12-09 10:14 - 2014-12-09 10:14 - 01062072 _____ (Microsoft Corporation) C:\Users\Nutzer\Downloads\Setup.X86.de-de_O365ProPlusRetail_49e0d883-c5d2-4ca1-980d-bd808bbc2c30_TX_PR_.exe

2014-12-06 11:08 - 2014-12-06 11:08 - 00000987 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk

2014-12-06 11:08 - 2014-12-06 11:08 - 00000975 _____ () C:\Users\Public\Desktop\Audacity.lnk

2014-12-06 11:08 - 2014-12-06 11:08 - 00000000 ____D () C:\Program Files\Audacity

2014-12-04 15:38 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\system32\dhRichClient3.dll

2014-12-04 15:38 - 2011-03-25 19:42 - 00338432 _____ () C:\windows\system32\sqlite36_engine.dll

2014-11-26 23:20 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\system32\D3DX9_43.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\windows\system32\XAudio2_7.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\windows\system32\xactengine3_7.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\windows\system32\XAPOFX1_5.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\windows\system32\D3DCompiler_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\windows\system32\d3dcsx_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\windows\system32\d3dx10_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\windows\system32\d3dx11_43.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\windows\system32\XAudio2_6.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\windows\system32\xactengine3_6.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\windows\system32\XAPOFX1_4.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\windows\system32\X3DAudio1_7.dll

2014-11-22 11:30 - 2014-11-22 11:32 - 69279069 _____ () C:\Users\Nutzer\Downloads\ANDOR_Into_the_North.zip

2014-11-21 20:51 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2014-11-21 20:51 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll

2014-11-18 14:56 - 2014-11-18 14:56 - 01202848 _____ (Microsoft Corporation) C:\windows\system32\FM20.DLL

2014-11-18 10:33 - 2014-11-18 10:33 - 00001988 _____ () C:\Users\Nutzer\Desktop\Star Wars Knights of the Old Republic.lnk

2014-11-18 10:33 - 2014-11-18 10:33 - 00001988 _____ () C:\Users\Administrator\Desktop\Star Wars Knights of the Old Republic.lnk

2014-11-18 10:33 - 2014-11-18 10:33 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LucasArts

2014-11-18 10:33 - 2014-11-18 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LucasArts

2014-11-18 10:09 - 2014-11-18 10:09 - 00000000 ____D () C:\Program Files\LucasArts
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-18 00:53 - 2014-08-30 10:30 - 00008192 _____ () C:\windows\system32\WDPABKP.dat

2014-12-18 00:52 - 2013-08-02 09:19 - 00272170 _____ () C:\windows\PFRO.log

2014-12-18 00:52 - 2013-06-25 09:19 - 00130017 _____ () C:\windows\setupact.log

2014-12-18 00:52 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-12-18 00:50 - 2010-09-16 10:28 - 01215081 _____ () C:\windows\WindowsUpdate.log

2014-12-18 00:49 - 2010-09-16 10:30 - 00000000 ___HD () C:\Users\Nutzer

2014-12-18 00:41 - 2012-10-28 11:13 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job

2014-12-18 00:23 - 2014-06-11 08:15 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird

2014-12-17 23:59 - 2012-01-06 12:20 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\TS3Client

2014-12-17 15:35 - 2010-09-16 10:30 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\VirtualStore

2014-12-17 13:51 - 2011-07-13 12:15 - 00000000 ____D () C:\ProgramData\MFAData

2014-12-17 13:43 - 2011-07-13 12:28 - 00000000 ____D () C:\Program Files\AVG

2014-12-17 13:36 - 2014-08-14 09:18 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-17 13:35 - 2014-06-21 10:50 - 00069760 _____ () C:\windows\DPINST.LOG

2014-12-17 13:34 - 2014-08-31 08:22 - 00000000 ____D () C:\Program Files\Common Files\Western Digital

2014-12-17 13:34 - 2014-08-30 10:28 - 00000000 ____D () C:\ProgramData\Western Digital

2014-12-17 13:34 - 2014-08-30 10:28 - 00000000 ____D () C:\Program Files\Western Digital

2014-12-17 13:26 - 2013-08-28 17:49 - 00114904 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamswissarmy.sys

2014-12-17 13:02 - 2009-07-14 05:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-17 13:02 - 2009-07-14 05:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-17 12:54 - 2009-07-14 03:04 - 00000441 _____ () C:\windows\win.ini

2014-12-17 12:22 - 2009-10-26 21:54 - 01658436 _____ () C:\windows\system32\PerfStringBackup.INI

2014-12-16 17:39 - 2009-07-14 05:52 - 00000000 ____D () C:\windows\system32\FxsTmp

2014-12-16 01:51 - 2009-07-14 05:52 - 00000000 ____D () C:\windows\Performance

2014-12-16 00:29 - 2013-06-09 10:57 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-16 00:04 - 2014-01-09 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-16 00:04 - 2014-01-09 18:36 - 00000000 ____D () C:\Program Files\Avira

2014-12-14 23:18 - 2010-09-19 20:30 - 00000000 ____D () C:\ProgramData\DivX

2014-12-14 23:17 - 2013-10-28 12:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX

2014-12-14 23:17 - 2010-09-19 20:30 - 00000000 ____D () C:\Program Files\DivX

2014-12-14 23:17 - 2010-09-19 20:30 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared

2014-12-11 12:12 - 2009-10-26 21:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-11 12:10 - 2013-07-14 07:40 - 00000000 ____D () C:\windows\system32\MRT

2014-12-11 12:03 - 2010-09-16 11:46 - 109818608 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-12-10 09:56 - 2013-05-01 09:14 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-12-10 09:53 - 2012-05-02 19:53 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-12-09 10:19 - 2014-04-03 11:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2014-12-09 10:18 - 2014-04-03 11:15 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-12-02 11:19 - 2014-06-15 18:17 - 00021947 _____ () C:\Users\Nutzer\Desktop\Bücherliste.xlsx

2014-11-29 22:13 - 2014-08-21 19:56 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Adobe

2014-11-29 08:39 - 2013-07-31 14:22 - 00000000 ____D () C:\ProgramData\BitRaider

2014-11-29 08:36 - 2012-05-10 09:36 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe

2014-11-29 08:36 - 2011-05-16 18:35 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

2014-11-25 11:39 - 2014-03-26 18:25 - 00000000 ____D () C:\Program Files\Steam

2014-11-24 14:04 - 2010-09-16 11:21 - 00229000 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-11-22 11:10 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET

2014-11-18 10:33 - 2010-10-22 21:53 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-11-18 10:09 - 2009-10-26 21:47 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
 

Some content of TEMP:

====================

C:\Users\Nutzer\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\windows\explorer.exe => File is digitally signed

C:\windows\system32\winlogon.exe => File is digitally signed

C:\windows\system32\wininit.exe => File is digitally signed

C:\windows\system32\svchost.exe => File is digitally signed

C:\windows\system32\services.exe => File is digitally signed

C:\windows\system32\User32.dll => File is digitally signed

C:\windows\system32\userinit.exe => File is digitally signed

C:\windows\system32\rpcss.dll => File is digitally signed

C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-15 17:44
 

==================== End Of Log ============================

Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 17-12-2014

Ran by Nutzer at 2014-12-18 00:58:44

Running from C:\Users\Nutzer\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.8.638 - Adobe Systems, Inc.)

ArcSoft Magic-i Visual Effects 2 (HKLM\...\{8E90189A-A5D4-4C0E-A908-06C4236F98EE}) (Version: 2.0.10.65 - ArcSoft)

ArcSoft Print Creations - Album Page (HKLM\...\{E6B4117F-AC59-4B13-9274-EB136E8897EE}) (Version:  - ArcSoft)

ArcSoft Print Creations - Brochures & Flyers (HKLM\...\{01A1A019-E1D8-482A-BE17-5E118D17C0A0}) (Version:  - ArcSoft)

ArcSoft Print Creations - Funhouse (HKLM\...\{9591C049-5CAE-4E89-A8D9-191F1899628B}) (Version:  - ArcSoft)

ArcSoft Print Creations - Funhouse II (HKLM\...\{3CE47E6B-AE27-4E40-AC54-329EED96B933}) (Version:  - ArcSoft)

ArcSoft Print Creations - Greeting Card (HKLM\...\{F04F9557-81A9-4293-BC49-2C216FA325A7}) (Version:  - ArcSoft)

ArcSoft Print Creations - Photo Book (HKLM\...\{56589DFE-0C29-4DFE-8E42-887B771ECD23}) (Version:  - ArcSoft)

ArcSoft Print Creations - Photo Calendar (HKLM\...\{CA9ED5E4-1548-485B-A293-417840060158}) (Version:  - ArcSoft)

ArcSoft Print Creations - Photo Prints (HKLM\...\{95F875CC-1B85-43E6-B3E0-13EA04F3D995}) (Version:  - ArcSoft)

ArcSoft Print Creations - Poster Creator (HKLM\...\{5D1C82E7-7EC0-4404-A8AD-36C3B444BC34}) (Version:  - ArcSoft)

ArcSoft Print Creations - Scrapbook (HKLM\...\{B0D83FCD-9D42-43ED-8315-250326AADA02}) (Version:  - ArcSoft)

ArcSoft Print Creations - Slimline Card (HKLM\...\{007B37D9-0C45-4202-834B-DD5FAAE99D63}) (Version:  - ArcSoft)

ArcSoft Print Creations (HKLM\...\{FC2822D9-926E-4F55-B2A2-C49A0588802E}) (Version: 3.0.255.331 - ArcSoft)

ArcSoft WebCam Companion 3 (HKLM\...\{25478065-4CB1-448C-80E4-8C4529017EE3}) (Version: 3.0.32.134 - ArcSoft)

Audacity 2.0.6 (HKLM\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)

AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5577 - AVG Technologies)

AVG 2015 (Version: 15.0.4189 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.5577 - AVG Technologies) Hidden

Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)

Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)

Bing-Desktop (HKLM\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.347.0 - Microsoft Corporation)

BitRaider Streaming Client (HKLM\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)

BitRaider Web Client (HKLM\...\BitRaider Web Client) (Version: 1.1.8.1 - BitRaider, LLC)

BurnRecovery (HKLM\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 3.0.908.2201 - Micro-Star International Co., Ltd.)

Canon MP Navigator EX 3.0 (HKLM\...\MP Navigator EX 3.0) (Version:  - )

Canon MP560 series Benutzerregistrierung (HKLM\...\Canon MP560 series Benutzerregistrierung) (Version:  - )

Canon MP560 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series) (Version:  - )

Canon Utilities Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version:  - )

Canon Utilities My Printer (HKLM\...\CanonMyPrinter) (Version:  - )

Canon Utilities Solution Menu (HKLM\...\CanonSolutionMenu) (Version:  - )

CCleaner (HKLM\...\CCleaner) (Version: 3.24 - Piriform)

Choice Guard (Version: 1.2.87.0 - Microsoft Corporation) Hidden

Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Creative Systeminformationen (HKLM\...\SysInfo) (Version: 1.10 - Creative Technology Limited)

DivX-Setup (HKLM\...\DivX Setup) (Version: 2.7.0.31 - DivX, LLC)

DVDVideoSoftTB Toolbar (HKLM\...\DVDVideoSoftTB Toolbar) (Version: 6.15.0.27 - DVDVideoSoftTB)

ENE CIR Receiver Driver (HKLM\...\5B73F775A90397BAF80173B8A6C0B327BE3872FB) (Version: 2.7.3.519 - ENE)

eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden

Gothic (HKLM\...\Gothic) (Version: 1.32 - JoWooD Software Productions AG)

GT740 Screen Saver (HKLM\...\GT740) (Version:  - )

Intel(R) Turbo Boost Technology Monitor (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.115.11 - Intel)

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)

Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)

JMicron Flash Media Controller Driver (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.31.3 - JMicron Technology Corp.)

Junk Mail filter update (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden

League of Legends (HKLM\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)

LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.1.94 - LSI Corporation)

Machinarium (HKLM\...\{4D96D2F0-8FB4-45C2-9B80-2DCB88016316}_is1) (Version:  - Daedalic Entertainment)

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 15.0.4667.1002 - Microsoft Corporation)

Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_HOMESTUDENTR_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version:  - Microsoft)

Microsoft Office Excel 2007 Help Actualización (KB963678) (HKLM\...\{90120000-0016-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{59E09C3D-4878-47D9-87DB-6D0018026889}) (Version:  - Microsoft)

Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_HOMESTUDENTR_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version:  - Microsoft)

Microsoft Office Powerpoint 2007 Help Actualización (KB963669) (HKLM\...\{90120000-0018-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F318245D-05AE-4681-A749-A036CE44AF29}) (Version:  - Microsoft)

Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)

Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_HOMESTUDENTR_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version:  - Microsoft)

Microsoft Office Word 2007 Help Actualización (KB963665) (HKLM\...\{90120000-001B-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{377BA42A-1C84-45D6-94B8-6D00887D172D}) (Version:  - Microsoft)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)

Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)

Mise à jour Microsoft Office Excel 2007 Help  (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_HOMESTUDENTR_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version:  - Microsoft)

Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_HOMESTUDENTR_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version:  - Microsoft)

Mise à jour Microsoft Office Word 2007 Help  (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_HOMESTUDENTR_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version:  - Microsoft)

Moebius (HKLM\...\{D6903FBB-FA2E-49DE-896F-7050B8679AFC}) (Version: 3.10.0000 - Fa. Ellen Hoche)

Motorola Bluetooth (HKLM\...\Motorola Bluetooth_is1) (Version: 2.1.2.177 - Motorola, Inc.)

Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Mozilla Thunderbird 24.6.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)

MSI Software Install (HKLM\...\{07690F1C-04B1-4060-9691-6748ED1826B9}) (Version: 3.0.908.2001 - MSI)

MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML4 Parser (HKLM\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios)

Norton Internet Security (Version: 16.7.0.30 - Symantec Corporation) Hidden

NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)

NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

Office 15 Click-to-Run Extensibility Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)

PhotoScape (HKLM\...\PhotoScape) (Version:  - )

Prince of Persia T2T (HKLM\...\{DFFE2B1F-07E0-45A9-8801-CD8514CAA876}) (Version: 1.00.999 - Ubisoft)

Prince of Persia The Two Thrones (Version: 1.00.999 - Ubisoft) Hidden

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5951 - Realtek Semiconductor Corp.)

SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden

Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)

Sound Blaster Tactic(3D) Alpha (HKLM\...\{2226247D-9846-4370-A1EF-FAA6958F7632}) (Version: 1.0 - Creative Technology Limited)

Speccy (HKLM\...\Speccy) (Version: 1.26 - Piriform)

Star Wars The Old Republic (HKLM\...\swtor_swtor) (Version: 8.0.0.5 - Bioware/EA)

Star Wars(TM): Knights of the Old Republic (TM) (HKLM\...\{2A9A40C7-6670-4D5F-8F41-D12E2E08B48B}) (Version:  - )

Star Wars: The Old Republic (HKLM\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)

Steam (HKLM\...\Steam) (Version:  - Valve Corporation)

swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

System Requirements Lab for Intel (HKLM\...\{04C4B49D-45D9-4A28-9ED1-B45CBD99B8C7}) (Version: 4.5.24.0 - Husdawg, LLC)

Team Fortress 2 (HKLM\...\Steam App 440) (Version:  - Valve)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden

Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 1.1.10 (HKLM\...\VLC media player) (Version: 1.1.10 - VideoLAN)

WD Drive Utilities (HKLM\...\{59E0381C-1047-45A3-B68A-57F586EAF3C2}) (Version: 1.1.0.51 - Western Digital Technologies, Inc.)

WD Quick View (HKLM\...\{C58994CF-D15D-41E3-A03B-587B39EAA903}) (Version: 2.4.6.3 - Western Digital Technologies, Inc.)

WD Security (HKLM\...\{D338102B-BA1C-4CCA-B870-8690FA0F0433}) (Version: 1.1.0.51 - Western Digital Technologies, Inc.)

WD SmartWare (HKLM\...\{752EC2DC-0313-435A-BF9A-9B02927C049A}) (Version: 2.4.6.3 - Western Digital Technologies, Inc.)

WD SmartWare Installer (HKLM\...\{1891b882-48f7-442d-98d0-c1ce533f25bd}) (Version: 2.4.6.3 - Western Digital Technologies, Inc.)

Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8050.1202 - Microsoft Corporation)

Windows Live ID-Anmelde-Assistent (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows Live Sync (HKLM\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)

Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

WinRAR (HKLM\...\WinRAR archiver) (Version:  - )

YouTube To MP3 V2.1.1 (HKLM\...\{52A73D55-93BC-41A9-B4C0-C5A6E6DA0E26}_is1) (Version: 2.1.1 - Apowersoft)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-3704150980-58891897-2341478771-1000_Classes\CLSID\{7F902AD4-FC6A-4B2F-8B8D-B6DD4E329B76}\InprocServer32 -> C:\Users\Nutzer\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAW~1.DLL No File

CustomCLSID: HKU\S-1-5-21-3704150980-58891897-2341478771-1000_Classes\CLSID\{A0359AE6-F410-4425-A975-684AAB785ABD}\InprocServer32 -> C:\Users\Nutzer\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAB~1.DLL No File
 

==================== Restore Points  =========================
 

17-12-2014 11:44:57 WD SmartWare Installer

17-12-2014 13:29:20 WD SmartWare Installer

17-12-2014 13:35:57 WD SmartWare Installer

17-12-2014 13:41:58 Installed AVG 2015

17-12-2014 13:45:13 Installed AVG 2015
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {25B84995-B351-4D88-B36A-C079A8D5E535} - System32\Tasks\{947899E3-A472-4FC9-847F-FE127E347140} => pcalua.exe -a "C:\Program Files\Bridge Building Game\uninstall.exe"

Task: {2CCF116C-9C5B-4C5D-AD07-A718C06C4F97} - System32\Tasks\ArcSoft Connect Daemon => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27] (ArcSoft Inc.)

Task: {30A985F5-5DA3-4442-B40E-052E13208192} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-10-24] (Piriform Ltd)

Task: {3A9A55BA-8EAE-4CC6-B553-31F11E201063} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX86\OfficeC2RClient.exe [2014-10-07] (Microsoft Corporation)

Task: {56586E1B-89D8-4529-BC11-125EF0216E29} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {77555E10-F920-49ED-868B-4B499D57CE16} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-09-26] (Oracle Corporation)

Task: {85647C8E-DB50-4793-AB27-322CA0500376} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20] (Adobe Systems Incorporated)

Task: {87A61AF2-1AE6-411C-83D7-2EE18F9D9734} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2014-01-10] ()

Task: {88EE7E85-4980-4915-BCEB-8E805DC26CC7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-29] (Adobe Systems Incorporated)

Task: {8A3D30A7-7B56-48EA-A78B-0CCD25107159} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-10-22] (Microsoft Corporation)

Task: {CBC698CD-D596-46CC-A489-7EE57AF35DDF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {E5443986-477F-4CA6-83F4-8B4A9B90B3A4} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {EFA12D76-4CC6-4794-B5F0-15E13C716136} - System32\Tasks\{D42129E0-D88E-417D-81F3-CD73EB9C65BD} => pcalua.exe -a C:\ProgramData\Wizard101(DE)\Wizard101.exe -d C:\ProgramData\Wizard101(DE)

Task: {FE552259-FABE-4EE4-AFDB-C65DC26E7C6B} - System32\Tasks\{0C719111-5582-4468-87A3-7274AB6AB4CC} => C:\Riot Games\League of Legends\lol.launcher.exe [2012-10-25] ()
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-09-10 10:42 - 2014-07-02 20:42 - 00107992 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll

2014-04-03 11:15 - 2014-05-20 03:11 - 00080040 _____ () C:\Program Files\Microsoft Office 15\ClientX86\ApiClient.dll

2014-12-09 13:36 - 2014-12-09 13:36 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\Services: ACDaemon => 2

MSCONFIG\Services: AdobeARMservice => 2

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3

MSCONFIG\Services: BingDesktopUpdate => 2

MSCONFIG\Services: Bluetooth Device Manager => 3

MSCONFIG\Services: Bluetooth Media Service => 3

MSCONFIG\Services: Bluetooth OBEX Service => 2

MSCONFIG\Services: Creative ALchemy AL6 Licensing Service => 3

MSCONFIG\Services: Creative Audio Engine Licensing Service => 3

MSCONFIG\Services: SkypeUpdate => 2

MSCONFIG\Services: Steam Client Service => 3

MSCONFIG\startupfolder: C:^Users^Nutzer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: BingDesktop => C:\Program Files\Microsoft\BingDesktop\BingDesktop.exe /fromkey

MSCONFIG\startupreg: BTMTrayAgent => rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp

MSCONFIG\startupreg: CanonSolutionMenu => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

MSCONFIG\startupreg: DivXMediaServer => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe

MSCONFIG\startupreg: DivXUpdate => "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

MSCONFIG\startupreg: IAAnotif => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

MSCONFIG\startupreg: MGSysCtrl => C:\Program Files\System Control Manager\MGSysCtrl.exe

MSCONFIG\startupreg: NvBackend => "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe"

MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-3704150980-58891897-2341478771-500 - Administrator - Enabled) => C:\Users\Administrator

Gast (S-1-5-21-3704150980-58891897-2341478771-501 - Limited - Enabled)

HomeGroupUser$ (S-1-5-21-3704150980-58891897-2341478771-1002 - Limited - Enabled)

Nutzer (S-1-5-21-3704150980-58891897-2341478771-1000 - Administrator - Enabled) => C:\Users\Nutzer
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/18/2014 00:36:28 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm FRST(1).exe, Version 17.12.2014.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1aa4
 

Startzeit: 01d01a5221e93c4e
 

Endzeit: 2
 

Anwendungspfad: C:\Users\Nutzer\Downloads\FRST(1).exe
 

Berichts-ID: 834c5c46-8645-11e4-936f-002421f525da
 

Error: (12/17/2014 11:08:50 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: swtor.exe, Version: 1.0.0.0, Zeitstempel: 0x548f140c

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x1670

Startzeit der fehlerhaften Anwendung: 0xswtor.exe0

Pfad der fehlerhaften Anwendung: swtor.exe1

Pfad des fehlerhaften Moduls: swtor.exe2

Berichtskennung: swtor.exe3
 

Error: (12/17/2014 01:04:45 PM) (Source: Microsoft Office 15) (EventID: 2001) (User: )

Description: Microsoft PowerPoint: Rejected Safe Mode action : PowerPoint konnte beim letzten Mal nicht gestartet werden. Der abgesicherte Modus kann Ihnen bei der Problembehandlung behilflich sein. Einige Features sind aber in diesem Modus möglicherweise nicht verfügbar.
 

Möchten Sie im abgesicherten Modus starten?.

Rejected Safe Mode action : Microsoft PowerPoint.
 

Error: (12/17/2014 00:06:25 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm avscan.exe, Version 14.0.7.462 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1620
 

Startzeit: 01d019e957030cae
 

Endzeit: 40804
 

Anwendungspfad: C:\Program Files\Avira\AntiVir Desktop\avscan.exe
 

Berichts-ID: a3f68c72-85dc-11e4-99eb-002421f525da
 

Error: (12/17/2014 11:24:27 AM) (Source: VSS) (EventID: 8193) (User: )

Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070013, Das Medium ist schreibgeschützt.

.
 

Error: (12/17/2014 11:24:27 AM) (Source: VSS) (EventID: 13) (User: )

Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} und dem Namen "CEventSystem" kann nicht gestartet werden. [0x80070013, Das Medium ist schreibgeschützt.

]
 

Error: (12/16/2014 05:52:55 PM) (Source: VSS) (EventID: 12298) (User: )

Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "C:\" nicht gespeichert werden.

Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.

], Leerung[0x00000000, Der Vorgang wurde erfolgreich beendet.

], Freigabe[0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.

], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.

].
 
 

Vorgang:

   Asynchroner Vorgang wird ausgeführt
 

Kontext:

   Aktueller Status: DoSnapshotSet
 

Error: (12/16/2014 05:52:55 PM) (Source: VSS) (EventID: 12310) (User: )

Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten.

Fehlerkontext: DeviceIoControl(\\?\Volume{852b96b2-c1f9-11df-85d6-806e6f6e6963} - 00000104,0x0053c010,00897050,0,00898058,4096,[0]).
 
 

Vorgang:

   Schattenkopien werden übertragen
 

Kontext:

   Ausführungskontext: System Provider
 

Error: (12/16/2014 05:38:41 PM) (Source: VSS) (EventID: 12298) (User: )

Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "C:\" nicht gespeichert werden.

Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.

], Leerung[0x00000000, Der Vorgang wurde erfolgreich beendet.

], Freigabe[0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.

], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.

].
 
 

Vorgang:

   Asynchroner Vorgang wird ausgeführt
 

Kontext:

   Aktueller Status: DoSnapshotSet
 

Error: (12/16/2014 05:38:41 PM) (Source: VSS) (EventID: 12310) (User: )

Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten.

Fehlerkontext: DeviceIoControl(\\?\Volume{852b96b2-c1f9-11df-85d6-806e6f6e6963} - 00000070,0x0053c010,00897050,0,00898058,4096,[0]).
 
 

Vorgang:

   Schattenkopien werden übertragen
 

Kontext:

   Ausführungskontext: System Provider
 
 

System errors:

=============

Error: (12/18/2014 00:53:52 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

sfdrv01

sfsync02

sfvfs02
 

Error: (12/18/2014 00:53:47 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Intel(R) Matrix Storage Event Monitor" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (12/18/2014 00:53:47 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Intel(R) Matrix Storage Event Monitor erreicht.
 

Error: (12/18/2014 00:52:07 AM) (Source: Application Popup) (EventID: 875) (User: )

Description: Treiber sfdrv01.sys konnte nicht geladen werden.
 

Error: (12/18/2014 00:52:07 AM) (Source: Application Popup) (EventID: 875) (User: )

Description: Treiber sfvfs02.sys konnte nicht geladen werden.
 

Error: (12/18/2014 00:52:06 AM) (Source: Application Popup) (EventID: 875) (User: )

Description: Treiber sfsync02.sys konnte nicht geladen werden.
 

Error: (12/17/2014 00:53:25 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

sfdrv01

sfsync02

sfvfs02
 

Error: (12/17/2014 00:52:35 PM) (Source: Application Popup) (EventID: 875) (User: )

Description: Treiber sfdrv01.sys konnte nicht geladen werden.
 

Error: (12/17/2014 00:52:35 PM) (Source: Application Popup) (EventID: 875) (User: )

Description: Treiber sfvfs02.sys konnte nicht geladen werden.
 

Error: (12/17/2014 00:52:34 PM) (Source: Application Popup) (EventID: 875) (User: )

Description: Treiber sfsync02.sys konnte nicht geladen werden.
 
 

Microsoft Office Sessions:

=========================

Error: (05/04/2011 02:55:46 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 10 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (03/23/2011 04:43:39 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 13 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (03/23/2011 04:42:31 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 23 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (03/18/2011 03:00:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i7 CPU Q 720 @ 1.60GHz

Percentage of memory in use: 62%

Total physical RAM: 3054.05 MB

Available physical RAM: 1144.17 MB

Total Pagefile: 6106.38 MB

Available Pagefile: 4021.19 MB

Total Virtual: 2047.88 MB

Available Virtual: 1905.25 MB
 

==================== Drives ================================
 

Drive c: (OS_Install) (Fixed) (Total:273.4 GB) (Free:68.8 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: (Data) (Fixed) (Total:182.26 GB) (Free:57.63 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1BB265CD)

Partition 1: (Not Active) - (Size=10 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=27)

Partition 3: (Not Active) - (Size=273.4 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=182.3 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Und noch die exportierten Ereignisse von Avira Antivir:

Code:

Exportierte Ereignisse:
 

17.12.2014 12:26 [System-Scanner] Malware gefunden

      Die Datei 

      'C:\Users\Nutzer\AppData\Local\Temp\Intention_warm\intention-involve.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114352' 

      [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '57f2cb92.qua' 

      verschoben!
 

17.12.2014 12:25 [Echtzeit-Scanner] Malware gefunden

      In der Datei 

      'C:\Users\Nutzer\AppData\Local\Temp\Intention_warm\intention-involve.exe'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114352' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

17.12.2014 12:18 [System-Scanner] Malware gefunden

      Die Datei 

      'C:\Users\Nutzer\AppData\Local\Temp\Intention_warm\intention-involve.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114352' 

      [trojan].

      Durchgeführte Aktion(en):

      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 

      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26004.

      Die Quelldatei konnte nicht gefunden werden.

      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '51cac90e.qua' 

      verschoben!
 

17.12.2014 12:06 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Roaming\Variety-rush\variety-cable.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114233' 

      [trojan].

      Durchgeführte Aktion(en):

      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 

      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26004.

      Die Quelldatei konnte nicht gefunden werden.

      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.

      Die Datei konnte nicht ins Quarantäneverzeichnis verschoben werden!

      Die Datei existiert nicht!
 

17.12.2014 12:05 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Roaming\Variety-rush\variety-cable.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114233' 

      [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '503ffc07.qua' 

      verschoben!
 

17.12.2014 12:05 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Roaming\Variety-rush\variety-cable.exe'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114233' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

17.12.2014 12:05 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Roaming\Variety-rush\variety-cable.exe'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114233' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

17.12.2014 12:01 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Roaming\Variety-rush\variety-cable.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114233' 

      [trojan].

      Durchgeführte Aktion(en):

      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 

      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26004.

      Die Quelldatei konnte nicht gefunden werden.

      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5061ccd8.qua' 

      verschoben!
 

17.12.2014 11:28 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Roaming\Vegetablebox\vegetableretain.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114366' 

      [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5764ca64.qua' 

      verschoben!

      Der Registrierungseintrag 

      <HKEY_USERS\S-1-5-21-3704150980-58891897-2341478771-1000\SOFTWARE\Microsoft\Wind

      ows\CurrentVersion\Run\vegetableslice> wurde erfolgreich repariert.
 

17.12.2014 11:26 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Roaming\Vegetablebox\vegetableretain.exe'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114366' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

16.12.2014 16:29 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Local\War-manage\wardish.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114186' 

      [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56dec562.qua' 

      verschoben!

      Der Registrierungseintrag 

      <HKEY_USERS\S-1-5-21-3704150980-58891897-2341478771-1000\SOFTWARE\Microsoft\Wind

      ows\CurrentVersion\Run\war-change> wurde erfolgreich repariert.
 

16.12.2014 16:28 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Local\Temp\Kuzlbiuu\dpkpmdienki.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Matsnu.A.287' [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '505ef45f.qua' 

      verschoben!
 

16.12.2014 16:26 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Local\War-manage\wardish.exe'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114186' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

16.12.2014 16:26 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Local\Temp\Kuzlbiuu\dpkpmdienki.exe'

      wurde ein Virus oder unerwünschtes Programm 'TR/Matsnu.A.287' [trojan] gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

16.12.2014 13:08 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Local\Temp\y3kAE1Hp.zip.part'

      enthielt einen Virus oder unerwünschtes Programm 'BDS/Androm.FRMN' [backdoor].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '51ef8069.qua' 

      verschoben!
 

16.12.2014 13:08 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Local\Temp\isfU96r9.zip.part'

      enthielt einen Virus oder unerwünschtes Programm 'BDS/Androm.FRMN' [backdoor].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4975ae0f.qua' 

      verschoben!
 

16.12.2014 00:41 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Local\Temp\{0000DDEC-DD68-42E9}'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.116224' 

      [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48eace7d.qua' 

      verschoben!
 

16.12.2014 00:41 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Local\Temp\{00000CBE-D715-C931}'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.116224' 

      [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '507de1da.qua' 

      verschoben!
 

16.12.2014 00:41 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Local\Temp\{0000E8D1-5713-C707}'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.116224' 

      [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1ab59495.qua' 

      verschoben!
 

16.12.2014 00:40 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Local\Temp\{0000E8D1-5713-C707}'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.116224' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

16.12.2014 00:40 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Local\Temp\{00000CBE-D715-C931}'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.116224' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

16.12.2014 00:40 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Local\Temp\{0000DDEC-DD68-42E9}'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.116224' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

15.12.2014 23:59 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Roaming\Intention-tie\intention_father.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114009' 

      [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '49afd6a0.qua' 

      verschoben!

      Der Registrierungseintrag 

      <HKEY_USERS\S-1-5-21-3704150980-58891897-2341478771-1000\SOFTWARE\Microsoft\Wind

      ows\CurrentVersion\Run\intention-command> wurde erfolgreich repariert.
 

15.12.2014 23:59 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Nutzer\AppData\Local\Vegetable-sing\vegetable-count.exe'

      enthielt einen Virus oder unerwünschtes Programm 'BDS/Androm.FRMN' [backdoor].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50cdf969.qua' 

      verschoben!

      Der Registrierungseintrag 

      <HKEY_USERS\S-1-5-21-3704150980-58891897-2341478771-1000\SOFTWARE\Microsoft\Wind

      ows\CurrentVersion\Run\vegetableslice> wurde erfolgreich repariert.
 

15.12.2014 23:58 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Local\Vegetable-sing\vegetable-count.exe'

      wurde ein Virus oder unerwünschtes Programm 'BDS/Androm.FRMN' [backdoor] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

15.12.2014 23:58 [Echtzeit-Scanner] Malware gefunden

      In der Datei 

      'C:\Users\Nutzer\AppData\Roaming\Intention-tie\intention_father.exe'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114009' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

15.12.2014 23:58 [Echtzeit-Scanner] Malware gefunden

      In der Datei 

      'C:\Users\Nutzer\AppData\Roaming\Intention-tie\intention_father.exe'

      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.114009' [trojan] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

15.12.2014 23:58 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Nutzer\AppData\Local\Vegetable-sing\vegetable-count.exe'

      wurde ein Virus oder unerwünschtes Programm 'BDS/Androm.FRMN' [backdoor] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern

Vielen Dank für die Hilfe schon mal im Vorraus!:dankeschoen:

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hey,
Danke für die schnelle Antwort.
Nachdem der Rechner sich neu gestartet hat, stand kurzzeitig "Zugriff verweigert". Nach 2 Sekunden etwa verschwand diese Information.
Außerdem schaltete sich AVG ein, als sich der Editor öffnete und behauptete, dass diese Datei infiziert sei.

Hier der Log:

Combofix Logfile:

Code:

ComboFix 14-12-14.01 - Nutzer 18.12.2014  10:14:05.1.8 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3054.1151 [GMT 1:00]

ausgeführt von:: c:\users\Nutzer\Desktop\ComboFix.exe

AV: AVG AntiVirus Free Edition 2015 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}

SP: AVG AntiVirus Free Edition 2015 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Nutzer\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll

c:\users\Nutzer\AppData\Roaming\Microsoft\Windows\Recent\desktop_83042752.ico

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-11-18 bis 2014-12-18  ))))))))))))))))))))))))))))))

.

.

2014-12-18 09:25 . 2014-12-18 09:25        --------        d-----w-        c:\users\hedev\AppData\Local\temp

2014-12-18 09:25 . 2014-12-18 09:25        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2014-12-17 23:42 . 2014-12-18 00:00        --------        dc----w-        C:\FRST

2014-12-17 16:06 . 2014-12-17 23:23        --------        d-----w-        c:\users\Nutzer\AppData\Local\Thunderbird

2014-12-17 12:49 . 2014-12-17 12:49        --------        d-----w-        c:\users\Nutzer\AppData\Roaming\AVG2015

2014-12-17 12:47 . 2014-12-17 12:47        --------        d-----w-        c:\users\Nutzer\AppData\Roaming\TuneUp Software

2014-12-17 12:46 . 2014-12-17 12:48        --------        d-----w-        c:\programdata\AVG2015

2014-12-17 12:46 . 2014-12-17 12:46        --------        dc----w-        C:\$AVG

2014-12-17 12:32 . 2014-12-17 12:50        --------        d-----w-        c:\users\Nutzer\AppData\Local\Avg2015

2014-12-17 12:32 . 2014-12-17 12:32        --------        d-----w-        c:\users\Nutzer\AppData\Local\MFAData

2014-12-17 12:02 . 2014-12-17 12:02        --------        d--h--w-        c:\windows\PIF

2014-12-16 15:20 . 2014-12-18 09:17        62576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8C8F8528-4071-451E-ADC3-BFA2542205C2}\offreg.dll

2014-12-16 14:18 . 2014-12-02 11:01        9054624        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8C8F8528-4071-451E-ADC3-BFA2542205C2}\mpengine.dll

2014-12-15 23:29 . 2014-12-15 23:30        --------        d-----w-        c:\program files\Malwarebytes Anti-Malware

2014-12-15 23:29 . 2014-11-21 05:14        51928        ----a-w-        c:\windows\system32\drivers\mwac.sys

2014-12-15 23:29 . 2014-11-21 05:14        75480        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2014-12-15 23:29 . 2014-11-21 05:14        23256        ----a-w-        c:\windows\system32\drivers\mbam.sys

2014-12-15 20:43 . 2014-12-15 20:45        --------        d-----w-        c:\programdata\oiv

2014-12-11 11:56 . 2014-12-11 11:56        --------        d-----w-        c:\users\Nutzer\AppData\Roaming\Apowersoft

2014-12-11 11:56 . 2014-12-11 11:56        --------        d-----w-        c:\program files\Apowersoft

2014-12-06 10:08 . 2014-12-06 10:08        --------        d-----w-        c:\program files\Audacity

2014-12-04 14:38 . 2011-05-13 10:16        493056        ----a-w-        c:\windows\system32\dhRichClient3.dll

2014-12-04 14:38 . 2011-03-25 18:42        338432        ----a-w-        c:\windows\system32\sqlite36_engine.dll

2014-11-26 22:20 . 2010-05-26 10:41        1998168        ----a-w-        c:\windows\system32\D3DX9_43.dll

2014-11-26 22:18 . 2010-06-02 03:55        74072        ----a-w-        c:\windows\system32\XAPOFX1_5.dll

2014-11-26 22:18 . 2010-06-02 03:55        527192        ----a-w-        c:\windows\system32\XAudio2_7.dll

2014-11-26 22:18 . 2010-06-02 03:55        239960        ----a-w-        c:\windows\system32\xactengine3_7.dll

2014-11-26 22:18 . 2010-05-26 10:41        2106216        ----a-w-        c:\windows\system32\D3DCompiler_43.dll

2014-11-26 22:18 . 2010-05-26 10:41        1868128        ----a-w-        c:\windows\system32\d3dcsx_43.dll

2014-11-26 22:18 . 2010-05-26 10:41        470880        ----a-w-        c:\windows\system32\d3dx10_43.dll

2014-11-26 22:18 . 2010-05-26 10:41        248672        ----a-w-        c:\windows\system32\d3dx11_43.dll

2014-11-26 22:18 . 2010-02-04 09:01        74072        ----a-w-        c:\windows\system32\XAPOFX1_4.dll

2014-11-26 22:18 . 2010-02-04 09:01        528216        ----a-w-        c:\windows\system32\XAudio2_6.dll

2014-11-26 22:18 . 2010-02-04 09:01        238936        ----a-w-        c:\windows\system32\xactengine3_6.dll

2014-11-26 22:18 . 2010-02-04 09:01        22360        ----a-w-        c:\windows\system32\X3DAudio1_7.dll

2014-11-21 19:51 . 2014-11-11 02:44        186880        ----a-w-        c:\windows\system32\pku2u.dll

2014-11-21 19:51 . 2014-11-11 02:44        550912        ----a-w-        c:\windows\system32\kerberos.dll

2014-11-18 13:56 . 2014-11-18 13:56        1202848        ----a-w-        c:\windows\system32\FM20.DLL

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-12-18 00:22 . 2013-08-28 16:49        114904        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2014-11-29 07:36 . 2012-05-10 08:36        701104        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2014-11-29 07:36 . 2011-05-16 17:35        71344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2014-11-24 13:04 . 2010-09-16 10:21        229000        ------w-        c:\windows\system32\MpSigStub.exe

2014-11-06 05:42 . 2014-11-06 05:42        341848        ----a-w-        c:\windows\system32\DivXControlPanelApplet.cpl

2014-10-31 10:01 . 2014-10-31 10:01        96680        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll

2014-10-29 20:34 . 2014-10-29 20:34        213784        ----a-w-        c:\windows\system32\drivers\avgidsdriverx.sys

2014-10-25 01:32 . 2014-11-12 08:51        67584        ----a-w-        c:\windows\system32\packager.dll

2014-10-18 01:33 . 2014-11-12 08:51        571904        ----a-w-        c:\windows\system32\oleaut32.dll

2014-10-14 01:56 . 2014-11-12 08:50        136632        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2014-10-14 01:50 . 2014-11-12 08:50        523776        ----a-w-        c:\windows\system32\termsrv.dll

2014-10-14 01:50 . 2014-11-12 08:50        1059840        ----a-w-        c:\windows\system32\lsasrv.dll

2014-10-14 01:47 . 2014-11-12 08:50        146432        ----a-w-        c:\windows\system32\msaudite.dll

2014-10-14 01:46 . 2014-11-12 08:50        681984        ----a-w-        c:\windows\system32\adtschema.dll

2014-10-10 13:13 . 2014-10-10 13:13        200984        ----a-w-        c:\windows\system32\drivers\avgtdix.sys

2014-10-10 00:45 . 2014-11-12 08:51        2379264        ----a-w-        c:\windows\system32\win32k.sys

2014-10-09 12:36 . 2014-01-09 17:36        37384        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2014-10-09 12:36 . 2014-01-09 17:36        98160        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2014-10-09 12:36 . 2014-01-09 17:36        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2014-10-07 09:06 . 2014-04-03 10:30        590536        ----a-w-        c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

2014-10-05 19:42 . 2014-10-05 19:42        98584        ----a-w-        c:\windows\system32\drivers\avgmfx86.sys

2014-10-03 01:44 . 2014-11-12 08:51        442880        ----a-w-        c:\windows\system32\AUDIOKSE.dll

2014-10-03 01:44 . 2014-11-12 08:51        275968        ----a-w-        c:\windows\system32\EncDump.dll

2014-10-03 01:44 . 2014-11-12 08:51        475136        ----a-w-        c:\windows\system32\audiosrv.dll

2014-10-03 01:44 . 2014-11-12 08:51        374784        ----a-w-        c:\windows\system32\AudioEng.dll

2014-10-03 01:44 . 2014-11-12 08:51        195584        ----a-w-        c:\windows\system32\AudioSes.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2014-10-14 16:29        1729752        ----a-w-        c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2014-10-14 16:29        1729752        ----a-w-        c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2014-10-14 16:29        1729752        ----a-w-        c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-11-20 1021128]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-12-04 702768]

"DriveUtilitiesHelper"="c:\program files\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe" [2014-05-23 1852264]

"WD Drive Unlocker"="c:\program files\Western Digital\WD Security\WDDriveAutoUnlock.exe" [2014-05-23 1694048]

"WD Quick View"="c:\program files\Western Digital\WD Quick View\WDDMStatus.exe" [2014-07-22 5562736]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-09-26 271744]

"DivXMediaServer"="c:\program files\DivX\DivX Media Server\DivXMediaServer.exe" [2014-11-17 448856]

"AVG_UI"="c:\program files\AVG\AVG2015\avgui.exe" [2014-11-09 3653136]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"EnableLUA"= 0 (0x0)

.

[HKLM\~\startupfolder\C:^Users^Nutzer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]

path=c:\users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2014-11-20 18:13        1021128        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BingDesktop]

2013-11-01 11:37        2353880        ----a-w-        c:\program files\Microsoft\BingDesktop\BingDesktop.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BTMTrayAgent]

2009-07-23 01:54        17753352        ----a-w-        c:\program files\Motorola\Bluetooth\btmshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]

2009-09-04 01:43        767312        ----a-w-        c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer]

2014-11-17 08:11        448856        ----a-w-        c:\program files\DivX\DivX Media Server\DivXMediaServer.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2014-01-10 05:26        1861968        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

2009-06-04 17:03        186904        ----a-w-        c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvBackend]

2014-04-30 18:28        2199840        ----a-w-        c:\program files\NVIDIA Corporation\Update Core\NvBackend.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2009-10-03 03:43        7772704        ----a-w-        c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2014-09-26 17:19        271744        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun

"ICQ"="c:\program files\ICQ7.2\ICQ.exe" silent loginmode=4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"CanonMyPrinter"=c:\program files\Canon\MyPrinter\BJMyPrt.exe /logon

.

R2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-11-20 166192]

R3 ACRUSBTM;ACRUSBTM;c:\windows\system32\drivers\ACRUSBTM.SYS [2007-08-02 28672]

R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2008-04-25 17920]

R3 BRDriver;BRDriver;c:\programdata\BitRaider\BRDriver.sys [2013-10-19 64808]

R3 BRDriver_1_3_3_E02B25FC;BRDriver_1_3_3_E02B25FC;c:\programdata\BitRaider\support\1.3.3\E02B25FC\BRDriver.sys [x]

R3 BrSerIb;Brother Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [2012-09-06 78960]

R3 BRSptStub;BitRaider Mini-Support Service Stub Loader;c:\programdata\BitRaider\BRSptStub.exe [2014-11-29 363208]

R3 BRSptSvc;BitRaider Mini-Support Service;c:\programdata\BitRaider\BRSptSvc.exe [2013-12-19 477960]

R3 BrUsbSIb;Brother Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [2012-09-06 18800]

R3 BTMCOM;Bluetooth Serial Port;c:\windows\System32\Drivers\btmcom.sys [2009-07-10 40448]

R3 btmhid;btmhid;c:\windows\system32\DRIVERS\btmhid.sys [2009-06-29 27008]

R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys [2009-07-13 516608]

R3 cdiskdun;cdiskdun;c:\users\Nutzer\AppData\Local\Temp\cdiskdun.sys [x]

R3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [2011-06-02 11336]

R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys [2009-05-19 11776]

R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys [2008-04-24 5632]

R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 19720]

R3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;c:\windows\system32\DRIVERS\LGSHidFilt.Sys [2013-01-17 42480]

R3 LGSUsbFilt;Logitech Gaming KMDF USB Filter Driver;c:\windows\system32\DRIVERS\LGSUsbFilt.Sys [2013-01-17 32496]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-24 14856]

R3 netr28;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28.sys [2009-09-11 626688]

R3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]

R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys [2014-06-21 13464]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]

R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 94096]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2013-07-10 11520]

R3 XDva399;XDva399;c:\windows\system32\XDva399.sys [x]

R3 XENfiltv;XENfiltv;c:\windows\system32\drivers\XENfiltv.sys [2009-07-31 17920]

R4 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2014-12-04 993584]

R4 BingDesktopUpdate;Bing Desktop Update service;c:\program files\Microsoft\BingDesktop\BingDesktopUpdater.exe [2013-11-01 173272]

R4 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [2009-07-23 3473672]

R4 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe [2009-07-23 709384]

R4 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe [2009-07-23 474888]

R4 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2014-06-23 79360]

R4 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2014-06-23 79360]

R4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]

R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-13 691696]

S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2014-06-18 147736]

S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2014-07-18 230680]

S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2014-06-18 27416]

S1 Avgdiskx;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiskx.sys [2014-06-18 121624]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2014-10-29 213784]

S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2014-06-18 21272]

S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2014-08-28 192792]

S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2014-10-10 200984]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-12-09 37352]

S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-12-04 431920]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2015\avgidsagent.exe [2014-11-09 3488784]

S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2015\avgwdsvc.exe [2014-11-09 298080]

S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2014-10-09 37384]

S2 ClickToRunSvc;Microsoft Office-Klick-und-Los-Dienst;c:\program files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [2014-10-29 1674928]

S2 NvNetworkService;NVIDIA Network Service;c:\program files\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-04-30 1617696]

S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-04-30 19702048]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-08-06 14808]

S2 WDBackup;WD Backup;c:\program files\Western Digital\WD SmartWare\WDBackupEngine.exe [2014-12-02 1042808]

S2 WDDriveService;WD Drive Manager;c:\program files\Western Digital\WD Drive Manager\WDDriveService.exe [2014-05-23 296312]

S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2009-05-20 59904]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2009-07-15 116064]

S3 NETwNs32;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [2013-11-26 7530736]

S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-04-30 17240]

S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad32v.sys [2014-03-31 34080]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]

.

.

Inhalt des "geplante Tasks" Ordners

.

2014-12-17 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-10 07:36]

.

.

------- Zusätzlicher Suchlauf -------

.

mStart Page = about:blank

IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe

MSConfigStartUp-MGSysCtrl - c:\program files\System Control Manager\MGSysCtrl.exe

AddRemove-5B73F775A90397BAF80173B8A6C0B327BE3872FB - c:\progra~1\DIFX\37C35FE1F6CAE763\DPInst.exe

AddRemove-DVDVideoSoftTB Toolbar - c:\program files\DVDVideoSoftTB\uninstall.exe

AddRemove-LSI Soft Modem - c:\windows\agrsmdel

AddRemove-swtor_swtor - c:\users\nutzer\downloads\BitRaider\bin\brwc.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"=hex:51,66,7a,6c,4c,1d,38,12,e6,58,38,

   83,87,d3,7e,06,c2,c6,ef,58,90,09,a1,e1

"{5018CFD2-804D-4C99-9F81-25EAEA2769DE}"=hex:51,66,7a,6c,4c,1d,38,12,bc,cc,0b,

   54,7f,ce,f7,09,e0,97,66,aa,ef,79,2d,ca

"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,

   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{E87806B5-E908-45FD-AF5E-957D83E58E68}"=hex:51,66,7a,6c,4c,1d,38,12,db,05,6b,

   ec,3a,a7,93,00,d0,48,d6,3d,86,bb,ca,7c

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

   fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

   b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:9a,c1,de,a6,c8,25,cf,01

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\progra~1\AVG\AVG2015\avgrsx.exe

c:\program files\AVG\AVG2015\avgcsrvx.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Creative\Shared Files\CTAudSvc.exe

c:\program files\NVIDIA Corporation\Display\nvxdsync.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files\LSI SoftModem\agrsmsvc.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\windows\system32\taskhost.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\program files\AVG\AVG2015\avgnsx.exe

c:\program files\AVG\AVG2015\avgemcx.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\conhost.exe

c:\program files\NVIDIA Corporation\Display\nvtray.exe

c:\windows\system32\conhost.exe

c:\windows\system32\conhost.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\sppsvc.exe

c:\program files\NVIDIA Corporation\ShadowPlay\nvspcaps.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-12-18  10:33:47 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-12-18 09:33

.

Vor Suchlauf: 9 Verzeichnis(se), 73.712.967.680 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 73.797.521.408 Bytes frei

.

- - End Of File - - 4A44DD543C33E42D87D4DBC0A6A44D98

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31

[/CODE]

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hey,

1. Hier ist der MBAM Log:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 19.12.2014

Suchlauf-Zeit: 01:34:05

Logdatei: MBAM.txt

Administrator: Ja
 

Version: 2.00.4.1028

Malware Datenbank: v2014.12.18.06

Rootkit Datenbank: v2014.12.14.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x86

Dateisystem: NTFS

Benutzer: Nutzer
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 392941

Verstrichene Zeit: 25 Min, 24 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente erkannt)
 

Module: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsschlüssel: 0

(Keine schädliche Elemente erkannt)
 

Registrierungswerte: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsdaten: 0

(Keine schädliche Elemente erkannt)
 

Ordner: 0

(Keine schädliche Elemente erkannt)
 

Dateien: 0

(Keine schädliche Elemente erkannt)
 

Physische Sektoren: 0

(Keine schädliche Elemente erkannt)
 
 

(end)

2. Zum ADWCleaner Folgendes: Das habe ich bereits einmal durchgeführt, bevor ich mich hier meldete. Ich kann demnach nur das beisteuern:

AdwCleaner Logfile:

Code:

# AdwCleaner v4.105 - Bericht erstellt am 19/12/2014 um 02:06:30

# Aktualisiert 08/12/2014 von Xplode

# Database : 2014-12-16.1 [Live]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)

# Benutzername : Nutzer - FRANK

# Gestartet von : C:\Users\Nutzer\Downloads\adwcleaner_4.105.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.17183
 
 

-\\ Mozilla Firefox v34.0.5 (x86 de)
 
 

*************************
 

AdwCleaner[R2].txt - [857 octets] - [19/12/2014 02:03:37]

AdwCleaner[S1].txt - [779 octets] - [19/12/2014 02:06:30]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [838 octets] ##########

--- --- ---

3. Junkware Removal Tool:

JRT Logfile:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.0 (11.29.2014:1)

OS: Windows 7 Home Premium x86

Ran by Nutzer on 19.12.2014 at  2:13:39,32

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] "hkey_current_user\software\classes\typelib\{006ad7b2-968a-11de-88c9-5bde55d89593}"

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A96C7C46-0E39-47F0-8FA7-AD5DE565AC63}
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Nutzer\AppData\Roaming\mozilla\firefox\profiles\g8ntqui0.default-1417564587162\minidumps [1 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 19.12.2014 at  2:16:59,54

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--- --- ---

4. Und wie gewünscht ein frisches FRST log:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014

Ran by Nutzer (administrator) on FRANK on 19-12-2014 02:18:51

Running from C:\Users\Nutzer\Desktop

Loaded Profile: Nutzer (Available profiles: Nutzer & Administrator)

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 10

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Security\WDDriveAutoUnlock.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe

(Farbar) C:\Users\Nutzer\Desktop\FRST(1).exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-04] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [DriveUtilitiesHelper] => C:\Program Files\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe [1852264 2014-05-23] (Western Digital Technologies, Inc.)

HKLM\...\Run: [WD Drive Unlocker] => C:\Program Files\Western Digital\WD Security\WDDriveAutoUnlock.exe [1694048 2014-05-23] (Western Digital Technologies, Inc.)

HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe [5562736 2014-07-22] (Western Digital Technologies, Inc.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)

HKLM\...\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [448856 2014-11-17] (DivX, LLC)

HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3653136 2014-11-09] (AVG Technologies CZ, s.r.o.)

ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKU\S-1-5-21-3704150980-58891897-2341478771-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()

FF Plugin: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)

FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)

FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3704150980-58891897-2341478771-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\searchplugins\google-maps.xml

FF Extension: Adblock Plus - C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-07]

FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-12-09]

FF HKLM\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn

FF HKU\S-1-5-21-3704150980-58891897-2341478771-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\extensions\cliqz@cliqz.com
 

Chrome: 

=======
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S4 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-03-27] (LSI Corporation)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-04] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-04] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-04] (Avira Operations GmbH & Co. KG)

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3488784 2014-11-09] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-11-09] (AVG Technologies CZ, s.r.o.)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

S4 BingDesktopUpdate; C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)

S4 Bluetooth Device Manager; C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe [3473672 2009-07-23] (Motorola, Inc.)

S4 Bluetooth Media Service; C:\Program Files\Motorola\Bluetooth\audiosrv.exe [709384 2009-07-23] (Motorola, Inc.)

S4 Bluetooth OBEX Service; C:\Program Files\Motorola\Bluetooth\obexsrv.exe [474888 2009-07-23] (Motorola, Inc.)

S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-11-29] (BitRaider, LLC)

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2013-12-19] (BitRaider, LLC)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1674928 2014-10-29] (Microsoft Corporation)

S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-06-23] (Creative Labs) [File not signed]

S4 Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-06-23] (Creative Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [423424 2011-10-19] (Creative Technology Ltd) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2009-10-26] (Macrovision Europe Ltd.) [File not signed]

R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19702048 2014-04-30] (NVIDIA Corporation)

R2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2014-12-02] (Western Digital Technologies, Inc.)

R2 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [296312 2014-05-23] (Western Digital Technologies, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 ACRUSBTM; C:\windows\system32\drivers\ACRUSBTM.SYS [28672 2007-08-02] () [File not signed]

S3 ArcSoftKsUFilter; C:\windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17920 2008-04-25] (ArcSoft, Inc.)

R1 Avgdiskx; C:\windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\windows\System32\DRIVERS\avgidsdriverx.sys [213784 2014-10-29] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHX; C:\windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSShim; C:\windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx86; C:\windows\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)

R0 Avglogx; C:\windows\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx86; C:\windows\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-09] (Avira Operations GmbH & Co. KG)

R0 Avgrkx86; C:\windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgtdix; C:\windows\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)

R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-10-09] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [37384 2014-10-09] (Avira Operations GmbH & Co. KG)

S3 BRDriver; C:\ProgramData\BitRaider\BRDriver.sys [64808 2013-10-19] (BitRaider)

S3 BTMCOM; C:\windows\System32\Drivers\btmcom.sys [40448 2009-07-10] (Motorola, Inc.)

S3 btmhid; C:\windows\system32\DRIVERS\btmhid.sys [27008 2009-06-29] (Motorola, Inc.)

S3 BTMUSB; C:\windows\System32\Drivers\btmusb.sys [516608 2009-07-13] (Motorola, Inc.)

S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()

S3 enecirhid; C:\windows\system32\DRIVERS\enecirhid.sys [11776 2009-05-19] (ENE TECHNOLOGY INC.)

S3 enecirhidma; C:\windows\system32\DRIVERS\enecirhidma.sys [5632 2008-04-24] (ENE TECHNOLOGY INC.)

S3 LGBusEnum; C:\windows\System32\drivers\LGBusEnum.sys [19720 2009-11-24] (Logitech Inc.)

S3 LGSHidFilt; C:\windows\System32\DRIVERS\LGSHidFilt.Sys [42480 2013-01-17] (Logitech Inc.)

S3 LGSUsbFilt; C:\windows\System32\DRIVERS\LGSUsbFilt.Sys [32496 2013-01-17] (Logitech Inc.)

S3 LGVirHid; C:\windows\System32\drivers\LGVirHid.sys [14856 2009-11-24] (Logitech Inc.)

S3 LUsbFilt; C:\windows\System32\Drivers\LUsbFilt.Sys [30360 2011-09-02] (Logitech, Inc.)

R3 NETwNs32; C:\windows\System32\DRIVERS\NETwNs32.sys [7530736 2013-11-26] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [17240 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\windows\System32\drivers\nvvad32v.sys [34080 2014-03-31] (NVIDIA Corporation)

R2 SecDrv; C:\windows\system32\drivers\SECDRV.SYS [163644 2012-04-22] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed]

S0 sfdrv01; C:\windows\System32\drivers\sfdrv01.sys [50688 2005-08-10] (Protection Technology) [File not signed]

R0 sfhlp02; C:\windows\System32\drivers\sfhlp02.sys [6656 2005-05-16] (Protection Technology) [File not signed]

S0 sfsync02; C:\windows\System32\drivers\sfsync02.sys [19968 2005-08-10] (Protection Technology) [File not signed]

S0 sfvfs02; C:\windows\System32\drivers\sfvfs02.sys [66048 2005-09-29] (Protection Technology) [File not signed]

S4 sptd; C:\windows\System32\Drivers\sptd.sys [691696 2010-11-13] (Duplex Secure Ltd.)

R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)

S3 SWDUMon; C:\windows\System32\DRIVERS\SWDUMon.sys [13464 2014-06-21] ()

R2 TurboB; C:\windows\System32\DRIVERS\TurboB.sys [14808 2009-08-06] ()

S3 XENfiltv; C:\windows\System32\drivers\XENfiltv.sys [17920 2009-07-31] (Creative Technology Ltd.)

U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

S3 BRDriver_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver.sys [X]

S3 catchme; \??\C:\Users\Nutzer\AppData\Local\Temp\catchme.sys [X]

S3 cdiskdun; \??\C:\Users\Nutzer\AppData\Local\Temp\cdiskdun.sys [X]

S3 smserial; system32\DRIVERS\smserial.sys [X]

S3 XDva399; \??\C:\windows\system32\XDva399.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-19 02:18 - 2014-12-19 02:18 - 00019904 _____ () C:\Users\Nutzer\Desktop\FRST.txt

2014-12-19 02:16 - 2014-12-19 02:16 - 00001041 _____ () C:\Users\Nutzer\Desktop\JRT.txt

2014-12-19 02:13 - 2014-12-19 02:13 - 01707646 _____ (Thisisu) C:\Users\Nutzer\Downloads\JRT.exe

2014-12-19 02:13 - 2014-12-19 02:13 - 00000000 ____D () C:\windows\ERUNT

2014-12-19 02:10 - 2014-12-19 02:10 - 00000917 _____ () C:\Users\Nutzer\Desktop\AdwCleaner[S1].txt

2014-12-19 02:03 - 2014-12-19 02:06 - 00000000 ___DC () C:\AdwCleaner

2014-12-19 02:02 - 2014-12-19 02:02 - 00001204 _____ () C:\Users\Nutzer\Desktop\MBAM.txt

2014-12-18 10:33 - 2014-12-18 10:33 - 00023503 ____C () C:\ComboFix.txt

2014-12-18 10:11 - 2014-12-18 10:33 - 00000000 ___DC () C:\Qoobox

2014-12-18 10:11 - 2011-06-26 07:45 - 00256000 _____ () C:\windows\PEV.exe

2014-12-18 10:11 - 2010-11-07 18:20 - 00208896 _____ () C:\windows\MBR.exe

2014-12-18 10:11 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00098816 _____ () C:\windows\sed.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00080412 _____ () C:\windows\grep.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00068096 _____ () C:\windows\zip.exe

2014-12-18 10:10 - 2014-12-18 10:32 - 00000000 ____D () C:\windows\erdnt

2014-12-18 10:06 - 2014-12-18 10:07 - 05601641 ____R (Swearware) C:\Users\Nutzer\Desktop\ComboFix.exe

2014-12-18 01:13 - 2014-12-18 01:13 - 00021716 _____ () C:\Users\Nutzer\Desktop\Ereignisse AVIRA.txt

2014-12-18 00:58 - 2014-12-18 01:00 - 00035111 _____ () C:\Users\Nutzer\Desktop\Addition.txt

2014-12-18 00:56 - 2014-12-18 01:00 - 00035752 _____ () C:\Users\Nutzer\Desktop\FRST(alt).txt

2014-12-18 00:49 - 2014-12-18 00:49 - 00000634 _____ () C:\Users\Nutzer\Desktop\defogger_disable.log

2014-12-18 00:49 - 2014-12-18 00:49 - 00000020 _____ () C:\Users\Nutzer\defogger_reenable

2014-12-18 00:48 - 2014-12-18 00:48 - 00050477 _____ () C:\Users\Nutzer\Desktop\Defogger.exe

2014-12-18 00:42 - 2014-12-19 02:19 - 00000000 ___DC () C:\FRST

2014-12-18 00:42 - 2014-12-18 00:42 - 01113600 _____ (Farbar) C:\Users\Nutzer\Desktop\FRST(1).exe

2014-12-18 00:30 - 2014-12-18 00:30 - 00000000 _____ () C:\Users\Nutzer\Downloads\FRST.exe

2014-12-17 17:06 - 2014-12-18 00:23 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Thunderbird

2014-12-17 13:49 - 2014-12-17 13:49 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\AVG2015

2014-12-17 13:47 - 2014-12-17 13:47 - 00000961 _____ () C:\Users\Public\Desktop\AVG 2015.lnk

2014-12-17 13:47 - 2014-12-17 13:47 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\TuneUp Software

2014-12-17 13:47 - 2014-12-17 13:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2014-12-17 13:46 - 2014-12-17 13:48 - 00000000 ____D () C:\ProgramData\AVG2015

2014-12-17 13:46 - 2014-12-17 13:46 - 00000000 ___DC () C:\$AVG

2014-12-17 13:32 - 2014-12-17 13:50 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Avg2015

2014-12-17 13:32 - 2014-12-17 13:32 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\MFAData

2014-12-17 13:25 - 2014-12-17 13:31 - 157569304 _____ (AVG Technologies) C:\Users\Nutzer\Downloads\avg_free_x86_all_2015_5577a8546.exe

2014-12-17 13:02 - 2014-12-17 13:02 - 00000000 ___HD () C:\windows\PIF

2014-12-17 12:56 - 2014-12-18 15:17 - 00008589 _____ () C:\Users\Nutzer\Downloads\hijackthis.log

2014-12-17 11:45 - 2014-12-18 14:49 - 00000000 ____D () C:\Users\Nutzer\Downloads\backups

2014-12-17 11:34 - 2014-12-17 12:56 - 00000000 ____D () C:\Users\Nutzer\Downloads\swtor

2014-12-17 11:27 - 2014-12-17 11:27 - 00119904 _____ () C:\Users\Nutzer\AppData\Local\GDIPFONTCACHEV1.DAT

2014-12-16 00:54 - 2014-12-16 00:54 - 02166272 _____ () C:\Users\Nutzer\Downloads\adwcleaner_4.105.exe

2014-12-16 00:30 - 2014-12-16 00:30 - 00001070 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-16 00:30 - 2014-12-16 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-16 00:29 - 2014-12-16 00:30 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-12-16 00:29 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-12-16 00:29 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2014-12-16 00:29 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-12-16 00:04 - 2014-12-16 00:04 - 00001105 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-12-15 21:43 - 2014-12-15 21:45 - 00000000 ____D () C:\ProgramData\oiv

2014-12-11 14:21 - 2014-12-11 14:24 - 62506964 _____ () C:\Users\Nutzer\Desktop\Walk in the snø!.wav

2014-12-11 12:56 - 2014-12-12 14:28 - 00000000 ____D () C:\Users\Nutzer\Documents\YouTube To MP3

2014-12-11 12:56 - 2014-12-11 12:56 - 00001192 _____ () C:\Users\Public\Desktop\YouTube To MP3.lnk

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\Apowersoft

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apowersoft

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\Program Files\Apowersoft

2014-12-11 12:55 - 2014-12-11 12:55 - 08646688 _____ (Apowersoft ) C:\Users\Nutzer\Downloads\youtube-to-mp3.exe

2014-12-11 09:13 - 2014-11-21 08:18 - 00042496 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-12-11 09:13 - 2014-11-21 08:17 - 14364672 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 01762816 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 01181696 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00523264 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00080384 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 13758976 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 02861568 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 02054656 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 01441280 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-12-11 09:13 - 2014-11-21 08:16 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00493056 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00391168 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00357888 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00109056 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00033280 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-12-11 09:13 - 2014-11-21 07:54 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-12-11 09:13 - 2014-11-21 07:24 - 00361984 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2014-12-11 09:13 - 2014-11-21 06:59 - 00071680 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2014-12-11 09:13 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll

2014-12-09 13:36 - 2014-12-09 13:36 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-12-09 10:14 - 2014-12-09 10:14 - 01062072 _____ (Microsoft Corporation) C:\Users\Nutzer\Downloads\Setup.X86.de-de_O365ProPlusRetail_49e0d883-c5d2-4ca1-980d-bd808bbc2c30_TX_PR_.exe

2014-12-06 11:08 - 2014-12-06 11:08 - 00000987 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk

2014-12-06 11:08 - 2014-12-06 11:08 - 00000975 _____ () C:\Users\Public\Desktop\Audacity.lnk

2014-12-06 11:08 - 2014-12-06 11:08 - 00000000 ____D () C:\Program Files\Audacity

2014-12-04 15:38 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\system32\dhRichClient3.dll

2014-12-04 15:38 - 2011-03-25 19:42 - 00338432 _____ () C:\windows\system32\sqlite36_engine.dll

2014-11-26 23:20 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\system32\D3DX9_43.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\windows\system32\XAudio2_7.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\windows\system32\xactengine3_7.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\windows\system32\XAPOFX1_5.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\windows\system32\D3DCompiler_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\windows\system32\d3dcsx_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\windows\system32\d3dx10_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\windows\system32\d3dx11_43.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\windows\system32\XAudio2_6.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\windows\system32\xactengine3_6.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\windows\system32\XAPOFX1_4.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\windows\system32\X3DAudio1_7.dll

2014-11-22 11:30 - 2014-11-22 11:32 - 69279069 _____ () C:\Users\Nutzer\Downloads\ANDOR_Into_the_North.zip

2014-11-21 20:51 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2014-11-21 20:51 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-19 02:17 - 2014-08-30 10:30 - 00008192 _____ () C:\windows\system32\WDPABKP.dat

2014-12-19 02:09 - 2013-08-02 09:19 - 00273710 _____ () C:\windows\PFRO.log

2014-12-19 02:09 - 2013-06-25 09:19 - 00130633 _____ () C:\windows\setupact.log

2014-12-19 02:09 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-12-19 02:07 - 2010-09-16 10:28 - 01285640 _____ () C:\windows\WindowsUpdate.log

2014-12-19 01:41 - 2012-10-28 11:13 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job

2014-12-19 01:34 - 2013-08-28 17:49 - 00114904 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamswissarmy.sys

2014-12-19 01:30 - 2011-07-13 12:15 - 00000000 ____D () C:\ProgramData\MFAData

2014-12-18 19:41 - 2012-01-06 12:20 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\TS3Client

2014-12-18 12:12 - 2009-10-26 21:54 - 01658436 _____ () C:\windows\system32\PerfStringBackup.INI

2014-12-18 12:04 - 2009-07-14 05:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-18 12:04 - 2009-07-14 05:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-18 10:33 - 2009-07-14 03:37 - 00000000 __RHD () C:\Users\Default

2014-12-18 10:33 - 2009-07-14 03:37 - 00000000 ___RD () C:\Users\Public

2014-12-18 10:27 - 2009-07-14 03:04 - 00000215 ____C () C:\windows\system.ini

2014-12-18 10:04 - 2014-06-11 08:15 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird

2014-12-18 00:49 - 2010-09-16 10:30 - 00000000 ___HD () C:\Users\Nutzer

2014-12-17 15:35 - 2010-09-16 10:30 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\VirtualStore

2014-12-17 13:43 - 2011-07-13 12:28 - 00000000 ____D () C:\Program Files\AVG

2014-12-17 13:36 - 2014-08-14 09:18 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-17 13:35 - 2014-06-21 10:50 - 00069760 _____ () C:\windows\DPINST.LOG

2014-12-17 13:34 - 2014-08-31 08:22 - 00000000 ____D () C:\Program Files\Common Files\Western Digital

2014-12-17 13:34 - 2014-08-30 10:28 - 00000000 ____D () C:\ProgramData\Western Digital

2014-12-17 13:34 - 2014-08-30 10:28 - 00000000 ____D () C:\Program Files\Western Digital

2014-12-17 12:54 - 2009-07-14 03:04 - 00000441 _____ () C:\windows\win.ini

2014-12-16 17:39 - 2009-07-14 05:52 - 00000000 ____D () C:\windows\system32\FxsTmp

2014-12-16 01:51 - 2009-07-14 05:52 - 00000000 ____D () C:\windows\Performance

2014-12-16 00:29 - 2013-06-09 10:57 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-16 00:04 - 2014-01-09 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-16 00:04 - 2014-01-09 18:36 - 00000000 ____D () C:\Program Files\Avira

2014-12-14 23:18 - 2010-09-19 20:30 - 00000000 ____D () C:\ProgramData\DivX

2014-12-14 23:17 - 2013-10-28 12:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX

2014-12-14 23:17 - 2010-09-19 20:30 - 00000000 ____D () C:\Program Files\DivX

2014-12-14 23:17 - 2010-09-19 20:30 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared

2014-12-11 12:12 - 2009-10-26 21:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-11 12:10 - 2013-07-14 07:40 - 00000000 ____D () C:\windows\system32\MRT

2014-12-11 12:03 - 2010-09-16 11:46 - 109818608 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-12-10 09:56 - 2013-05-01 09:14 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-12-10 09:53 - 2012-05-02 19:53 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-12-09 10:19 - 2014-04-03 11:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2014-12-09 10:18 - 2014-04-03 11:15 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-12-02 11:19 - 2014-06-15 18:17 - 00021947 _____ () C:\Users\Nutzer\Desktop\Bücherliste.xlsx

2014-11-29 22:13 - 2014-08-21 19:56 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Adobe

2014-11-29 08:39 - 2013-07-31 14:22 - 00000000 ____D () C:\ProgramData\BitRaider

2014-11-29 08:36 - 2012-05-10 09:36 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe

2014-11-29 08:36 - 2011-05-16 18:35 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

2014-11-25 11:39 - 2014-03-26 18:25 - 00000000 ____D () C:\Program Files\Steam

2014-11-24 14:04 - 2010-09-16 11:21 - 00229000 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-11-22 11:10 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
 

Some content of TEMP:

====================

C:\Users\Nutzer\AppData\Local\Temp\avgnt.exe

C:\Users\Nutzer\AppData\Local\Temp\Quarantine.exe

C:\Users\Nutzer\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\windows\explorer.exe => File is digitally signed

C:\windows\system32\winlogon.exe => File is digitally signed

C:\windows\system32\wininit.exe => File is digitally signed

C:\windows\system32\svchost.exe => File is digitally signed

C:\windows\system32\services.exe => File is digitally signed

C:\windows\system32\User32.dll => File is digitally signed

C:\windows\system32\userinit.exe => File is digitally signed

C:\windows\system32\rpcss.dll => File is digitally signed

C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-15 17:44
 

==================== End Of Log ============================

--- --- ---

Vielen Dank schon bis hierher. Haben ja schon einige (hoffentlich damit alle) Viren etc. erwischt.
Gruß Jarvan

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hallo Schrauber,

ich habe meine externe Festplatte schon sehr lange nicht angeschlossen. Erst recht noch nicht seit ich die infizierte Email geöffnet habe. Ich kann sie auch jetzt nicht anschließen, weil ich nicht zu Hause bin. Ich hoffe das hat keinen Einfluss auf das Ergebnis des Scans.

1. Die ESET Log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=6b39850a066e734ab19e576e12bcada1

# engine=21644

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-12-20 11:13:04

# local_time=2014-12-20 12:13:04 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='AVG AntiVirus Free Edition 2015'

# compatibility_mode=1055 16777213 100 100 93043 106207968 0 0

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1810 16777213 100 100 9336 32492146 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 177969 170705175 0 0

# scanned=107671

# found=0

# cleaned=0

# scan_time=8456

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=6b39850a066e734ab19e576e12bcada1

# engine=21644

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-12-20 04:06:13

# local_time=2014-12-20 05:06:13 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='AVG AntiVirus Free Edition 2015'

# compatibility_mode=1055 16777213 100 100 110632 106225557 0 0

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1810 16777213 100 100 26925 32509735 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 195558 170722764 0 0

# scanned=308717

# found=0

# cleaned=0

# scan_time=17501

2. Der SecurityCheck:

Code:

 Results of screen317's Security Check version 0.99.93  

 Windows 7 Service Pack 1 x86 (UAC is disabled!)  

 Internet Explorer 10 Out of date! 
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop                     

AVG AntiVirus Free Edition 2015   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 CCleaner     

 Java 7 Update 71  

  Adobe Flash Player         15.0.0.239 Flash Player out of Date!  

 Adobe Reader XI  

 Mozilla Firefox (34.0.5) 

 Mozilla Thunderbird (24.6.0) 
 ````````Process Check: objlist.exe by Laurent````````  

 AVG avgwdsvc.exe 

 AVG avgrsx.exe 

 AVG avgnsx.exe 

 AVG avgemc.exe 

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Und als Letztes das frische FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-12-2014

Ran by Nutzer (administrator) on FRANK on 20-12-2014 17:22:33

Running from C:\Users\Nutzer\Desktop\Trojanerboard

Loaded Profile: Nutzer (Available profiles: Nutzer & Administrator)

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 10

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Security\WDDriveAutoUnlock.exe

(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-04] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [DriveUtilitiesHelper] => C:\Program Files\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe [1852264 2014-05-23] (Western Digital Technologies, Inc.)

HKLM\...\Run: [WD Drive Unlocker] => C:\Program Files\Western Digital\WD Security\WDDriveAutoUnlock.exe [1694048 2014-05-23] (Western Digital Technologies, Inc.)

HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe [5562736 2014-07-22] (Western Digital Technologies, Inc.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)

HKLM\...\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [448856 2014-11-17] (DivX, LLC)

HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3653136 2014-11-09] (AVG Technologies CZ, s.r.o.)

ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/

HKU\S-1-5-21-3704150980-58891897-2341478771-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKU\S-1-5-21-3704150980-58891897-2341478771-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()

FF Plugin: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)

FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)

FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3704150980-58891897-2341478771-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\searchplugins\google-maps.xml

FF Extension: Adblock Plus - C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-07]

FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-12-09]

FF HKLM\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn

FF HKU\S-1-5-21-3704150980-58891897-2341478771-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\g8ntqui0.default-1417564587162\extensions\cliqz@cliqz.com
 

Chrome: 

=======
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S4 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-03-27] (LSI Corporation)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-04] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-04] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-04] (Avira Operations GmbH & Co. KG)

S2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3488784 2014-11-09] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-11-09] (AVG Technologies CZ, s.r.o.)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

S4 BingDesktopUpdate; C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)

S4 Bluetooth Device Manager; C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe [3473672 2009-07-23] (Motorola, Inc.)

S4 Bluetooth Media Service; C:\Program Files\Motorola\Bluetooth\audiosrv.exe [709384 2009-07-23] (Motorola, Inc.)

S4 Bluetooth OBEX Service; C:\Program Files\Motorola\Bluetooth\obexsrv.exe [474888 2009-07-23] (Motorola, Inc.)

S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-11-29] (BitRaider, LLC)

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2013-12-19] (BitRaider, LLC)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1674928 2014-10-29] (Microsoft Corporation)

S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-06-23] (Creative Labs) [File not signed]

S4 Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-06-23] (Creative Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [423424 2011-10-19] (Creative Technology Ltd) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2009-10-26] (Macrovision Europe Ltd.) [File not signed]

R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19702048 2014-04-30] (NVIDIA Corporation)

R2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2014-12-02] (Western Digital Technologies, Inc.)

R2 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [296312 2014-05-23] (Western Digital Technologies, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 ACRUSBTM; C:\windows\system32\drivers\ACRUSBTM.SYS [28672 2007-08-02] () [File not signed]

S3 ArcSoftKsUFilter; C:\windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17920 2008-04-25] (ArcSoft, Inc.)

R1 Avgdiskx; C:\windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\windows\System32\DRIVERS\avgidsdriverx.sys [213784 2014-10-29] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHX; C:\windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSShim; C:\windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx86; C:\windows\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)

R0 Avglogx; C:\windows\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx86; C:\windows\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-09] (Avira Operations GmbH & Co. KG)

R0 Avgrkx86; C:\windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgtdix; C:\windows\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)

R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-10-09] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [37384 2014-10-09] (Avira Operations GmbH & Co. KG)

S3 BRDriver; C:\ProgramData\BitRaider\BRDriver.sys [64808 2013-10-19] (BitRaider)

S3 BTMCOM; C:\windows\System32\Drivers\btmcom.sys [40448 2009-07-10] (Motorola, Inc.)

S3 btmhid; C:\windows\system32\DRIVERS\btmhid.sys [27008 2009-06-29] (Motorola, Inc.)

S3 BTMUSB; C:\windows\System32\Drivers\btmusb.sys [516608 2009-07-13] (Motorola, Inc.)

S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()

S3 enecirhid; C:\windows\system32\DRIVERS\enecirhid.sys [11776 2009-05-19] (ENE TECHNOLOGY INC.)

S3 enecirhidma; C:\windows\system32\DRIVERS\enecirhidma.sys [5632 2008-04-24] (ENE TECHNOLOGY INC.)

S3 LGBusEnum; C:\windows\System32\drivers\LGBusEnum.sys [19720 2009-11-24] (Logitech Inc.)

S3 LGSHidFilt; C:\windows\System32\DRIVERS\LGSHidFilt.Sys [42480 2013-01-17] (Logitech Inc.)

S3 LGSUsbFilt; C:\windows\System32\DRIVERS\LGSUsbFilt.Sys [32496 2013-01-17] (Logitech Inc.)

S3 LGVirHid; C:\windows\System32\drivers\LGVirHid.sys [14856 2009-11-24] (Logitech Inc.)

S3 LUsbFilt; C:\windows\System32\Drivers\LUsbFilt.Sys [30360 2011-09-02] (Logitech, Inc.)

R3 NETwNs32; C:\windows\System32\DRIVERS\NETwNs32.sys [7530736 2013-11-26] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [17240 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\windows\System32\drivers\nvvad32v.sys [34080 2014-03-31] (NVIDIA Corporation)

R2 SecDrv; C:\windows\system32\drivers\SECDRV.SYS [163644 2012-04-22] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed]

S0 sfdrv01; C:\windows\System32\drivers\sfdrv01.sys [50688 2005-08-10] (Protection Technology) [File not signed]

R0 sfhlp02; C:\windows\System32\drivers\sfhlp02.sys [6656 2005-05-16] (Protection Technology) [File not signed]

S0 sfsync02; C:\windows\System32\drivers\sfsync02.sys [19968 2005-08-10] (Protection Technology) [File not signed]

S0 sfvfs02; C:\windows\System32\drivers\sfvfs02.sys [66048 2005-09-29] (Protection Technology) [File not signed]

S4 sptd; C:\windows\System32\Drivers\sptd.sys [691696 2010-11-13] (Duplex Secure Ltd.)

R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)

S3 SWDUMon; C:\windows\System32\DRIVERS\SWDUMon.sys [13464 2014-06-21] ()

R2 TurboB; C:\windows\System32\DRIVERS\TurboB.sys [14808 2009-08-06] ()

S3 XENfiltv; C:\windows\System32\drivers\XENfiltv.sys [17920 2009-07-31] (Creative Technology Ltd.)

U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

S3 BRDriver_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver.sys [X]

S3 catchme; \??\C:\Users\Nutzer\AppData\Local\Temp\catchme.sys [X]

S3 cdiskdun; \??\C:\Users\Nutzer\AppData\Local\Temp\cdiskdun.sys [X]

S3 smserial; system32\DRIVERS\smserial.sys [X]

S3 XDva399; \??\C:\windows\system32\XDva399.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-20 12:13 - 2014-12-20 12:13 - 02347384 _____ (ESET) C:\Users\Nutzer\Downloads\esetsmartinstaller_deu(1).exe

2014-12-20 09:47 - 2014-12-20 09:47 - 00000000 ____D () C:\Program Files\ESET

2014-12-20 09:44 - 2014-12-20 09:44 - 02347384 _____ (ESET) C:\Users\Nutzer\Downloads\esetsmartinstaller_deu.exe

2014-12-20 09:33 - 2014-12-20 09:34 - 00852505 _____ () C:\Users\Nutzer\Desktop\SecurityCheck.exe

2014-12-19 02:32 - 2014-12-20 17:22 - 00000000 ____D () C:\Users\Nutzer\Desktop\Trojanerboard

2014-12-19 02:13 - 2014-12-19 02:13 - 01707646 _____ (Thisisu) C:\Users\Nutzer\Downloads\JRT.exe

2014-12-19 02:13 - 2014-12-19 02:13 - 00000000 ____D () C:\windows\ERUNT

2014-12-19 02:03 - 2014-12-19 02:06 - 00000000 ___DC () C:\AdwCleaner

2014-12-18 10:33 - 2014-12-18 10:33 - 00023503 ____C () C:\ComboFix.txt

2014-12-18 10:11 - 2014-12-18 10:33 - 00000000 ___DC () C:\Qoobox

2014-12-18 10:11 - 2011-06-26 07:45 - 00256000 _____ () C:\windows\PEV.exe

2014-12-18 10:11 - 2010-11-07 18:20 - 00208896 _____ () C:\windows\MBR.exe

2014-12-18 10:11 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00098816 _____ () C:\windows\sed.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00080412 _____ () C:\windows\grep.exe

2014-12-18 10:11 - 2000-08-31 01:00 - 00068096 _____ () C:\windows\zip.exe

2014-12-18 10:10 - 2014-12-18 10:32 - 00000000 ____D () C:\windows\erdnt

2014-12-18 10:06 - 2014-12-18 10:07 - 05601641 ____R (Swearware) C:\Users\Nutzer\Desktop\ComboFix.exe

2014-12-18 00:49 - 2014-12-18 00:49 - 00000020 _____ () C:\Users\Nutzer\defogger_reenable

2014-12-18 00:42 - 2014-12-20 17:22 - 00000000 ___DC () C:\FRST

2014-12-18 00:30 - 2014-12-18 00:30 - 00000000 _____ () C:\Users\Nutzer\Downloads\FRST.exe

2014-12-17 17:06 - 2014-12-18 00:23 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Thunderbird

2014-12-17 13:49 - 2014-12-17 13:49 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\AVG2015

2014-12-17 13:47 - 2014-12-17 13:47 - 00000961 _____ () C:\Users\Public\Desktop\AVG 2015.lnk

2014-12-17 13:47 - 2014-12-17 13:47 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\TuneUp Software

2014-12-17 13:47 - 2014-12-17 13:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2014-12-17 13:46 - 2014-12-17 13:48 - 00000000 ____D () C:\ProgramData\AVG2015

2014-12-17 13:46 - 2014-12-17 13:46 - 00000000 ___DC () C:\$AVG

2014-12-17 13:32 - 2014-12-17 13:50 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Avg2015

2014-12-17 13:32 - 2014-12-17 13:32 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\MFAData

2014-12-17 13:25 - 2014-12-17 13:31 - 157569304 _____ (AVG Technologies) C:\Users\Nutzer\Downloads\avg_free_x86_all_2015_5577a8546.exe

2014-12-17 13:02 - 2014-12-17 13:02 - 00000000 ___HD () C:\windows\PIF

2014-12-17 12:56 - 2014-12-19 10:20 - 00008211 _____ () C:\Users\Nutzer\Downloads\hijackthis.log

2014-12-17 11:45 - 2014-12-18 14:49 - 00000000 ____D () C:\Users\Nutzer\Downloads\backups

2014-12-17 11:34 - 2014-12-17 12:56 - 00000000 ____D () C:\Users\Nutzer\Downloads\swtor

2014-12-17 11:27 - 2014-12-17 11:27 - 00119904 _____ () C:\Users\Nutzer\AppData\Local\GDIPFONTCACHEV1.DAT

2014-12-16 00:54 - 2014-12-16 00:54 - 02166272 _____ () C:\Users\Nutzer\Downloads\adwcleaner_4.105.exe

2014-12-16 00:30 - 2014-12-16 00:30 - 00001070 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-16 00:30 - 2014-12-16 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-16 00:29 - 2014-12-16 00:30 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-12-16 00:29 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-12-16 00:29 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2014-12-16 00:29 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-12-16 00:04 - 2014-12-16 00:04 - 00001105 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-12-15 21:43 - 2014-12-15 21:45 - 00000000 ____D () C:\ProgramData\oiv

2014-12-11 14:21 - 2014-12-11 14:24 - 62506964 _____ () C:\Users\Nutzer\Desktop\Walk in the snø!.wav

2014-12-11 12:56 - 2014-12-12 14:28 - 00000000 ____D () C:\Users\Nutzer\Documents\YouTube To MP3

2014-12-11 12:56 - 2014-12-11 12:56 - 00001192 _____ () C:\Users\Public\Desktop\YouTube To MP3.lnk

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\Apowersoft

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apowersoft

2014-12-11 12:56 - 2014-12-11 12:56 - 00000000 ____D () C:\Program Files\Apowersoft

2014-12-11 12:55 - 2014-12-11 12:55 - 08646688 _____ (Apowersoft ) C:\Users\Nutzer\Downloads\youtube-to-mp3.exe

2014-12-11 09:13 - 2014-11-21 08:18 - 00042496 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-12-11 09:13 - 2014-11-21 08:17 - 14364672 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 01762816 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 01181696 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00523264 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-12-11 09:13 - 2014-11-21 08:17 - 00080384 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 13758976 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 02861568 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 02054656 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 01441280 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-12-11 09:13 - 2014-11-21 08:16 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00493056 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00391168 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00357888 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00109056 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-12-11 09:13 - 2014-11-21 08:16 - 00033280 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-12-11 09:13 - 2014-11-21 07:54 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-12-11 09:13 - 2014-11-21 07:24 - 00361984 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2014-12-11 09:13 - 2014-11-21 06:59 - 00071680 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2014-12-11 09:13 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll

2014-12-09 13:36 - 2014-12-09 13:36 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-12-09 10:14 - 2014-12-09 10:14 - 01062072 _____ (Microsoft Corporation) C:\Users\Nutzer\Downloads\Setup.X86.de-de_O365ProPlusRetail_49e0d883-c5d2-4ca1-980d-bd808bbc2c30_TX_PR_.exe

2014-12-06 11:08 - 2014-12-06 11:08 - 00000987 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk

2014-12-06 11:08 - 2014-12-06 11:08 - 00000975 _____ () C:\Users\Public\Desktop\Audacity.lnk

2014-12-06 11:08 - 2014-12-06 11:08 - 00000000 ____D () C:\Program Files\Audacity

2014-12-04 15:38 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\system32\dhRichClient3.dll

2014-12-04 15:38 - 2011-03-25 19:42 - 00338432 _____ () C:\windows\system32\sqlite36_engine.dll

2014-11-26 23:20 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\system32\D3DX9_43.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\windows\system32\XAudio2_7.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\windows\system32\xactengine3_7.dll

2014-11-26 23:18 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\windows\system32\XAPOFX1_5.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\windows\system32\D3DCompiler_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\windows\system32\d3dcsx_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\windows\system32\d3dx10_43.dll

2014-11-26 23:18 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\windows\system32\d3dx11_43.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\windows\system32\XAudio2_6.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\windows\system32\xactengine3_6.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\windows\system32\XAPOFX1_4.dll

2014-11-26 23:18 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\windows\system32\X3DAudio1_7.dll

2014-11-22 11:30 - 2014-11-22 11:32 - 69279069 _____ () C:\Users\Nutzer\Downloads\ANDOR_Into_the_North.zip

2014-11-21 20:51 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2014-11-21 20:51 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-20 16:41 - 2012-10-28 11:13 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job

2014-12-20 10:05 - 2010-09-16 10:28 - 01333210 _____ () C:\windows\WindowsUpdate.log

2014-12-20 09:40 - 2009-07-14 05:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-20 09:40 - 2009-07-14 05:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-20 09:35 - 2011-07-13 12:15 - 00000000 ____D () C:\ProgramData\MFAData

2014-12-20 09:31 - 2014-08-30 10:30 - 00008192 _____ () C:\windows\system32\WDPABKP.dat

2014-12-20 09:30 - 2013-06-25 09:19 - 00130969 _____ () C:\windows\setupact.log

2014-12-20 09:30 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-12-19 12:47 - 2014-06-11 08:15 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird

2014-12-19 02:09 - 2013-08-02 09:19 - 00273710 _____ () C:\windows\PFRO.log

2014-12-19 01:34 - 2013-08-28 17:49 - 00114904 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamswissarmy.sys

2014-12-18 19:41 - 2012-01-06 12:20 - 00000000 ____D () C:\Users\Nutzer\AppData\Roaming\TS3Client

2014-12-18 12:12 - 2009-10-26 21:54 - 01658436 _____ () C:\windows\system32\PerfStringBackup.INI

2014-12-18 10:33 - 2009-07-14 03:37 - 00000000 __RHD () C:\Users\Default

2014-12-18 10:33 - 2009-07-14 03:37 - 00000000 ___RD () C:\Users\Public

2014-12-18 10:27 - 2009-07-14 03:04 - 00000215 ____C () C:\windows\system.ini

2014-12-18 00:49 - 2010-09-16 10:30 - 00000000 ___HD () C:\Users\Nutzer

2014-12-17 15:35 - 2010-09-16 10:30 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\VirtualStore

2014-12-17 13:43 - 2011-07-13 12:28 - 00000000 ____D () C:\Program Files\AVG

2014-12-17 13:36 - 2014-08-14 09:18 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-17 13:35 - 2014-06-21 10:50 - 00069760 _____ () C:\windows\DPINST.LOG

2014-12-17 13:34 - 2014-08-31 08:22 - 00000000 ____D () C:\Program Files\Common Files\Western Digital

2014-12-17 13:34 - 2014-08-30 10:28 - 00000000 ____D () C:\ProgramData\Western Digital

2014-12-17 13:34 - 2014-08-30 10:28 - 00000000 ____D () C:\Program Files\Western Digital

2014-12-17 12:54 - 2009-07-14 03:04 - 00000441 _____ () C:\windows\win.ini

2014-12-16 17:39 - 2009-07-14 05:52 - 00000000 ____D () C:\windows\system32\FxsTmp

2014-12-16 01:51 - 2009-07-14 05:52 - 00000000 ____D () C:\windows\Performance

2014-12-16 00:29 - 2013-06-09 10:57 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-16 00:04 - 2014-01-09 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-16 00:04 - 2014-01-09 18:36 - 00000000 ____D () C:\Program Files\Avira

2014-12-14 23:18 - 2010-09-19 20:30 - 00000000 ____D () C:\ProgramData\DivX

2014-12-14 23:17 - 2013-10-28 12:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX

2014-12-14 23:17 - 2010-09-19 20:30 - 00000000 ____D () C:\Program Files\DivX

2014-12-14 23:17 - 2010-09-19 20:30 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared

2014-12-11 12:12 - 2009-10-26 21:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-11 12:10 - 2013-07-14 07:40 - 00000000 ____D () C:\windows\system32\MRT

2014-12-11 12:03 - 2010-09-16 11:46 - 109818608 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-12-10 09:56 - 2013-05-01 09:14 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-12-10 09:53 - 2012-05-02 19:53 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-12-09 10:19 - 2014-04-03 11:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2014-12-09 10:18 - 2014-04-03 11:15 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-12-02 11:19 - 2014-06-15 18:17 - 00021947 _____ () C:\Users\Nutzer\Desktop\Bücherliste.xlsx

2014-11-29 22:13 - 2014-08-21 19:56 - 00000000 ____D () C:\Users\Nutzer\AppData\Local\Adobe

2014-11-29 08:39 - 2013-07-31 14:22 - 00000000 ____D () C:\ProgramData\BitRaider

2014-11-29 08:36 - 2012-05-10 09:36 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe

2014-11-29 08:36 - 2011-05-16 18:35 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

2014-11-25 11:39 - 2014-03-26 18:25 - 00000000 ____D () C:\Program Files\Steam

2014-11-24 14:04 - 2010-09-16 11:21 - 00229000 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-11-22 11:10 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
 

Some content of TEMP:

====================

C:\Users\Nutzer\AppData\Local\Temp\avgnt.exe

C:\Users\Nutzer\AppData\Local\Temp\Quarantine.exe

C:\Users\Nutzer\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\windows\explorer.exe => File is digitally signed

C:\windows\system32\winlogon.exe => File is digitally signed

C:\windows\system32\wininit.exe => File is digitally signed

C:\windows\system32\svchost.exe => File is digitally signed

C:\windows\system32\services.exe => File is digitally signed

C:\windows\system32\User32.dll => File is digitally signed

C:\windows\system32\userinit.exe => File is digitally signed

C:\windows\system32\rpcss.dll => File is digitally signed

C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-15 17:44
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Nein, ich habe keine Probleme mehr und meine Anti-Virenprogramme finden auch keine Viren oder Bedrohungen mehr. HijackThis zeigt auch keine Auffälligkeiten mehr. Sofern das FRST nichts anzeigt, denke ich, haben wir sie erwischt! ^^

Schon mal an dieser Stelle ein riesiges Dankeschön für die großartige Arbeit!

:dankeschoen:

Hijackthis kann eh nix anzeigen weil es seit Jahren kein Mensch mehr benutzt und total out of date is.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hat alles Super funtioniert. Danke. Konnte auch ComboFix leicht löschen. (Macht ja manchmal Probleme)

Herzlichen Dank dir, Schrauber.
War kurz vor dem verzweifeln.