Trojaner-Board - Windows 7 Fehlermeldung bei Start: Problem beim Starten von C:\PROGRA~3\01D3D0D9B.cpp

Hier die ComboFix Datei

Code:

ComboFix 15-02-02.01 - Philipp 02.02.2015  18:40:43.1.2 - x64

ausgeführt von:: c:\users\Philipp\Desktop\ComboFix.exe

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\1415703224.bdinstall.bin

c:\programdata\B9D0D3D10.zot

c:\programdata\ntuser.pol

c:\users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense

c:\users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\SaveSense Help.url

c:\users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\SaveSense.url

c:\users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\Uninstall SaveSense.lnk

c:\users\Philipp\AppData\Roaming\SaveSense

c:\users\Philipp\AppData\Roaming\SaveSense\UpdateProc\config.dat

c:\users\Philipp\AppData\Roaming\SaveSense\UpdateProc\STTL.DAT

c:\users\Philipp\AppData\Roaming\SaveSense\UpdateProc\TTL.DAT

c:\users\Philipp\AppData\Roaming\systweak\ssd\SSDPTstub.exe

G:\install.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2015-01-02 bis 2015-02-02  ))))))))))))))))))))))))))))))

.

.

2015-02-02 17:50 . 2015-02-02 17:50        --------        d-----w-        c:\users\Default\AppData\Local\temp

2015-02-02 15:27 . 2015-02-02 16:06        --------        d-----w-        C:\FRST

2015-02-01 20:38 . 2015-02-01 20:40        --------        d-----w-        C:\AdwCleaner

2015-02-01 20:20 . 2015-02-02 16:10        --------        d-----w-        c:\users\Philipp\AppData\Local\SaveSense

2015-02-01 20:20 . 2015-02-01 20:20        --------        d-----w-        c:\users\Philipp\AppData\Roaming\OpenCandy

2015-02-01 19:38 . 2015-02-02 17:55        129752        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys

2015-02-01 19:37 . 2015-02-01 19:37        --------        d-----w-        c:\program files (x86)\Malwarebytes Anti-Malware

2015-02-01 19:37 . 2015-02-01 19:37        --------        d-----w-        c:\programdata\Malwarebytes

2015-02-01 19:37 . 2014-11-21 05:14        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys

2015-02-01 19:37 . 2014-11-21 05:14        93400        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2015-02-01 19:37 . 2014-11-21 05:14        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys

2015-01-29 18:09 . 2015-01-29 18:09        --------        d-----w-        c:\program files (x86)\VS Revo Group

2015-01-27 05:34 . 2015-01-27 05:34        --------        d-----w-        c:\programdata\bdch

2015-01-26 19:46 . 2015-01-26 19:46        155912        ----a-w-        c:\windows\system32\drivers\gzflt.sys

2015-01-26 19:45 . 2015-01-26 19:45        82824        ----a-w-        c:\windows\system32\drivers\bdsandbox.sys

2015-01-26 18:37 . 2015-01-26 18:37        --------        d-----w-        c:\programdata\MobileBrServ

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2015-02-02 18:03 . 2015-02-02 18:03        75888        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{BACD1F38-FDC3-4960-8B46-03925CF1B0FF}\offreg.dll

2015-02-01 19:42 . 2012-10-09 17:07        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2015-02-01 19:42 . 2012-10-09 17:07        701616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2015-01-26 19:45 . 2013-11-28 10:34        33360        ----a-w-        c:\windows\system32\bdsandboxuh.dll

2015-01-26 19:44 . 2013-11-28 10:34        84336        ----a-w-        c:\windows\system32\bdsandboxuiskin.dll

2015-01-26 19:44 . 2014-11-11 11:06        74000        ----a-w-        c:\windows\system32\bdsandboxuiskin32.dll

2014-11-25 13:16 . 2012-10-09 17:56        103374192        ----a-w-        c:\windows\system32\MRT.exe

2014-11-25 10:52 . 2014-11-11 10:58        1288472        ----a-w-        c:\windows\system32\drivers\avc3.sys

2014-11-25 10:52 . 2013-09-23 19:02        263032        ----a-w-        c:\windows\system32\drivers\avchv.sys

2014-11-25 10:52 . 2014-11-11 10:53        452040        ----a-w-        c:\windows\system32\drivers\trufos.sys

2014-11-17 01:08 . 2014-12-03 16:08        11632448        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{BACD1F38-FDC3-4960-8B46-03925CF1B0FF}\mpengine.dll

2014-11-11 03:08 . 2014-11-22 13:17        241152        ----a-w-        c:\windows\system32\pku2u.dll

2014-11-11 03:08 . 2014-11-22 13:17        728064        ----a-w-        c:\windows\system32\kerberos.dll

2014-11-11 02:44 . 2014-11-22 13:17        186880        ----a-w-        c:\windows\SysWow64\pku2u.dll

2014-11-11 02:44 . 2014-11-22 13:17        550912        ----a-w-        c:\windows\SysWow64\kerberos.dll

2014-11-07 19:49 . 2014-11-22 13:20        388272        ----a-w-        c:\windows\system32\iedkcs32.dll

2014-11-06 04:04 . 2014-11-22 13:20        2724864        ----a-w-        c:\windows\system32\mshtml.tlb

2014-11-06 04:03 . 2014-11-22 13:20        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll

2014-11-06 04:03 . 2014-11-22 13:20        25110016        ----a-w-        c:\windows\system32\mshtml.dll

2014-11-06 03:47 . 2014-11-22 13:20        66560        ----a-w-        c:\windows\system32\iesetup.dll

2014-11-06 03:46 . 2014-11-22 13:20        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll

2014-11-06 03:46 . 2014-11-22 13:20        580096        ----a-w-        c:\windows\system32\vbscript.dll

2014-11-06 03:44 . 2014-11-22 13:20        88064        ----a-w-        c:\windows\system32\MshtmlDac.dll

2014-11-06 03:43 . 2014-11-22 13:20        2884096        ----a-w-        c:\windows\system32\iertutil.dll

2014-11-06 03:36 . 2014-11-22 13:20        54784        ----a-w-        c:\windows\system32\jsproxy.dll

2014-11-06 03:35 . 2014-11-22 13:20        34304        ----a-w-        c:\windows\system32\iernonce.dll

2014-11-06 03:31 . 2014-11-22 13:20        633856        ----a-w-        c:\windows\system32\ieui.dll

2014-11-06 03:30 . 2014-11-22 13:20        144384        ----a-w-        c:\windows\system32\ieUnatt.exe

2014-11-06 03:30 . 2014-11-22 13:20        114688        ----a-w-        c:\windows\system32\ieetwcollector.exe

2014-11-06 03:29 . 2014-11-22 13:20        814080        ----a-w-        c:\windows\system32\jscript9diag.dll

2014-11-06 03:28 . 2014-11-22 13:20        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2014-11-06 03:23 . 2014-11-22 13:20        6040064        ----a-w-        c:\windows\system32\jscript9.dll

2014-11-06 03:20 . 2014-11-22 13:20        968704        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2014-11-06 03:16 . 2014-11-22 13:20        490496        ----a-w-        c:\windows\system32\dxtmsft.dll

2014-11-06 03:13 . 2014-11-22 13:20        501248        ----a-w-        c:\windows\SysWow64\vbscript.dll

2014-11-06 03:13 . 2014-11-22 13:20        62464        ----a-w-        c:\windows\SysWow64\iesetup.dll

2014-11-06 03:12 . 2014-11-22 13:20        47616        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll

2014-11-06 03:10 . 2014-11-22 13:20        64000        ----a-w-        c:\windows\SysWow64\MshtmlDac.dll

2014-11-06 03:07 . 2014-11-22 13:20        77824        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll

2014-11-06 03:02 . 2014-11-22 13:20        199680        ----a-w-        c:\windows\system32\msrating.dll

2014-11-06 03:00 . 2014-11-22 13:20        92160        ----a-w-        c:\windows\system32\mshtmled.dll

2014-11-06 02:59 . 2014-11-22 13:20        115712        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2014-11-06 02:58 . 2014-11-22 13:20        620032        ----a-w-        c:\windows\SysWow64\jscript9diag.dll

2014-11-06 02:57 . 2014-11-22 13:20        316928        ----a-w-        c:\windows\system32\dxtrans.dll

2014-11-06 02:42 . 2014-11-22 13:20        60416        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll

2014-11-06 02:41 . 2014-11-22 13:20        716800        ----a-w-        c:\windows\system32\ie4uinit.exe

2014-11-06 02:41 . 2014-11-22 13:20        800768        ----a-w-        c:\windows\system32\msfeeds.dll

2014-11-06 02:39 . 2014-11-22 13:20        1359360        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2014-11-06 02:38 . 2014-11-22 13:20        2124288        ----a-w-        c:\windows\system32\inetcpl.cpl

2014-11-06 02:30 . 2014-11-22 13:20        14390272        ----a-w-        c:\windows\system32\ieframe.dll

2014-11-06 02:21 . 2014-11-22 13:20        4298240        ----a-w-        c:\windows\SysWow64\jscript9.dll

2014-11-06 02:21 . 2014-11-22 13:20        2051072        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2014-11-06 02:20 . 2014-11-22 13:20        1155072        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2014-11-06 02:17 . 2014-11-22 13:20        2365440        ----a-w-        c:\windows\system32\wininet.dll

2014-11-06 02:04 . 2014-11-22 13:20        1550336        ----a-w-        c:\windows\system32\urlmon.dll

2014-11-06 01:53 . 2014-11-22 13:20        799232        ----a-w-        c:\windows\system32\ieapfltr.dll

2014-11-06 01:52 . 2014-11-22 13:20        1892864        ----a-w-        c:\windows\SysWow64\wininet.dll

2014-11-05 17:56 . 2014-11-22 13:20        304640        ----a-w-        c:\windows\system32\generaltel.dll

2014-11-05 17:56 . 2014-11-22 13:20        228864        ----a-w-        c:\windows\system32\aepdu.dll

2014-11-05 17:52 . 2014-11-22 13:20        424448        ----a-w-        c:\windows\system32\aeinv.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-17 04:09        131480        ----a-w-        c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-17 04:09        131480        ----a-w-        c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-17 04:09        131480        ----a-w-        c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Amazon Cloud Player"="c:\users\Philipp\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe" [2014-05-08 3145536]

"Bitdefender-Geldbörse-Agent"="c:\program files\Bitdefender\Bitdefender 2015\bdwtxag.exe" [2015-01-26 790880]

"BackgroundContainer"="c:\users\Philipp\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll" [2013-10-14 319264]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Adobe Speed Launcher"="1422899746" [X]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-11-20 1021128]

.

c:\users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

B9D0D3D10.lnk - c:\windows\system32\rundll32.exe  c:\progra~3\01D3D0D9B.cpp,work [2009-7-14 45568]

Dropbox.lnk - c:\users\Philipp\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-12-9 39207112]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys;c:\windows\SYSNATIVE\DRIVERS\avckf.sys [x]

R3 BdDesktopParental;Bitdefender Desktop Parental Control;c:\program files\Bitdefender\Bitdefender 2015\bdparentalservice.exe;c:\program files\Bitdefender\Bitdefender 2015\bdparentalservice.exe [x]

R3 bdfwfpf_pc;bdfwfpf_pc;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [x]

R3 BDSandBox;BDSandBox;c:\windows\system32\drivers\bdsandbox.sys;c:\windows\SYSNATIVE\drivers\bdsandbox.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R4 SafeBox;SafeBox;c:\program files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe;c:\program files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [x]

R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys;c:\windows\SYSNATIVE\DRIVERS\avc3.sys [x]

S0 gzflt;gzflt;c:\windows\system32\DRIVERS\gzflt.sys;c:\windows\SYSNATIVE\DRIVERS\gzflt.sys [x]

S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [x]

S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [x]

S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys;c:\windows\SYSNATIVE\DRIVERS\bdvedisk.sys [x]

S2 AAV UpdateService;AAV UpdateService;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [x]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [x]

S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [x]

S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]

S2 Mobile Broadband HL Service;Mobile Broadband HL Service;c:\programdata\MobileBrServ\mbbservice.exe;c:\programdata\MobileBrServ\mbbservice.exe [x]

S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]

S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]

S2 UPDATESRV;Bitdefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2015\updatesrv.exe;c:\program files\Bitdefender\Bitdefender 2015\updatesrv.exe [x]

S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys;c:\windows\SYSNATIVE\DRIVERS\avchv.sys [x]

S3 AVerAF15;AVerMedia BDA Digital Tuner;c:\windows\system32\Drivers\AVerAF15.sys;c:\windows\SYSNATIVE\Drivers\AVerAF15.sys [x]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]

S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]

S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]

S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - MBAMSWISSARMY

*NewlyCreated* - WS2IFSL

.

Inhalt des "geplante Tasks" Ordners

.

2015-02-02 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-09 19:42]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-17 04:10        164760        ----a-w-        c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-17 04:10        164760        ----a-w-        c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-17 04:10        164760        ----a-w-        c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-17 04:10        164760        ----a-w-        c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox1]

@="{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}"

[HKEY_CLASSES_ROOT\CLSID\{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}]

2014-07-04 16:58        206352        ----a-w-        c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox2]

@="{342DAA0B-D796-460D-8566-901E08A1CCAD}"

[HKEY_CLASSES_ROOT\CLSID\{342DAA0B-D796-460D-8566-901E08A1CCAD}]

2014-07-04 16:58        206352        ----a-w-        c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox3]

@="{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}"

[HKEY_CLASSES_ROOT\CLSID\{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}]

2014-07-04 16:58        206352        ----a-w-        c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox4]

@="{33816773-98AE-4723-ADE0-EBE54C8B5A67}"

[HKEY_CLASSES_ROOT\CLSID\{33816773-98AE-4723-ADE0-EBE54C8B5A67}]

2014-07-04 16:58        206352        ----a-w-        c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-04-02 1225920]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-03-23 487424]

"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-04-02 2201032]

"Bdagent"="c:\program files\Bitdefender\Bitdefender 2015\bdagent.exe" [2015-01-26 1686480]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = about:blank

mStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.8.1 192.168.8.1

.

.

------- Dateityp-Verknüpfung -------

.

inifile="%SystemRoot%\system32\NOTEPAD.EXE" %1

txtfile="%SystemRoot%\system32\NOTEPAD.EXE" %1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{66bd2442-241b-44cd-8c7a-b51037053cdb} - (no file)

BHO-{71E129FF-6C2A-4984-818C-7E2C998B8D99} - c:\users\Philipp\AppData\Local\SaveSense\SaveSenseIE.dll

Toolbar-{66bd2442-241b-44cd-8c7a-b51037053cdb} - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

WebBrowser-{66BD2442-241B-44CD-8C7A-B51037053CDB} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_296_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_296_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]

@Denied: (A 2) (Everyone)

@="IFlashBroker6"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_296_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_296_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.16"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]

@Denied: (A 2) (Everyone)

@="IFlashBroker6"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Malwarebytes Anti-Malware\mbam.exe

c:\programdata\TVersity\Media Server\MediaServer.exe

c:\windows\SysWOW64\rundll32.exe

c:\users\Philipp\AppData\Roaming\Dropbox\bin\Dropbox.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2015-02-02  19:12:08 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2015-02-02 18:12

.

Vor Suchlauf: 11 Verzeichnis(se), 19.587.473.408 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 19.414.278.144 Bytes frei

.

- - End Of File - - 944E4103A50AFF6B6B54B63CFB6263AC

A36C5E4F47E84449FF07ED3517B43A31

Hier FRST Datei

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015

Ran by Philipp (administrator) on PHILIPP-PC on 02-02-2015 19:17:25

Running from C:\Users\Philipp\Downloads

Loaded Profiles: Philipp (Available profiles: Philipp)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\stacsv64.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

() C:\ProgramData\MobileBrServ\mbbService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

() C:\ProgramData\TVersity\Media Server\MediaServer.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe

() C:\Users\Philipp\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Dropbox, Inc.) C:\Users\Philipp\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Farbar) C:\Users\Philipp\Downloads\FRST64 (1).exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-23] (IDT, Inc.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2201032 2014-04-02] (NVIDIA Corporation)

HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe [1686480 2015-01-26] (Bitdefender)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\Run: [Amazon Cloud Player] => C:\Users\Philipp\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2014-05-08] ()

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\Run: [Bitdefender-Geldbörse-Agent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe [790880 2015-01-26] (Bitdefender)

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\Run: [BackgroundContainer] => "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Philipp\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION

Startup: C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\B9D0D3D10.lnk

ShortcutTarget: B9D0D3D10.lnk -> C:\PROGRA~3\01D3D0D9B.cpp (No File)

Startup: C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [__SafeBox1] -> {152C96EB-288E-4EDC-B7C6-D21F8250ADF3} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)

ShellIconOverlayIdentifiers: [__SafeBox2] -> {342DAA0B-D796-460D-8566-901E08A1CCAD} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)

ShellIconOverlayIdentifiers: [__SafeBox3] -> {57595DAE-1AE1-4D97-A49E-67CBB53B52DF} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)

ShellIconOverlayIdentifiers: [__SafeBox4] -> {33816773-98AE-4723-ADE0-EBE54C8B5A67} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

URLSearchHook: HKLM-x32 - (No Name) - {66bd2442-241b-44cd-8c7a-b51037053cdb} - No File

SearchScopes: HKLM-x32 -> DefaultScope {18A7A560-2588-4E99-A018-5A3282885A75} URL = 

SearchScopes: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001 -> DefaultScope {18A7A560-2588-4E99-A018-5A3282885A75} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2548838&CUI=UN36763650512378113&UM=1

SearchScopes: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=DEAC002186B81241&affID=119557&tsp=4982

SearchScopes: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001 -> {18A7A560-2588-4E99-A018-5A3282885A75} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2548838&CUI=UN36763650512378113&UM=1

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: SaveSense -> {71E129FF-6C2A-4984-818C-7E2C998B8D99} -> C:\Users\Philipp\AppData\Local\SaveSense\SaveSenseIE.dll No File

Toolbar: HKLM - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\pmbxie.dll (Bitdefender)

Toolbar: HKLM-x32 - No Name - {66bd2442-241b-44cd-8c7a-b51037053cdb} -  No File

Toolbar: HKLM-x32 - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll (Bitdefender)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1104\7.1.1104\TmBpIe32.dll No File

Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 192.168.8.1
 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()

FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1289413869-1661704052-1926519009-1001: @www.flatcast.com/FlatViewer 5.2 -> C:\Users\Philipp\AppData\Roaming\Mozilla\Plugins\NpFv530.dll (1 mal 1 Software GmbH)

FF Plugin HKU\S-1-5-21-1289413869-1661704052-1926519009-1001: amazon.com/AmazonMP3DownloaderPlugin -> F:\Diashow\Download\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)

FF Plugin HKU\S-1-5-21-1289413869-1661704052-1926519009-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File

FF Plugin ProgramFiles/Appdata: C:\Users\Philipp\AppData\Roaming\mozilla\plugins\NpFv530.dll (1 mal 1 Software GmbH)

FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext

FF Extension: Bitdefender Antispam Toolbar - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext [2014-11-11]

FF HKLM-x32\...\Firefox\Extensions: [{38783831-6098-4faa-A9C9-1EE1E343F4D2}] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1104\7.1.1104\firefoxextension

FF HKLM-x32\...\Firefox\Extensions: [bdwteff@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff

FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff [2014-11-11]

FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [fabcmochhfpldjekobfaaggijgohadih] - No Path
 

Opera: 

=======

StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)

S3 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2015\bdparentalservice.exe [78144 2015-01-26] (Bitdefender)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239696 2013-07-23] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1615192 2014-04-02] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [20541216 2014-04-02] (NVIDIA Corporation)

S4 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [94624 2013-07-08] (Bitdefender)

R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\STacSV64.exe [247808 2010-03-23] (IDT, Inc.)

R2 TVersityMediaServer; C:\ProgramData\TVersity\Media Server\MediaServer.exe [1249064 2011-07-29] ()

R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe [67320 2014-11-25] (Bitdefender)

R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe [1545376 2015-01-26] (Bitdefender)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S3 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]

S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1288472 2014-11-25] (BitDefender)

R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [263032 2014-11-25] (BitDefender)

R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [647752 2014-05-16] (BitDefender)

R3 AVerAF15; C:\Windows\System32\Drivers\AVerAF15.sys [369024 2008-01-16] (AVerMedia TECHNOLOGIES, Inc.)

R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-11-13] (BitDefender LLC)

R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [107080 2012-10-29] (BitDefender LLC)

S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL)

S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2015-01-26] (BitDefender SRL)

R1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)

R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [155912 2015-01-26] (BitDefender LLC)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-02] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-21] (NVIDIA Corporation)

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-02-02] (Duplex Secure Ltd.)

R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [452040 2014-11-25] (BitDefender S.R.L.)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-07-28] (Apple, Inc.) [File not signed]

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-02 19:17 - 2015-02-02 19:17 - 00016130 _____ () C:\Users\Philipp\Downloads\FRST.txt

2015-02-02 19:12 - 2015-02-02 19:12 - 00026774 _____ () C:\ComboFix.txt

2015-02-02 18:37 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2015-02-02 18:37 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2015-02-02 18:37 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2015-02-02 18:36 - 2015-02-02 19:13 - 00000000 ____D () C:\Qoobox

2015-02-02 18:34 - 2015-02-02 19:07 - 00000000 ____D () C:\Windows\erdnt

2015-02-02 18:31 - 2015-02-02 18:31 - 05611380 ____R (Swearware) C:\Users\Philipp\Desktop\ComboFix.exe

2015-02-02 17:24 - 2015-02-02 17:24 - 00821523 _____ () C:\Users\Philipp\Desktop\Gmer.txt

2015-02-02 17:08 - 2015-02-02 17:08 - 00380416 _____ () C:\Users\Philipp\Downloads\Gmer-19357.exe

2015-02-02 16:58 - 2015-02-02 16:58 - 00000375 _____ () C:\Users\Philipp\Desktop\Addition.txt

2015-02-02 16:57 - 2015-02-02 17:06 - 00026383 _____ () C:\Users\Philipp\Desktop\FRST.txt

2015-02-02 16:57 - 2015-02-02 16:57 - 02131456 _____ (Farbar) C:\Users\Philipp\Downloads\FRST64 (1).exe

2015-02-02 16:47 - 2015-02-02 16:47 - 00000586 _____ () C:\Users\Philipp\Desktop\defogger_disable.log

2015-02-02 16:47 - 2015-02-02 16:47 - 00000020 _____ () C:\Users\Philipp\defogger_reenable

2015-02-02 16:46 - 2015-02-02 16:46 - 00050477 _____ () C:\Users\Philipp\Downloads\Defogger.exe

2015-02-02 16:27 - 2015-02-02 19:17 - 00000000 ____D () C:\FRST

2015-02-01 21:38 - 2015-02-01 21:40 - 00000000 ____D () C:\AdwCleaner

2015-02-01 21:38 - 2015-02-01 21:38 - 02194432 _____ () C:\Users\Philipp\Downloads\adwcleaner_4.109 (2).exe

2015-02-01 21:37 - 2015-02-01 21:37 - 02194432 _____ () C:\Users\Philipp\Downloads\adwcleaner_4.109 (1).exe

2015-02-01 21:34 - 2015-02-01 21:34 - 02194432 _____ () C:\Users\Philipp\Downloads\AdwCleaner_4.109.exe

2015-02-01 21:20 - 2015-02-02 17:10 - 00000000 ____D () C:\Users\Philipp\AppData\Local\SaveSense

2015-02-01 21:20 - 2015-02-01 21:20 - 19577400 _____ () C:\Users\Philipp\Downloads\TVersitySetup_2_6.exe

2015-02-01 21:20 - 2015-02-01 21:20 - 00936616 _____ () C:\Users\Philipp\Downloads\FLVPlayerSetup.exe

2015-02-01 21:20 - 2015-02-01 21:20 - 00936616 _____ () C:\Users\Philipp\Downloads\FLVPlayerSetup (1).exe

2015-02-01 21:20 - 2015-02-01 21:20 - 00386936 _____ (Softonic ) C:\Users\Philipp\Downloads\SoftonicDownloader_fuer_euro-truck-simulator-2-patch.exe

2015-02-01 21:20 - 2015-02-01 21:20 - 00386936 _____ (Softonic ) C:\Users\Philipp\Downloads\SoftonicDownloader_fuer_euro-truck-simulator-2-patch (1).exe

2015-02-01 21:20 - 2015-02-01 21:20 - 00003382 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task

2015-02-01 21:20 - 2015-02-01 21:20 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\OpenCandy

2015-02-01 20:38 - 2015-02-02 18:55 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-02-01 20:37 - 2015-02-01 20:37 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-02-01 20:37 - 2015-02-01 20:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-02-01 20:37 - 2015-02-01 20:37 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-02-01 20:37 - 2015-02-01 20:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-02-01 20:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-02-01 20:37 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-02-01 20:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-02-01 20:35 - 2015-02-01 20:36 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Philipp\Downloads\mbam-setup-2.0.4.1028.exe

2015-01-29 19:09 - 2015-01-29 19:09 - 00001268 _____ () C:\Users\Philipp\Desktop\Revo Uninstaller.lnk

2015-01-29 19:09 - 2015-01-29 19:09 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2015-01-29 19:08 - 2015-01-29 19:08 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Philipp\Downloads\revosetup95.exe

2015-01-27 06:34 - 2015-01-27 06:34 - 00000000 ____D () C:\ProgramData\bdch

2015-01-26 20:46 - 2015-01-26 20:46 - 00155912 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys

2015-01-26 20:45 - 2015-01-26 20:45 - 00082824 _____ (BitDefender SRL) C:\Windows\system32\Drivers\bdsandbox.sys

2015-01-26 19:37 - 2015-01-26 19:37 - 00000000 ____D () C:\ProgramData\MobileBrServ
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-02 19:12 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default

2015-02-02 19:00 - 2009-07-14 05:45 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-02 19:00 - 2009-07-14 05:45 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-02 18:57 - 2013-11-22 22:11 - 00000000 ____D () C:\Program Files (x86)\Opera

2015-02-02 18:56 - 2012-10-09 17:43 - 01487358 _____ () C:\Windows\WindowsUpdate.log

2015-02-02 18:56 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2015-02-02 18:53 - 2013-09-02 11:52 - 00061774 _____ () C:\Windows\SysWOW64\TVersityMediaServer.log

2015-02-02 18:52 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-02 18:52 - 2009-07-14 05:51 - 00108831 _____ () C:\Windows\setupact.log

2015-02-02 18:51 - 2010-11-21 04:47 - 00828888 _____ () C:\Windows\PFRO.log

2015-02-02 18:42 - 2012-10-09 18:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-02-02 16:56 - 2014-03-31 12:01 - 00000000 ___RD () C:\Users\Philipp\Dropbox

2015-02-02 16:56 - 2014-03-31 11:59 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Dropbox

2015-02-02 16:47 - 2012-10-09 17:51 - 00000000 ____D () C:\Users\Philipp

2015-02-02 06:24 - 2012-10-10 17:58 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\vlc

2015-02-01 21:20 - 2014-03-04 13:54 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\systweak

2015-02-01 21:20 - 2013-09-02 11:50 - 00000000 ____D () C:\Program Files (x86)\TVersitybar

2015-02-01 20:42 - 2012-10-09 18:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-01 20:42 - 2012-10-09 18:07 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-01 20:42 - 2012-10-09 18:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-02-01 20:39 - 2014-06-04 17:50 - 00003856 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1394150704

2015-01-29 20:03 - 2012-12-05 19:09 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2015-01-26 20:45 - 2013-11-28 11:34 - 00033360 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuh.dll

2015-01-26 20:44 - 2014-11-11 12:06 - 00074000 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll

2015-01-26 20:44 - 2013-11-28 11:34 - 00084336 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin.dll

2015-01-26 19:55 - 2011-04-12 08:43 - 00711094 _____ () C:\Windows\system32\perfh007.dat

2015-01-26 19:55 - 2011-04-12 08:43 - 00153542 _____ () C:\Windows\system32\perfc007.dat

2015-01-26 19:55 - 2009-07-14 06:13 - 01651444 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-26 19:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2015-01-16 21:07 - 2014-09-07 14:47 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Adobe
 

==================== Files in the root of some directories =======
 

2012-10-10 18:08 - 2014-05-11 12:26 - 0000072 _____ () C:\Users\Philipp\AppData\Roaming\DAXACHRT.INI

2014-03-04 13:54 - 2014-03-04 13:54 - 0000044 _____ () C:\Users\Philipp\AppData\Roaming\WB.CFG

2013-11-08 23:31 - 2013-11-08 23:31 - 0001525 _____ () C:\Users\Philipp\AppData\Local\recently-used.xbel
 

Some content of TEMP:

====================

C:\Users\Philipp\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0aywip.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-01-28 06:04
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

und zu guter letzt... Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015

Ran by Philipp at 2015-02-02 19:18:12

Running from C:\Users\Philipp\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Bitdefender Antivirus (Enabled - Up to date) {9A0813D8-CED6-F86B-072E-28D2AF25A83D}

AS: Bitdefender Spyware-Schutz (Enabled - Up to date) {2169F23C-E8EC-F7E5-3D9E-13A0D4A2E280}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Bitdefender Firewall (Enabled) {A23392FD-84B9-F933-2C71-81E751F6EF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Amazon Cloud Player (HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\Amazon Amazon Cloud Player) (Version: 2.4.0.33 - Amazon Services LLC)

Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)

Bitdefender Total Security 2015 (HKLM\...\Bitdefender) (Version: 18.17.0.1227 - Bitdefender)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)

Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version:  - Cheat Engine)

CyberLink PhotoDirector 2011 (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.2105 - CyberLink Corp.)

Dropbox (HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)

EPSON SX125 Series Printer Uninstall (HKLM\...\EPSON SX125 Series) (Version:  - SEIKO EPSON Corporation)

Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.1.1 - SCS Software)

Flatcast Viewer Plugin 5.3.0.784 (HKLM-x32\...\Flatcast Viewer 5.3_is1) (Version:  - 1 mal 1 Software GmbH)

Freemake Video Converter Version 3.2.1 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 3.2.1 - Ellora Assets Corporation)

GIMP 2.8.8 (HKLM\...\GIMP-2_is1) (Version: 2.8.8 - The GIMP Team)

Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)

Java SE Development Kit 7 Update 45 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170450}) (Version: 1.7.0.450 - Oracle)

JMicron JMB38X Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.20.07 - JMicron Technology Corp.)

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.22.00.03 - Huawei Technologies Co.,Ltd)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

NVIDIA GeForce Experience 2.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0 - NVIDIA Corporation)

NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org)

Opera Stable 27.0.1689.54 (HKLM-x32\...\Opera 27.0.1689.54) (Version: 27.0.1689.54 - Opera Software ASA)

PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

SHIELD Streaming (Version: 1.8.323 - NVIDIA Corporation) Hidden

Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)

Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.08 - Wolters Kluwer Deutschland GmbH)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.29.0 - Synaptics Incorporated)

TVersity Codec Pack 1.7 (HKLM-x32\...\TVersity Codec Pack) (Version: 1.7 - TVersity Inc.)

TVersity Media Server 1.9.7 (HKLM-x32\...\TVersity Media Server) (Version: 1.9.7 - TVersity)

TVersitybar Toolbar (HKLM-x32\...\TVersitybar Toolbar) (Version: 6.15.0.27 - TVersitybar)

VLC media player 2.0.4 (HKLM-x32\...\VLC media player) (Version: 2.0.4 - VideoLAN)

Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1289413869-1661704052-1926519009-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
 

==================== Restore Points  =========================
 

30-01-2015 05:45:16 Revo Uninstaller's restore point - Apple Software Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2015-02-02 18:55 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {109A9C32-4304-457F-976E-B386F5E38E23} - System32\Tasks\Opera scheduled Autoupdate 1394150704 => C:\Program Files (x86)\Opera\launcher.exe [2015-01-23] (Opera Software)

Task: {28BD8E14-7237-4BC7-BD67-97332B2C0738} - System32\Tasks\BackgroundContainer Startup Task => Rundll32.exe "C:\Users\Philipp\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <==== ATTENTION

Task: {7EFE6ED1-696C-4054-A41A-4BBF007A0FBD} - System32\Tasks\{ACB400EF-0E8E-49D5-8191-8D53D1572B15} => pcalua.exe -a "C:\Users\Philipp\AppData\Local\Opera\Opera x64\temporary_downloads\TV Tuner_AverMedia_v1.0.64.40_Vistax64\TV Tuner_AverMedia_v1.0.64.40_Vistax64\A309_VistaLogo_Drv_V1.0.x.40_Direct_Install.exe" -d "C:\Users\Philipp\AppData\Local\Opera\Opera x64\temporary_downloads\TV Tuner_AverMedia_v1.0.64.40_Vistax64\TV Tuner_AverMedia_v1.0.64.40_Vistax64"

Task: {B7ADF7AE-7559-418B-997D-38DA421154F4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-01] (Adobe Systems Incorporated)

Task: {BE17EF3C-0566-4610-8F87-087417A11E2A} - System32\Tasks\Games\UpdateCheck_S-1-5-21-1289413869-1661704052-1926519009-1001

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2014-11-11 11:59 - 2014-08-27 16:31 - 00265080 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\txmlutil.dll

2014-11-11 11:58 - 2013-09-03 14:29 - 00101328 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\bdmetrics.dll

2014-11-11 11:59 - 2014-10-15 12:08 - 00003072 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\UI\accessl.ui

2014-11-11 11:59 - 2012-10-29 14:22 - 00152816 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\bdfwcore.dll

2014-11-11 11:58 - 2014-07-24 09:44 - 00780592 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_001_001\ashttpbr.mdl

2014-11-11 11:58 - 2014-07-24 09:44 - 00568400 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_001_001\ashttpdsp.mdl

2014-11-11 11:58 - 2014-07-24 09:44 - 02602680 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_001_001\ashttpph.mdl

2014-11-11 11:58 - 2014-07-24 09:44 - 01323408 _____ () C:\Program Files\Bitdefender\Bitdefender 2015\otengines_001_001\ashttprbl.mdl

2013-10-15 13:24 - 2014-03-04 14:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

2015-01-26 19:37 - 2013-07-23 04:47 - 00239696 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe

2011-07-29 20:31 - 2011-07-29 20:31 - 01249064 _____ () C:\ProgramData\TVersity\Media Server\MediaServer.exe

2013-11-29 23:28 - 2014-05-08 18:26 - 03145536 _____ () C:\Users\Philipp\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

2011-07-13 19:36 - 2011-07-13 19:36 - 00347944 _____ () C:\ProgramData\TVersity\Media Server\taglib.dll

2011-07-13 19:36 - 2011-07-13 19:36 - 00225064 _____ () C:\ProgramData\TVersity\Media Server\CORE_RL_lcms_.dll

2011-07-13 19:36 - 2011-07-13 19:36 - 00031528 _____ () C:\ProgramData\TVersity\Media Server\CORE_RL_xlib_.dll

2011-07-13 19:36 - 2011-07-13 19:36 - 00716584 _____ () C:\ProgramData\TVersity\Media Server\log4cxx.dll

2011-07-13 19:35 - 2011-07-13 19:35 - 04534072 _____ () C:\ProgramData\TVersity\Media Server\avcodec-52.dll

2011-07-13 19:36 - 2011-07-13 19:36 - 00083768 _____ () C:\ProgramData\TVersity\Media Server\avutil-50.dll

2011-07-13 19:36 - 2011-07-13 19:36 - 00313640 _____ () C:\ProgramData\TVersity\Media Server\libmp3lame-0.dll

2011-07-13 19:36 - 2011-07-13 19:36 - 00795448 _____ () C:\ProgramData\TVersity\Media Server\avformat-52.dll

2011-07-13 19:35 - 2011-07-13 19:35 - 00203064 _____ () C:\ProgramData\TVersity\Media Server\swscale-0.dll

2011-07-13 19:36 - 2011-07-13 19:36 - 00509720 _____ () C:\ProgramData\TVersity\Media Server\sqlite3.dll

2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\Philipp\AppData\Roaming\Dropbox\bin\libGLESv2.dll

2015-02-02 18:56 - 2015-02-02 18:56 - 00043008 _____ () c:\users\philipp\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0aywip.dll

2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\Philipp\AppData\Roaming\Dropbox\bin\libEGL.dll

2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\Philipp\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll

2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\Philipp\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Users\Philipp\Desktop\ComboFix.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\adwcleaner_4.109 (1).exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\adwcleaner_4.109 (2).exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\AdwCleaner_4.109.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\AmazonCloudPlayerInstaller_381.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\CDex-win32-1.70-b4-2009.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\CheatEngine63 (1).exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\CheatEngine63.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\Defogger.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\Dropbox 2.6.27.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\FileOpenerSetup.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\FRST64 (1).exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\Gmer-19357.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\install_flashplayer13x32_chrd_aaa_aih.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\mbam-setup-2.0.4.1028.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\revosetup95.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\Silverlight_x64.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\SkypeSetupFull.exe:BDU

AlternateDataStreams: C:\Users\Philipp\Downloads\winzip175-mediafire.exe:BDU
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-1289413869-1661704052-1926519009-500 - Administrator - Disabled)

Gast (S-1-5-21-1289413869-1661704052-1926519009-501 - Limited - Enabled)

HomeGroupUser$ (S-1-5-21-1289413869-1661704052-1926519009-1002 - Limited - Enabled)

Philipp (S-1-5-21-1289413869-1661704052-1926519009-1001 - Administrator - Enabled) => C:\Users\Philipp
 

==================== Faulty Device Manager Devices =============
 

Name: 

Description: 

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (02/02/2015 06:53:46 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/02/2015 06:51:06 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )

Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
 

Error: (02/02/2015 05:05:01 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm FRST64 (1).exe, Version 1.2.2015.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 17b4
 

Startzeit: 01d03f00eb058620
 

Endzeit: 16
 

Anwendungspfad: C:\Users\Philipp\Downloads\FRST64 (1).exe
 

Berichts-ID:
 

Error: (02/02/2015 05:03:15 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (02/02/2015 05:03:15 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (02/01/2015 09:22:48 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )

Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
 

Error: (02/01/2015 08:55:19 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )

Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
 

Error: (01/29/2015 06:52:47 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 04:13:24 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 05:46:30 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (02/02/2015 06:50:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 

Error: (02/02/2015 06:50:44 PM) (Source: Service Control Manager) (EventID: 7030) (User: )

Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 

Error: (02/02/2015 06:50:19 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 

Error: (02/02/2015 06:49:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 

Error: (02/02/2015 06:49:19 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 

Error: (02/02/2015 06:48:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 

Error: (02/02/2015 06:48:19 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 

Error: (02/02/2015 06:47:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 

Error: (02/02/2015 06:47:19 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 

Error: (02/02/2015 06:46:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 

%%127
 
 

Microsoft Office Sessions:

=========================

Error: (02/02/2015 06:53:46 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/02/2015 06:51:06 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )

Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
 

Error: (02/02/2015 05:05:01 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: FRST64 (1).exe1.2.2015.017b401d03f00eb05862016C:\Users\Philipp\Downloads\FRST64 (1).exe
 

Error: (02/02/2015 05:03:15 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Philipp\Downloads\SoftonicDownloader_fuer_euro-truck-simulator-2-patch.exe
 

Error: (02/02/2015 05:03:15 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Philipp\Downloads\SoftonicDownloader_fuer_euro-truck-simulator-2-patch (1).exe
 

Error: (02/01/2015 09:22:48 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )

Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
 

Error: (02/01/2015 08:55:19 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )

Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
 

Error: (01/29/2015 06:52:47 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 04:13:24 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/29/2015 05:46:30 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

CodeIntegrity Errors:

===================================

  Date: 2015-02-02 18:46:39.650

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2015-02-02 18:46:39.557

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-03 17:08:39.877

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-03 17:08:39.768

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-03 17:02:49.076

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-03 17:02:48.969

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-08-06 19:03:09.394

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-08-06 19:02:57.064

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-16 13:42:59.348

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-09-16 13:42:59.348

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM)2 Duo CPU P8600 @ 2.40GHz

Percentage of memory in use: 40%

Total physical RAM: 4062.96 MB

Available physical RAM: 2398.58 MB

Total Pagefile: 8124.09 MB

Available Pagefile: 6320.76 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:97.56 GB) (Free:18.17 GB) NTFS

Drive f: (Volume) (Fixed) (Total:135.23 GB) (Free:118.24 GB) NTFS

Drive g: (Volume) (Fixed) (Total:232.88 GB) (Free:232.75 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 133E133E)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=97.6 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=135.2 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 232.9 GB) (Disk ID: 42C63CBC)

Partition 1: (Not Active) - (Size=232.9 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Jetzt müsste ich alles haben...

Hallo,
danke nochmal für deine Hilfe.
Also, nachdem ich alles nach deinen Anweisungen erledigt habe, bekomme ich nachdem Neustart keine Fehlermeldung mehr. :-)

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-02-2015

Ran by Philipp at 2015-02-03 16:59:43 Run:1

Running from C:\Users\Philipp\Downloads

Loaded Profiles: Philipp (Available profiles: Philipp)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

emptytemp:

Startup: C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\B9D0D3D10.lnk

ShortcutTarget: B9D0D3D10.lnk -> C:\PROGRA~3\01D3D0D9B.cpp (No File)

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\Run: [BackgroundContainer] => "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Philipp\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

Task: {28BD8E14-7237-4BC7-BD67-97332B2C0738} - System32\Tasks\BackgroundContainer Startup Task => Rundll32.exe "C:\Users\Philipp\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <==== ATTENTION

         

*****************
 

C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\B9D0D3D10.lnk => Moved successfully.

C:\PROGRA~3\01D3D0D9B.cpp not found.

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\Software\Microsoft\Windows\CurrentVersion\Run\\BackgroundContainer => value deleted successfully.

"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.

"HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{28BD8E14-7237-4BC7-BD67-97332B2C0738}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28BD8E14-7237-4BC7-BD67-97332B2C0738}" => Key deleted successfully.

C:\Windows\System32\Tasks\BackgroundContainer Startup Task => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BackgroundContainer Startup Task" => Key deleted successfully.

EmptyTemp: => Removed 53.2 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 16:59:46 ====

Code:

# AdwCleaner v4.109 - Bericht erstellt am 03/02/2015 um 17:15:31

# Aktualisiert 24/01/2015 von Xplode

# Database : 2015-01-24.3 [Local]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Philipp - PHILIPP-PC

# Gestartet von : C:\Users\Philipp\Downloads\adwcleaner_4.109 (2).exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\Program Files (x86)\Conduit

Ordner Gelöscht : C:\Users\Philipp\AppData\Local\Conduit

Ordner Gelöscht : C:\Users\Philipp\AppData\Local\PackageAware

Ordner Gelöscht : C:\Users\Philipp\AppData\Local\SaveSense

Ordner Gelöscht : C:\Users\Philipp\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Philipp\AppData\Roaming\Babylon

Ordner Gelöscht : C:\Users\Philipp\AppData\Roaming\OpenCandy

Ordner Gelöscht : C:\Users\Philipp\AppData\Roaming\Systweak

Datei Gelöscht : C:\Windows\System32\roboot64.exe
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\f538f8abc38be49

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2548838

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{71E129FF-6C2A-4984-818C-7E2C998B8D99}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71E129FF-6C2A-4984-818C-7E2C998B8D99}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}

Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{18A7A560-2588-4E99-A018-5A3282885A75}

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\Conduit_Search_Protect

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\Delta

Schlüssel Gelöscht : HKCU\Software\InstallCore

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\SaveSense

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\systweak

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainer

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\LyricsContainer

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar

Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit

Schlüssel Gelöscht : HKLM\SOFTWARE\DataMngr

Schlüssel Gelöscht : HKLM\SOFTWARE\DealPlyLive

Schlüssel Gelöscht : HKLM\SOFTWARE\Delta

Schlüssel Gelöscht : HKLM\SOFTWARE\SaveSenseLive

Schlüssel Gelöscht : HKLM\SOFTWARE\systweak

Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17420
 
 

-\\ Opera v27.0.1689.54
 
 

*************************
 

AdwCleaner[R0].txt - [5421 octets] - [01/02/2015 21:38:47]

AdwCleaner[R1].txt - [4873 octets] - [03/02/2015 17:11:52]

AdwCleaner[S0].txt - [3796 octets] - [03/02/2015 17:15:31]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3856 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.2 (02.02.2015:1)

OS: Windows 7 Home Premium x64

Ran by Philipp on 03.02.2015 at 17:25:46,19

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{66bd2442-241b-44cd-8c7a-b51037053cdb}

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 03.02.2015 at 17:29:43,94

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 
 

Protection, 03.02.2015 06:03:24, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Starting, 

Protection, 03.02.2015 06:03:24, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Started, 

Protection, 03.02.2015 06:03:24, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Starting, 

Protection, 03.02.2015 06:05:51, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Started, 

Protection, 03.02.2015 16:34:31, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Starting, 

Protection, 03.02.2015 16:34:31, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Started, 

Protection, 03.02.2015 16:34:31, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Starting, 

Protection, 03.02.2015 16:35:25, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Started, 

Protection, 03.02.2015 17:02:58, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Starting, 

Protection, 03.02.2015 17:02:58, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Started, 

Protection, 03.02.2015 17:03:00, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Starting, 

Protection, 03.02.2015 17:04:37, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Started, 

Protection, 03.02.2015 17:18:32, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Starting, 

Protection, 03.02.2015 17:18:32, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Started, 

Protection, 03.02.2015 17:18:32, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Starting, 

Protection, 03.02.2015 17:21:08, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Started, 

Detection, 03.02.2015 17:26:00, SYSTEM, PHILIPP-PC, Protection, Malware Protection, File, PUP.Optional.Softonic.A, C:\Users\Philipp\Downloads\SoftonicDownloader_fuer_euro-truck-simulator-2-patch.exe, Quarantine, [129ba871dfabcc6a9c119aab2ad733cd]

Detection, 03.02.2015 17:26:51, SYSTEM, PHILIPP-PC, Protection, Malware Protection, File, PUP.Optional.Softonic.A, c:\users\philipp\downloads\softonicdownloader_fuer_euro-truck-simulator-2-patch.exe, Quarantine Failed, 2, Das System kann die angegebene Datei nicht finden.  , [129ba871dfabcc6a9c119aab2ad733cd]

Detection, 03.02.2015 17:27:42, SYSTEM, PHILIPP-PC, Protection, Malware Protection, File, PUP.Optional.Softonic.A, c:\users\philipp\downloads\softonicdownloader_fuer_euro-truck-simulator-2-patch.exe, Quarantine Failed, 2, Das System kann die angegebene Datei nicht finden.  , [129ba871dfabcc6a9c119aab2ad733cd]

Update, 03.02.2015 17:31:33, SYSTEM, PHILIPP-PC, Manual, Failed, Unable to access update server, 

Scan, 03.02.2015 17:44:09, SYSTEM, PHILIPP-PC, Manual, Start: % 1 "% 2", Dauer: % 1 min 11 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, 6-Malwareerkennung, 

Protection, 03.02.2015 17:46:13, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Starting, 

Protection, 03.02.2015 17:46:13, SYSTEM, PHILIPP-PC, Protection, Malware Protection, Started, 

Protection, 03.02.2015 17:46:13, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Starting, 

Protection, 03.02.2015 17:46:51, SYSTEM, PHILIPP-PC, Protection, Malicious Website Protection, Started, 
 

(end)

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015

Ran by Philipp (administrator) on PHILIPP-PC on 03-02-2015 17:51:13

Running from C:\Users\Philipp\Downloads

Loaded Profiles: Philipp (Available profiles: Philipp)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\stacsv64.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

() C:\ProgramData\MobileBrServ\mbbService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\ProgramData\TVersity\Media Server\MediaServer.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe

() C:\Users\Philipp\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe

(Dropbox, Inc.) C:\Users\Philipp\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Farbar) C:\Users\Philipp\Downloads\FRST64 (1).exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-23] (IDT, Inc.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2201032 2014-04-02] (NVIDIA Corporation)

HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe [1686480 2015-01-26] (Bitdefender)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\Run: [Amazon Cloud Player] => C:\Users\Philipp\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2014-05-08] ()

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\Run: [Bitdefender-Geldbörse-Agent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe [790880 2015-01-26] (Bitdefender)

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\...\RunOnce: [Adobe Speed Launcher] => 1422982024

Startup: C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Philipp\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [__SafeBox1] -> {152C96EB-288E-4EDC-B7C6-D21F8250ADF3} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)

ShellIconOverlayIdentifiers: [__SafeBox2] -> {342DAA0B-D796-460D-8566-901E08A1CCAD} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)

ShellIconOverlayIdentifiers: [__SafeBox3] -> {57595DAE-1AE1-4D97-A49E-67CBB53B52DF} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)

ShellIconOverlayIdentifiers: [__SafeBox4] -> {33816773-98AE-4723-ADE0-EBE54C8B5A67} => C:\Program Files\Bitdefender\Bitdefender SafeBox\SafeBoxShell.dll (Bitdefender)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-1289413869-1661704052-1926519009-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

URLSearchHook: HKLM-x32 - (No Name) - {66bd2442-241b-44cd-8c7a-b51037053cdb} - No File

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\pmbxie.dll (Bitdefender)

Toolbar: HKLM-x32 - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll (Bitdefender)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1104\7.1.1104\TmBpIe32.dll No File

Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 192.168.8.1
 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()

FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1289413869-1661704052-1926519009-1001: @www.flatcast.com/FlatViewer 5.2 -> C:\Users\Philipp\AppData\Roaming\Mozilla\Plugins\NpFv530.dll (1 mal 1 Software GmbH)

FF Plugin HKU\S-1-5-21-1289413869-1661704052-1926519009-1001: amazon.com/AmazonMP3DownloaderPlugin -> F:\Diashow\Download\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)

FF Plugin HKU\S-1-5-21-1289413869-1661704052-1926519009-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File

FF Plugin ProgramFiles/Appdata: C:\Users\Philipp\AppData\Roaming\mozilla\plugins\NpFv530.dll (1 mal 1 Software GmbH)

FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext

FF Extension: Bitdefender Antispam Toolbar - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext [2014-11-11]

FF HKLM-x32\...\Firefox\Extensions: [{38783831-6098-4faa-A9C9-1EE1E343F4D2}] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1104\7.1.1104\firefoxextension

FF HKLM-x32\...\Firefox\Extensions: [bdwteff@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff

FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff [2014-11-11]

FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [fabcmochhfpldjekobfaaggijgohadih] - No Path
 

Opera: 

=======

StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)

S3 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2015\bdparentalservice.exe [78144 2015-01-26] (Bitdefender)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239696 2013-07-23] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1615192 2014-04-02] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [20541216 2014-04-02] (NVIDIA Corporation)

S4 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [94624 2013-07-08] (Bitdefender)

R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\STacSV64.exe [247808 2010-03-23] (IDT, Inc.)

R2 TVersityMediaServer; C:\ProgramData\TVersity\Media Server\MediaServer.exe [1249064 2011-07-29] ()

R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe [67320 2014-11-25] (Bitdefender)

R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe [1545376 2015-01-26] (Bitdefender)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S3 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]

S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1288472 2014-11-25] (BitDefender)

R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [263032 2014-11-25] (BitDefender)

S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [647752 2014-05-16] (BitDefender)

R3 AVerAF15; C:\Windows\System32\Drivers\AVerAF15.sys [369024 2008-01-16] (AVerMedia TECHNOLOGIES, Inc.)

R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-11-13] (BitDefender LLC)

R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [107080 2012-10-29] (BitDefender LLC)

S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL)

S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2015-01-26] (BitDefender SRL)

R1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)

R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [155912 2015-01-26] (BitDefender LLC)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-03] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-21] (NVIDIA Corporation)

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-02-02] (Duplex Secure Ltd.)

R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [452040 2014-11-25] (BitDefender S.R.L.)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-07-28] (Apple, Inc.) [File not signed]

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-03 17:50 - 2015-02-03 17:50 - 00003240 _____ () C:\Users\Philipp\Desktop\mbam.txt

2015-02-03 17:29 - 2015-02-03 17:29 - 00000905 _____ () C:\Users\Philipp\Desktop\JRT.txt

2015-02-03 17:22 - 2015-02-03 17:22 - 01388274 _____ (Thisisu) C:\Users\Philipp\Downloads\JRT.exe

2015-02-03 17:19 - 2015-02-03 17:19 - 00003944 _____ () C:\Users\Philipp\Desktop\AdwCleaner[S0].txt

2015-02-02 21:41 - 2015-02-02 21:41 - 00000000 ____D () C:\Users\Philipp\Desktop\Trojaner Board

2015-02-02 19:18 - 2015-02-02 19:18 - 00032408 _____ () C:\Users\Philipp\Downloads\Addition.txt

2015-02-02 19:17 - 2015-02-03 17:51 - 00014843 _____ () C:\Users\Philipp\Downloads\FRST.txt

2015-02-02 19:12 - 2015-02-02 19:12 - 00026774 _____ () C:\ComboFix.txt

2015-02-02 18:37 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2015-02-02 18:37 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2015-02-02 18:37 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2015-02-02 18:37 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2015-02-02 18:36 - 2015-02-02 19:13 - 00000000 ____D () C:\Qoobox

2015-02-02 18:34 - 2015-02-02 19:07 - 00000000 ____D () C:\Windows\erdnt

2015-02-02 18:31 - 2015-02-02 18:31 - 05611380 ____R (Swearware) C:\Users\Philipp\Desktop\ComboFix.exe

2015-02-02 17:08 - 2015-02-02 17:08 - 00380416 _____ () C:\Users\Philipp\Downloads\Gmer-19357.exe

2015-02-02 16:57 - 2015-02-02 16:57 - 02131456 _____ (Farbar) C:\Users\Philipp\Downloads\FRST64 (1).exe

2015-02-02 16:47 - 2015-02-02 16:47 - 00000020 _____ () C:\Users\Philipp\defogger_reenable

2015-02-02 16:46 - 2015-02-02 16:46 - 00050477 _____ () C:\Users\Philipp\Downloads\Defogger.exe

2015-02-02 16:27 - 2015-02-03 17:51 - 00000000 ____D () C:\FRST

2015-02-01 21:38 - 2015-02-03 17:15 - 00000000 ____D () C:\AdwCleaner

2015-02-01 21:38 - 2015-02-01 21:38 - 02194432 _____ () C:\Users\Philipp\Downloads\adwcleaner_4.109 (2).exe

2015-02-01 20:38 - 2015-02-03 17:46 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-02-01 20:37 - 2015-02-01 20:37 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-02-01 20:37 - 2015-02-01 20:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-02-01 20:37 - 2015-02-01 20:37 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-02-01 20:37 - 2015-02-01 20:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-02-01 20:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-02-01 20:37 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-02-01 20:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-02-01 20:35 - 2015-02-01 20:36 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Philipp\Downloads\mbam-setup-2.0.4.1028.exe

2015-01-29 19:09 - 2015-01-29 19:09 - 00001268 _____ () C:\Users\Philipp\Desktop\Revo Uninstaller.lnk

2015-01-29 19:09 - 2015-01-29 19:09 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2015-01-29 19:08 - 2015-01-29 19:08 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Philipp\Downloads\revosetup95.exe

2015-01-27 06:34 - 2015-01-27 06:34 - 00000000 ____D () C:\ProgramData\bdch

2015-01-26 20:46 - 2015-01-26 20:46 - 00155912 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys

2015-01-26 20:45 - 2015-01-26 20:45 - 00082824 _____ (BitDefender SRL) C:\Windows\system32\Drivers\bdsandbox.sys

2015-01-26 19:37 - 2015-01-26 19:37 - 00000000 ____D () C:\ProgramData\MobileBrServ
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-03 17:46 - 2013-09-02 11:52 - 00065530 _____ () C:\Windows\SysWOW64\TVersityMediaServer.log

2015-02-03 17:46 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-03 17:46 - 2009-07-14 05:51 - 00109839 _____ () C:\Windows\setupact.log

2015-02-03 17:45 - 2010-11-21 04:47 - 00831186 _____ () C:\Windows\PFRO.log

2015-02-03 17:44 - 2012-10-09 17:43 - 01505265 _____ () C:\Windows\WindowsUpdate.log

2015-02-03 17:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Resources

2015-02-03 17:42 - 2012-10-09 18:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-02-03 17:26 - 2009-07-14 05:45 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-03 17:26 - 2009-07-14 05:45 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-03 17:21 - 2014-03-31 12:01 - 00000000 ___RD () C:\Users\Philipp\Dropbox

2015-02-03 17:21 - 2014-03-31 11:59 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Dropbox

2015-02-03 17:11 - 2013-11-22 22:11 - 00000000 ____D () C:\Program Files (x86)\Opera

2015-02-02 21:37 - 2012-10-10 17:58 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\vlc

2015-02-02 19:12 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default

2015-02-02 18:56 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2015-02-02 16:47 - 2012-10-09 17:51 - 00000000 ____D () C:\Users\Philipp

2015-02-01 21:20 - 2013-09-02 11:50 - 00000000 ____D () C:\Program Files (x86)\TVersitybar

2015-02-01 20:42 - 2012-10-09 18:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-01 20:42 - 2012-10-09 18:07 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-01 20:42 - 2012-10-09 18:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-02-01 20:39 - 2014-06-04 17:50 - 00003856 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1394150704

2015-01-29 20:03 - 2012-12-05 19:09 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2015-01-26 20:45 - 2013-11-28 11:34 - 00033360 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuh.dll

2015-01-26 20:44 - 2014-11-11 12:06 - 00074000 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll

2015-01-26 20:44 - 2013-11-28 11:34 - 00084336 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin.dll

2015-01-26 19:55 - 2011-04-12 08:43 - 00711094 _____ () C:\Windows\system32\perfh007.dat

2015-01-26 19:55 - 2011-04-12 08:43 - 00153542 _____ () C:\Windows\system32\perfc007.dat

2015-01-26 19:55 - 2009-07-14 06:13 - 01651444 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-26 19:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2015-01-16 21:07 - 2014-09-07 14:47 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Adobe
 

==================== Files in the root of some directories =======
 

2012-10-10 18:08 - 2014-05-11 12:26 - 0000072 _____ () C:\Users\Philipp\AppData\Roaming\DAXACHRT.INI

2014-03-04 13:54 - 2014-03-04 13:54 - 0000044 _____ () C:\Users\Philipp\AppData\Roaming\WB.CFG

2013-11-08 23:31 - 2013-11-08 23:31 - 0001525 _____ () C:\Users\Philipp\AppData\Local\recently-used.xbel
 

Some content of TEMP:

====================

C:\Users\Philipp\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp4mwyjl.dll

C:\Users\Philipp\AppData\Local\Temp\Quarantine.exe

C:\Users\Philipp\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-01-28 06:04
 

==================== End Of Log ============================

--- --- ---

--- --- ---