Trojaner-Board - Auf suspekten Link geklickt/Kaspersky findet nichts

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Auf suspekten Link geklickt/Kaspersky findet nichts (https://www.trojaner-board.de/163577-suspekten-link-geklickt-kaspersky-findet-nichts.html)

Auf suspekten Link geklickt/Kaspersky findet nichts

Moin moin,

Ich habe vorgestern abend auf einen Link geklickt, der mir von einem Kontakt bei Steam gesendet wurde. Obwohl der Link schon einigermaßen suspekt aussah, habe ich ihn blöderweise geöffnet.

Bevor der Steam Browser ihn allerdings geladen hatte, kam schon die Meldung von Kaspersky, dass es sich um einen als unsicher eingestuften Link handelt. Umgehend habe ich das System von Kaspersky überprüfen lassen, jedoch blieben sowohl vollständiger Systemcheck als auch die Rootkitsuche ergebnislos.

Um Sicherheit zu haben würde ich deshalb gerne die Meinung von jemandem mit Erfahrung hören, ich habe vorsorglich frst und gmer nach Anleitung benutzt und logs angefertigt, falls diese gebraucht werden.

Hoffe ihr könnt mir helfen :daumenhoc

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hoffe das klappt so

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015

Ran by paul (administrator) on PAUL-PC on 03-02-2015 19:33:05

Running from C:\Users\paul\Downloads

Loaded Profiles: paul & UpdatusUser (Available profiles: paul & UpdatusUser)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avpui.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

() C:\Users\paul\Downloads\Defogger.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)

HKLM-x32\...\Run: [RoccatKone+] => C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE [557056 2013-09-13] (ROCCAT GmbH)

HKLM-x32\...\RunOnce: [DXTempFolder] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\paul\AppData\Local\Temp\DXBE5F.tmp\" <===== ATTENTION

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\MountPoints2: {7aafdb6c-d0ef-11e1-8409-806e6f6e6963} - F:\setup.exe

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\MountPoints2: {7aafdb6d-d0ef-11e1-8409-806e6f6e6963} - G:\Setup.exe -check

HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-11-27] (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default

FF SelectedSearchEngine: Google

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com ()

FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com ()

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2492140108-2297389676-158246720-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF user.js: detected! => C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\user.js

FF SearchPlugin: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\searchplugins\trovi.xml

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-03]

FF Extension: DownloadHelper - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]

FF Extension: Adblock Plus - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-07-25]

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-01-27]

FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com

FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com [2014-12-22]

FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com

FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]

FF HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-03]
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)

R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO)

R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2014-12-22] (Kaspersky Lab ZAO)

R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2014-12-22] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO)

R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2014-12-22] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]

U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-03 19:33 - 2015-02-03 19:33 - 00011766 _____ () C:\Users\paul\Downloads\FRST.txt

2015-02-03 19:33 - 2015-02-03 19:33 - 00000000 ____D () C:\FRST

2015-02-03 19:32 - 2015-02-03 19:32 - 02131456 _____ (Farbar) C:\Users\paul\Downloads\FRST64.exe

2015-02-03 19:30 - 2015-02-03 19:30 - 00000470 _____ () C:\Users\paul\Downloads\defogger_disable.log

2015-02-03 19:30 - 2015-02-03 19:30 - 00000000 _____ () C:\Users\paul\defogger_reenable

2015-02-03 19:29 - 2015-02-03 19:29 - 00050477 _____ () C:\Users\paul\Downloads\Defogger.exe

2015-02-02 13:12 - 2015-02-02 13:12 - 00000869 _____ () C:\Users\paul\Desktop\BitTorrent.lnk

2015-02-02 13:12 - 2015-02-02 13:12 - 00000849 _____ () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk

2015-02-02 13:11 - 2015-02-02 13:25 - 00000000 ____D () C:\Users\paul\AppData\Roaming\BitTorrent

2015-02-02 13:11 - 2015-02-02 13:11 - 01738840 _____ (BitTorrent Inc.) C:\Users\paul\Downloads\BitTorrent_7.9.2.38398.exe

2015-01-31 22:45 - 2015-01-31 22:46 - 01983604 _____ () C:\Users\paul\Downloads\HoxHud P8.8 Self-installer.exe

2015-01-29 14:16 - 2015-01-29 14:30 - 44769901 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.33_95.exe

2015-01-28 20:54 - 2015-01-28 20:54 - 00001111 _____ () C:\Users\Public\Desktop\Fragen-Lern-CD 4.6.lnk

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\paul\AppData\Roaming\de.wendel.flcd-de

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wendel-Verlag

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Wendel-Verlag

2015-01-27 21:02 - 2015-01-27 21:26 - 00000000 ____D () C:\Users\paul\Downloads\DSfix24

2015-01-27 21:01 - 2015-01-27 21:02 - 00392093 _____ () C:\Users\paul\Downloads\DSfix24.zip

2015-01-27 16:38 - 2015-01-27 16:38 - 00000000 ____D () C:\Users\paul\AppData\Local\NBGI

2015-01-27 16:37 - 2015-01-27 16:37 - 00001338 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Windows\SysWOW64\xlive

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE

2015-01-27 10:13 - 2015-01-27 10:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-25 20:32 - 2015-02-02 13:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\FLV and Media Player

2015-01-25 20:31 - 2015-01-25 20:31 - 00001325 _____ () C:\Users\Public\Desktop\FLV and Media Player.lnk

2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies

2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\Program Files (x86)\Applian Technologies

2015-01-25 20:29 - 2015-01-25 20:30 - 23750568 _____ () C:\Users\paul\Downloads\FLVPlayer4211Install.exe

2015-01-25 19:34 - 2015-02-02 13:23 - 00000000 ____D () C:\Users\paul\dwhelper

2015-01-25 19:28 - 2015-01-25 19:30 - 00000000 ____D () C:\Users\paul\Downloads\chrome

2015-01-25 19:28 - 2015-01-25 19:28 - 00000979 _____ () C:\Users\Public\Desktop\WinRAR.lnk

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Program Files\WinRAR

2015-01-25 19:28 - 2014-09-05 09:15 - 00003914 _____ () C:\Users\paul\Downloads\chrome.manifest

2015-01-25 19:28 - 2014-09-05 09:15 - 00001956 _____ () C:\Users\paul\Downloads\install.rdf

2015-01-25 19:28 - 2014-09-05 09:15 - 00000000 ____D () C:\Users\paul\Downloads\defaults

2015-01-25 19:27 - 2015-01-25 19:27 - 02060888 _____ () C:\Users\paul\Downloads\winrar-x64-520d.exe

2015-01-25 19:26 - 2015-01-25 19:26 - 00772184 _____ () C:\Users\paul\Downloads\video_downloadhelper-4.9.24-sm_fx.zip

2015-01-24 15:17 - 2015-01-24 15:17 - 00000000 ____D () C:\Users\paul\Documents\nbgi

2015-01-24 14:34 - 2015-01-24 14:34 - 00000222 _____ () C:\Users\paul\Desktop\Dark Souls Prepare to Die Edition.url

2015-01-22 10:37 - 2015-02-03 19:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-22 10:37 - 2015-01-25 12:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-18 02:02 - 2015-01-18 02:02 - 40177100 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.26_95.exe

2015-01-15 01:02 - 2015-01-15 01:02 - 00302688 _____ () C:\Windows\Minidump\011515-40326-01.dmp

2015-01-14 12:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 12:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 12:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 12:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-01-14 12:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-01-14 12:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-01-14 12:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-14 12:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-01-14 12:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-01-14 12:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 12:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-14 12:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2015-01-14 12:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2015-01-13 20:29 - 2015-01-13 20:29 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Wargaming.net

2015-01-11 19:09 - 2015-01-11 19:09 - 00000769 _____ () C:\Users\paul\Desktop\World of Tanks.lnk

2015-01-11 19:09 - 2015-01-11 19:09 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Tanks

2015-01-07 12:05 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-01-07 12:05 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-01-06 20:26 - 2015-01-06 20:26 - 00000000 ____D () C:\Users\paul\AppData\Roaming\OpenOffice

2015-01-05 12:37 - 2015-01-05 12:37 - 05994752 _____ (Wargaming.net ) C:\Users\paul\Downloads\WoT_internet_install_eu(1).exe

2015-01-05 12:33 - 2015-01-05 12:33 - 05994752 _____ (Wargaming.net ) C:\Users\paul\Downloads\WoT_internet_install_eu.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-03 19:30 - 2012-07-18 17:14 - 00000000 ____D () C:\Users\paul

2015-02-03 19:13 - 2012-07-18 16:47 - 01227670 _____ () C:\Windows\WindowsUpdate.log

2015-02-03 16:30 - 2014-11-27 10:52 - 00000000 ____D () C:\Program Files (x86)\Steam

2015-02-03 13:26 - 2014-11-27 11:58 - 00057813 _____ () C:\Windows\DirectX.log

2015-02-03 13:04 - 2014-12-22 12:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2015-02-03 12:56 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-03 12:56 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-03 12:49 - 2014-11-29 09:27 - 00108862 _____ () C:\Windows\PFRO.log

2015-02-03 12:49 - 2012-07-18 17:39 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-02-03 12:49 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-03 12:49 - 2009-07-14 05:51 - 00037167 _____ () C:\Windows\setupact.log

2015-01-31 13:49 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-01-29 09:45 - 2012-07-18 17:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\ProgramData\Adobe

2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\Program Files (x86)\Adobe

2015-01-28 20:46 - 2014-11-27 10:59 - 00000000 ____D () C:\Users\paul\AppData\Local\Adobe

2015-01-28 20:46 - 2012-07-18 17:36 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Adobe

2015-01-27 16:37 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-01-27 16:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

2015-01-27 13:25 - 2012-07-18 17:37 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Skype

2015-01-25 12:50 - 2012-07-18 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-01-25 12:50 - 2012-07-18 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-01-24 14:34 - 2014-11-27 11:04 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-01-18 12:52 - 2012-07-18 18:09 - 00065832 _____ () C:\Users\paul\AppData\Local\GDIPFONTCACHEV1.DAT

2015-01-18 12:43 - 2009-07-14 05:45 - 00301632 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-01-17 15:46 - 2012-07-18 18:08 - 00000000 ____D () C:\ProgramData\Apple Computer

2015-01-15 01:02 - 2012-07-19 15:07 - 477307799 _____ () C:\Windows\MEMORY.DMP

2015-01-15 01:02 - 2012-07-19 15:07 - 00000000 ____D () C:\Windows\Minidump

2015-01-11 19:09 - 2012-05-08 19:50 - 00000000 ____D () C:\Games

2015-01-11 13:21 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

2015-01-06 20:37 - 2012-07-18 17:37 - 00000000 ____D () C:\Windows.old

2015-01-06 04:36 - 2012-07-18 17:26 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-01-05 12:38 - 2014-12-27 14:52 - 00000000 ____D () C:\Windows\SysWOW64\directx

2015-01-05 12:37 - 2014-12-27 14:52 - 00000000 ___HD () C:\Windows\msdownld.tmp
 

Some content of TEMP:

====================

C:\Users\paul\AppData\Local\Temp\FreeYouTubeDownload.exe

C:\Users\paul\AppData\Local\Temp\swt-win32-3349.dll

C:\Users\paul\AppData\Local\Temp\uttAFC8.tmp.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-01-24 22:37
 

==================== End Of Log ============================

--- --- ---

Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015

Ran by paul at 2015-02-03 19:34:02

Running from C:\Users\paul\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Kaspersky Anti-Virus (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}

AS: Kaspersky Anti-Virus (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)

Apple Application Support (HKLM-x32\...\{122ADF8C-DDA1-480C-9936-C88F2825B265}) (Version: 2.1.9 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Aslain's XVM Mod Version 4.1.33 (HKLM-x32\...\ZRwTINhSZfduKONYrSCTiCiGPggQZdcLRvoAVxyCOXXpkHeC~1DC3968F_is1) (Version: 4.1.33 - Aslain)

AutoHotkey 1.0.48.05 (HKLM-x32\...\AutoHotkey) (Version: 1.0.48.05 - Chris Mallett)

BitTorrent (HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\BitTorrent) (Version: 7.9.2.38398 - BitTorrent Inc.)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)

Dark Souls: Prepare to Die Edition (HKLM-x32\...\Steam App 211420) (Version:  - FromSoftware)

DARK SOULS™ II (HKLM-x32\...\Steam App 236430) (Version:  - FromSoftware, Inc)

Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version:  - Stunlock Studios)

FLV and Media Player 4.2.1.1 (HKLM-x32\...\FLV and Media Player) (Version: 4.2.1.1 - Applian Technologies)

Fragen-Lern-CD 4.6 (HKLM-x32\...\de.wendel.flcd-de) (Version: 4.6.5 - Wendel-Verlag GmbH)

Fragen-Lern-CD 4.6 (x32 Version: 4.6.5 - Wendel-Verlag GmbH) Hidden

Free YouTube Download version 3.2.49.1122 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.49.1122 - DVDVideoSoft Ltd.)

Garry's Mod (HKLM-x32\...\Steam App 4000) (Version:  - Facepunch Studios)

Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}) (Version: 15.0.1.415 - Kaspersky Lab)

Kaspersky Anti-Virus (x32 Version: 15.0.1.415 - Kaspersky Lab) Hidden

League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)

Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)

NVIDIA 3D Vision Controller-Treiber 301.42 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 301.42 - NVIDIA Corporation)

NVIDIA 3D Vision Treiber 301.42 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 301.42 - NVIDIA Corporation)

NVIDIA Grafiktreiber 301.42 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 301.42 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.16.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.16.0 - NVIDIA Corporation)

NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)

NVIDIA Update 1.8.15 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.8.15 - NVIDIA Corporation)

OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)

Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)

PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.0 - pdfforge)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)

ROCCAT Kone[+] Mouse Driver (HKLM-x32\...\{B99CB207-4704-4C51-9309-0FA90AA26DD4}) (Version:  - Roccat GmbH)

Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)

Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)

War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

World of Tanks (HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

30-01-2015 11:07:09 Windows Update

01-02-2015 12:24:07 DirectX wurde installiert

02-02-2015 09:24:59 DirectX wurde installiert

02-02-2015 13:31:26 Removed Fragen-Lern-CD 4.6

03-02-2015 12:54:09 Windows Update

03-02-2015 13:24:40 DirectX wurde installiert
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {3C5BEC23-61CF-49D4-83C5-AD5D8DD161F0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {787D2A08-39B4-4E29-918E-A175A362829B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-07-18 17:38 - 2012-05-15 10:28 - 00085824 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2009-11-19 05:01 - 2009-11-19 05:01 - 00022016 _____ () C:\Windows\System32\sugw2l6.dll

2015-02-03 19:29 - 2015-02-03 19:29 - 00050477 _____ () C:\Users\paul\Downloads\Defogger.exe

2014-08-30 17:12 - 2014-08-30 17:12 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\kpcengine.2.3.dll

2014-12-23 17:51 - 2010-06-22 13:50 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\hiddriver.dll

2015-01-27 10:13 - 2015-01-27 10:13 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2014-08-30 17:12 - 2014-12-22 12:15 - 00459048 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll

2014-08-30 17:12 - 2014-12-22 12:15 - 00587048 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll

2015-01-25 12:50 - 2015-01-25 12:50 - 16844976 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll

2014-11-27 10:55 - 2014-12-01 22:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll

2014-11-27 10:55 - 2014-12-01 22:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll

2014-11-27 10:55 - 2014-12-01 22:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll

2014-11-27 10:55 - 2014-12-01 22:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll

2014-11-27 10:55 - 2014-11-11 19:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll

2015-01-20 11:37 - 2014-12-02 01:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll

2015-01-20 11:37 - 2014-12-02 01:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll

2015-01-20 11:37 - 2014-12-02 01:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll

2014-11-27 10:55 - 2015-01-23 23:34 - 02227904 _____ () C:\Program Files (x86)\Steam\video.dll

2014-11-27 10:55 - 2014-12-01 22:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll

2014-11-27 10:55 - 2015-01-23 23:33 - 00696512 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL

2014-11-27 10:55 - 2015-01-16 00:42 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

2014-11-27 10:55 - 2015-01-16 00:42 - 01709960 _____ () C:\Program Files (x86)\Steam\bin\ffmpegsumo.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-2492140108-2297389676-158246720-500 - Administrator - Disabled)

Gast (S-1-5-21-2492140108-2297389676-158246720-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2492140108-2297389676-158246720-1002 - Limited - Enabled)

paul (S-1-5-21-2492140108-2297389676-158246720-1001 - Administrator - Enabled) => C:\Users\paul

UpdatusUser (S-1-5-21-2492140108-2297389676-158246720-1003 - Limited - Enabled) => C:\Users\UpdatusUser
 

==================== Faulty Device Manager Devices =============
 

Name: SM-Bus-Controller

Description: SM-Bus-Controller

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 

Name: USB (Universal Serial Bus)-Controller

Description: USB (Universal Serial Bus)-Controller

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 10000
 

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 10000
 

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (02/02/2015 01:13:31 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: BitTorrent.exe, Version: 7.9.2.38398, Zeitstempel: 0x54c6c76c

Name des fehlerhaften Moduls: RPCRT4.dll, Version: 6.1.7601.18532, Zeitstempel: 0x53c3352a

Ausnahmecode: 0xc0020043

Fehleroffset: 0x0005d111

ID des fehlerhaften Prozesses: 0x1bd0

Startzeit der fehlerhaften Anwendung: 0xBitTorrent.exe0

Pfad der fehlerhaften Anwendung: BitTorrent.exe1

Pfad des fehlerhaften Moduls: BitTorrent.exe2

Berichtskennung: BitTorrent.exe3
 

Error: (01/28/2015 03:17:10 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 90080108
 

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 7004
 

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 7004
 

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (01/27/2015 09:47:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 6006
 

Error: (01/27/2015 09:47:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 6006
 
 

System errors:

=============

Error: (01/24/2015 11:24:46 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (01/24/2015 11:24:46 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
 

Error: (01/20/2015 11:37:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (01/20/2015 11:37:14 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
 

Error: (01/17/2015 02:38:10 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (01/16/2015 01:09:09 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
 

Error: (01/15/2015 01:02:21 AM) (Source: BugCheck) (EventID: 1001) (User: )

Description: 0x0000000a (0x00000000001d7c1b, 0x0000000000000002, 0x0000000000000000, 0xfffff800032841b0)C:\Windows\MEMORY.DMP011515-40326-01
 

Error: (01/07/2015 01:45:21 AM) (Source: volsnap) (EventID: 36) (User: )

Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 

Error: (01/02/2015 01:41:57 PM) (Source: volsnap) (EventID: 36) (User: )

Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 

Error: (01/02/2015 01:18:02 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
 
 

Microsoft Office Sessions:

=========================

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 10000
 

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 10000
 

Error: (02/03/2015 06:12:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (02/02/2015 01:13:31 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: BitTorrent.exe7.9.2.3839854c6c76cRPCRT4.dll6.1.7601.1853253c3352ac00200430005d1111bd001d03ee1a81863caC:\Users\paul\AppData\Roaming\BitTorrent\BitTorrent.exeC:\Windows\syswow64\RPCRT4.dlle63b1a6e-aad4-11e4-a785-50465d06929f
 

Error: (01/28/2015 03:17:10 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 90080108
 

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 7004
 

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 7004
 

Error: (01/27/2015 09:47:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (01/27/2015 09:47:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 6006
 

Error: (01/27/2015 09:47:43 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 6006
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz

Percentage of memory in use: 23%

Total physical RAM: 8125.66 MB

Available physical RAM: 6213.25 MB

Total Pagefile: 16249.51 MB

Available Pagefile: 13422.57 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:306.44 GB) (Free:122.42 GB) NTFS

Drive e: () (Fixed) (Total:289.64 GB) (Free:282.29 GB) NTFS

Drive h: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 9DC5DB2A)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=306.4 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=289.6 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hi, hoffe du kannst damit was anfangen^^

Code:

ComboFix 15-02-02.01 - paul 04.02.2015  22:22:35.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8126.3448 [GMT 1:00]

ausgeführt von:: c:\users\paul\Downloads\ComboFix.exe

AV: Kaspersky Anti-Virus *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}

SP: Kaspersky Anti-Virus *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\msdownld.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2015-01-04 bis 2015-02-04  ))))))))))))))))))))))))))))))

.

.

2015-02-04 21:27 . 2015-02-04 21:27        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2015-02-04 21:27 . 2015-02-04 21:27        --------        d-----w-        c:\users\Default\AppData\Local\temp

2015-02-03 18:33 . 2015-02-03 18:34        --------        d-----w-        C:\FRST

2015-02-03 11:54 . 2014-12-02 10:26        11870360        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{1038CAF4-F873-4158-B52E-82DFB2899200}\mpengine.dll

2015-02-02 12:11 . 2015-02-02 12:25        --------        d-----w-        c:\users\paul\AppData\Roaming\BitTorrent

2015-01-28 19:54 . 2015-01-28 19:54        --------        d-----w-        c:\users\paul\AppData\Roaming\de.wendel.flcd-de

2015-01-28 19:54 . 2015-02-02 12:31        --------        d-----w-        c:\program files (x86)\Common Files\Adobe AIR

2015-01-28 19:54 . 2015-01-28 19:54        --------        d-----w-        c:\program files (x86)\Wendel-Verlag

2015-01-27 15:38 . 2015-01-27 15:38        --------        d-----w-        c:\users\paul\AppData\Local\NBGI

2015-01-27 15:37 . 2015-01-27 15:37        --------        d-----w-        c:\windows\SysWow64\xlive

2015-01-27 15:37 . 2015-01-27 15:37        --------        d-----w-        c:\program files (x86)\Microsoft Games for Windows - LIVE

2015-01-25 19:32 . 2015-02-04 10:04        --------        d-----w-        c:\users\paul\AppData\Roaming\FLV and Media Player

2015-01-25 19:31 . 2015-01-25 19:31        --------        d-----w-        c:\program files (x86)\Applian Technologies

2015-01-25 18:34 . 2015-02-04 09:57        --------        d-----w-        c:\users\paul\dwhelper

2015-01-25 18:28 . 2015-01-25 18:28        --------        d-----w-        c:\program files\WinRAR

2015-01-13 19:29 . 2015-01-13 19:29        --------        d-----w-        c:\users\paul\AppData\Roaming\Wargaming.net

2015-01-07 11:05 . 2013-04-09 23:34        1247744        ----a-w-        c:\windows\SysWow64\DWrite.dll

2015-01-07 11:05 . 2013-04-02 22:51        1643520        ----a-w-        c:\windows\system32\DWrite.dll

2015-01-06 19:26 . 2015-01-06 19:26        --------        d-----w-        c:\users\paul\AppData\Roaming\OpenOffice

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2015-02-04 17:57 . 2014-11-27 09:58        163504        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin

2015-01-27 15:40 . 2009-08-18 11:49        564632        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll

2015-01-27 15:40 . 2009-08-18 10:24        23256        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2015-01-25 11:50 . 2012-07-18 16:33        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2015-01-25 11:50 . 2012-07-18 16:33        701616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2015-01-06 03:36 . 2012-07-18 16:26        298120        ------w-        c:\windows\system32\MpSigStub.exe

2014-12-22 11:15 . 2014-08-20 17:04        818888        ----a-w-        c:\windows\system32\drivers\klif.sys

2014-12-22 11:15 . 2014-08-18 13:43        150536        ----a-w-        c:\windows\system32\drivers\klflt.sys

2014-12-22 11:15 . 2014-08-13 18:34        77512        ----a-w-        c:\windows\system32\drivers\klwtp.sys

2014-12-13 05:09 . 2014-12-18 10:30        144384        ----a-w-        c:\windows\system32\ieUnatt.exe

2014-12-13 03:33 . 2014-12-18 10:30        115712        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2014-12-04 02:50 . 2014-12-16 18:17        413184        ----a-w-        c:\windows\system32\generaltel.dll

2014-12-04 02:50 . 2014-12-16 18:17        741376        ----a-w-        c:\windows\system32\invagent.dll

2014-12-04 02:50 . 2014-12-16 18:17        396800        ----a-w-        c:\windows\system32\devinv.dll

2014-12-04 02:50 . 2014-12-16 18:17        830976        ----a-w-        c:\windows\system32\appraiser.dll

2014-12-04 02:50 . 2014-12-16 18:17        192000        ----a-w-        c:\windows\system32\aepic.dll

2014-12-04 02:50 . 2014-12-16 18:17        227328        ----a-w-        c:\windows\system32\aepdu.dll

2014-12-04 02:44 . 2014-12-16 18:17        1083392        ----a-w-        c:\windows\system32\aeinv.dll

2014-12-01 23:28 . 2014-12-16 18:17        1232040        ----a-w-        c:\windows\system32\aitstatic.exe

2014-12-01 19:31 . 2014-12-01 19:31        113848        ----a-w-        c:\windows\system32\pdfcmon.dll

2014-11-28 20:01 . 2014-11-28 20:01        194048        ----a-w-        c:\windows\SysWow64\elshyph.dll

2014-11-28 20:01 . 2014-11-28 20:01        942592        ----a-w-        c:\windows\system32\jsIntl.dll

2014-11-28 20:01 . 2014-11-28 20:01        90112        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2014-11-28 20:01 . 2014-11-28 20:01        86016        ----a-w-        c:\windows\SysWow64\iesysprep.dll

2014-11-28 20:01 . 2014-11-28 20:01        86016        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2014-11-28 20:01 . 2014-11-28 20:01        81408        ----a-w-        c:\windows\system32\icardie.dll

2014-11-28 20:01 . 2014-11-28 20:01        774144        ----a-w-        c:\windows\system32\jscript.dll

2014-11-28 20:01 . 2014-11-28 20:01        77312        ----a-w-        c:\windows\system32\tdc.ocx

2014-11-28 20:01 . 2014-11-28 20:01        74240        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2014-11-28 20:01 . 2014-11-28 20:01        71680        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe

2014-11-28 20:01 . 2014-11-28 20:01        645120        ----a-w-        c:\windows\SysWow64\jsIntl.dll

2014-11-28 20:01 . 2014-11-28 20:01        62464        ----a-w-        c:\windows\SysWow64\tdc.ocx

2014-11-28 20:01 . 2014-11-28 20:01        62464        ----a-w-        c:\windows\system32\pngfilt.dll

2014-11-28 20:01 . 2014-11-28 20:01        616104        ----a-w-        c:\windows\system32\ieapfltr.dat

2014-11-28 20:01 . 2014-11-28 20:01        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2014-11-28 20:01 . 2014-11-28 20:01        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2014-11-28 20:01 . 2014-11-28 20:01        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2014-11-28 20:01 . 2014-11-28 20:01        48128        ----a-w-        c:\windows\system32\imgutil.dll

2014-11-28 20:01 . 2014-11-28 20:01        413696        ----a-w-        c:\windows\system32\html.iec

2014-11-28 20:01 . 2014-11-28 20:01        36352        ----a-w-        c:\windows\SysWow64\imgutil.dll

2014-11-28 20:01 . 2014-11-28 20:01        337408        ----a-w-        c:\windows\SysWow64\html.iec

2014-11-28 20:01 . 2014-11-28 20:01        30208        ----a-w-        c:\windows\system32\licmgr10.dll

2014-11-28 20:01 . 2014-11-28 20:01        247808        ----a-w-        c:\windows\system32\msls31.dll

2014-11-28 20:01 . 2014-11-28 20:01        24576        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2014-11-28 20:01 . 2014-11-28 20:01        243200        ----a-w-        c:\windows\system32\webcheck.dll

2014-11-28 20:01 . 2014-11-28 20:01        235520        ----a-w-        c:\windows\system32\url.dll

2014-11-28 20:01 . 2014-11-28 20:01        235008        ----a-w-        c:\windows\system32\elshyph.dll

2014-11-28 20:01 . 2014-11-28 20:01        182272        ----a-w-        c:\windows\SysWow64\msls31.dll

2014-11-28 20:01 . 2014-11-28 20:01        167424        ----a-w-        c:\windows\system32\iexpress.exe

2014-11-28 20:01 . 2014-11-28 20:01        151552        ----a-w-        c:\windows\SysWow64\iexpress.exe

2014-11-28 20:01 . 2014-11-28 20:01        147968        ----a-w-        c:\windows\system32\occache.dll

2014-11-28 20:01 . 2014-11-28 20:01        143872        ----a-w-        c:\windows\system32\wextract.exe

2014-11-28 20:01 . 2014-11-28 20:01        139264        ----a-w-        c:\windows\SysWow64\wextract.exe

2014-11-28 20:01 . 2014-11-28 20:01        13824        ----a-w-        c:\windows\system32\mshta.exe

2014-11-28 20:01 . 2014-11-28 20:01        135680        ----a-w-        c:\windows\system32\iepeers.dll

2014-11-28 20:01 . 2014-11-28 20:01        13312        ----a-w-        c:\windows\SysWow64\mshta.exe

2014-11-28 20:01 . 2014-11-28 20:01        13312        ----a-w-        c:\windows\system32\msfeedssync.exe

2014-11-28 20:01 . 2014-11-28 20:01        131072        ----a-w-        c:\windows\system32\IEAdvpack.dll

2014-11-28 20:01 . 2014-11-28 20:01        111616        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2014-11-28 20:01 . 2014-11-28 20:01        105984        ----a-w-        c:\windows\system32\iesysprep.dll

2014-11-28 20:01 . 2014-11-28 20:01        101376        ----a-w-        c:\windows\system32\inseng.dll

2014-11-28 19:58 . 2014-11-28 19:58        9728        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        648192        ----a-w-        c:\windows\system32\d3d10level9.dll

2014-11-28 19:58 . 2014-11-28 19:58        604160        ----a-w-        c:\windows\SysWow64\d3d10level9.dll

2014-11-28 19:58 . 2014-11-28 19:58        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        522752        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2014-11-28 19:58 . 2014-11-28 19:58        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        4096        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        364544        ----a-w-        c:\windows\SysWow64\XpsGdiConverter.dll

2014-11-28 19:58 . 2014-11-28 19:58        363008        ----a-w-        c:\windows\system32\dxgi.dll

2014-11-28 19:58 . 2014-11-28 19:58        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        3584        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        333312        ----a-w-        c:\windows\system32\d3d10_1core.dll

2014-11-28 19:58 . 2014-11-28 19:58        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        296960        ----a-w-        c:\windows\system32\d3d10core.dll

2014-11-28 19:58 . 2014-11-28 19:58        293376        ----a-w-        c:\windows\SysWow64\dxgi.dll

2014-11-28 19:58 . 2014-11-28 19:58        2560        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        2560        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        249856        ----a-w-        c:\windows\SysWow64\d3d10_1core.dll

2014-11-28 19:58 . 2014-11-28 19:58        245248        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2014-11-28 19:58 . 2014-11-28 19:58        221184        ----a-w-        c:\windows\system32\UIAnimation.dll

2014-11-28 19:58 . 2014-11-28 19:58        220160        ----a-w-        c:\windows\SysWow64\d3d10core.dll

2014-11-28 19:58 . 2014-11-28 19:58        207872        ----a-w-        c:\windows\SysWow64\WindowsCodecsExt.dll

2014-11-28 19:58 . 2014-11-28 19:58        194560        ----a-w-        c:\windows\system32\d3d10_1.dll

2014-11-28 19:58 . 2014-11-28 19:58        187392        ----a-w-        c:\windows\SysWow64\UIAnimation.dll

2014-11-28 19:58 . 2014-11-28 19:58        1682432        ----a-w-        c:\windows\system32\XpsPrint.dll

2014-11-28 19:58 . 2014-11-28 19:58        161792        ----a-w-        c:\windows\SysWow64\d3d10_1.dll

2014-11-28 19:58 . 2014-11-28 19:58        1238528        ----a-w-        c:\windows\system32\d3d10.dll

2014-11-28 19:58 . 2014-11-28 19:58        1175552        ----a-w-        c:\windows\system32\FntCache.dll

2014-11-28 19:58 . 2014-11-28 19:58        1158144        ----a-w-        c:\windows\SysWow64\XpsPrint.dll

2014-11-28 19:58 . 2014-11-28 19:58        1080832        ----a-w-        c:\windows\SysWow64\d3d10.dll

2014-11-28 19:58 . 2014-11-28 19:58        10752        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll

2014-11-28 19:58 . 2014-11-28 19:58        10752        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2014-11-22 12:54        323752        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 AVP15.0.1;Kaspersky Anti-Virus Service 15.0.1;c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]

S0 cm_km_w;Kaspersky Lab Crypto Module (FDE PDK);c:\windows\system32\DRIVERS\cm_km_w.sys;c:\windows\SYSNATIVE\DRIVERS\cm_km_w.sys [x]

S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]

S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]

S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]

S1 Klwtp;Klwtp;c:\windows\system32\DRIVERS\klwtp.sys;c:\windows\SYSNATIVE\DRIVERS\klwtp.sys [x]

S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]

S2 kldisk;kldisk;c:\windows\system32\DRIVERS\kldisk.sys;c:\windows\SYSNATIVE\DRIVERS\kldisk.sys [x]

S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]

S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]

S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]

S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]

S3 LVUVC64;Logitech HD Webcam C510(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - KXLDAPOD

*Deregistered* - kxldapod

.

Inhalt des "geplante Tasks" Ordners

.

2015-02-04 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-18 11:50]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2014-11-20 13:53        357376        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm

IE: {{09A10376-994C-4BBF-9121-F50CF7BA237E} - {F2A56BFE-7911-451A-BC74-A9C3C2E95126} - c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll

IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

FF - user.js: plugin.state.npcontentblocker - 2

FF - user.js: plugin.state.nponlinebanking - 2

FF - user.js: plugin.state.npvkplugin - 2

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2015-02-04  22:28:57

ComboFix-quarantined-files.txt  2015-02-04 21:28

.

Vor Suchlauf: 13 Verzeichnis(se), 130.948.173.824 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 131.980.242.944 Bytes frei

.

- - End Of File - - 4BF2C6C2F6A750DE032F129FE30B4ABE

A36C5E4F47E84449FF07ED3517B43A31

Mir fällt grade auf, dass ich den Defender nicht deaktiviert habe, habe allerdings keine Fehldermeldung oder Ähnliches bekommen. Wenn ich den Scan wiederholen soll dann sag bescheid ^^

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Alles klar!

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 05.02.2015

Suchlauf-Zeit: 11:59:36

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.4.1028

Malware Datenbank: v2015.02.05.04

Rootkit Datenbank: v2015.02.03.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: paul
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 377367

Verstrichene Zeit: 3 Min, 22 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Warnen

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente erkannt)
 

Module: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsschlüssel: 0

(Keine schädliche Elemente erkannt)
 

Registrierungswerte: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsdaten: 0

(Keine schädliche Elemente erkannt)
 

Ordner: 0

(Keine schädliche Elemente erkannt)
 

Dateien: 0

(Keine schädliche Elemente erkannt)
 

Physische Sektoren: 0

(Keine schädliche Elemente erkannt)
 
 

(end)

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.2 (02.02.2015:1)

OS: Windows 7 Home Premium x64

Ran by paul on 05.02.2015 at 12:07:47,03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\Users\paul\AppData\Roaming\pdfforge"
 
 
 

~~~ FireFox
 

Successfully deleted: [File] C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\qfm7bsca.default\user.js

Emptied folder: C:\Users\paul\AppData\Roaming\mozilla\firefox\profiles\qfm7bsca.default\minidumps [31 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 05.02.2015 at 12:09:45,33

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

# AdwCleaner v4.109 - Bericht erstellt am 05/02/2015 um 12:13:11

# Aktualisiert 24/01/2015 von Xplode

# Database : 2015-02-04.1 [Live]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : paul - PAUL-PC

# Gestartet von : C:\Users\paul\Downloads\AdwCleaner_4.109.exe

# Option : Suchen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gefunden : C:\Users\paul\AppData\Roaming\RHEng
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Daten Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17496
 
 

-\\ Mozilla Firefox v35.0.1 (x86 de)
 
 

*************************
 

AdwCleaner[R0].txt - [1619 octets] - [05/02/2015 12:13:11]
 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1679 octets] ##########

Code:

# AdwCleaner v4.109 - Bericht erstellt am 05/02/2015 um 12:16:26

# Aktualisiert 24/01/2015 von Xplode

# Database : 2015-02-04.1 [Live]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : paul - PAUL-PC

# Gestartet von : C:\Users\paul\Downloads\AdwCleaner_4.109.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Users\paul\AppData\Roaming\RHEng
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17496
 
 

-\\ Mozilla Firefox v35.0.1 (x86 de)
 
 

*************************
 

AdwCleaner[R0].txt - [1767 octets] - [05/02/2015 12:13:11]

AdwCleaner[S0].txt - [1680 octets] - [05/02/2015 12:16:26]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1740 octets] ##########

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01

Ran by paul (administrator) on PAUL-PC on 05-02-2015 12:22:40

Running from C:\Users\paul\Desktop

Loaded Profiles: paul & UpdatusUser (Available profiles: paul & UpdatusUser)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avpui.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)

HKLM-x32\...\Run: [RoccatKone+] => C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE [557056 2013-09-13] (ROCCAT GmbH)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-2492140108-2297389676-158246720-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default

FF SelectedSearchEngine: Google

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()

FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com ()

FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com ()

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2492140108-2297389676-158246720-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF SearchPlugin: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\searchplugins\trovi.xml

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-03]

FF Extension: DownloadHelper - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]

FF Extension: Adblock Plus - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-07-25]

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-01-27]

FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com

FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com [2014-12-22]

FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com

FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]

FF HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-03]
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)

R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO)

R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2014-12-22] (Kaspersky Lab ZAO)

R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2014-12-22] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO)

R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2014-12-22] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]

U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-05 12:22 - 2015-02-05 12:22 - 00000000 ____D () C:\Users\paul\Desktop\FRST-OlderVersion

2015-02-05 12:16 - 2015-02-05 12:20 - 00001828 _____ () C:\Users\paul\Desktop\AdwCleaner[S0].txt

2015-02-05 12:16 - 2015-02-05 12:16 - 00001767 _____ () C:\Users\paul\Desktop\AdwCleaner[R0].txt

2015-02-05 12:13 - 2015-02-05 12:22 - 00000000 ____D () C:\AdwCleaner

2015-02-05 12:09 - 2015-02-05 12:09 - 00000940 _____ () C:\Users\paul\Desktop\JRT.txt

2015-02-05 12:04 - 2015-02-05 12:04 - 00001198 _____ () C:\Users\paul\Desktop\mbam.txt

2015-02-05 12:04 - 2015-02-05 12:04 - 00001198 _____ () C:\mbam.txt

2015-02-05 11:49 - 2015-02-05 11:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-02-05 11:49 - 2015-02-05 11:49 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-02-05 11:49 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-02-05 11:49 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-02-05 11:49 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-02-05 11:45 - 2015-02-05 11:45 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\paul\Downloads\mbam-setup-2.0.4.1028.exe

2015-02-05 11:45 - 2015-02-05 11:45 - 02194432 _____ () C:\Users\paul\Downloads\AdwCleaner_4.109.exe

2015-02-05 11:45 - 2015-02-05 11:45 - 01388274 _____ (Thisisu) C:\Users\paul\Downloads\JRT.exe

2015-02-04 23:41 - 2015-02-04 23:41 - 00519128 _____ () C:\Windows\Minidump\020415-17908-01.dmp

2015-02-04 22:50 - 2015-02-04 22:50 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2015-02-04 22:28 - 2015-02-04 22:28 - 00018312 _____ () C:\ComboFix.txt

2015-02-04 22:21 - 2015-02-04 22:28 - 00000000 ____D () C:\Windows\erdnt

2015-02-04 22:21 - 2015-02-04 22:28 - 00000000 ____D () C:\Qoobox

2015-02-04 22:21 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2015-02-04 22:21 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2015-02-04 22:21 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2015-02-04 22:18 - 2015-02-04 22:18 - 05611380 ____R (Swearware) C:\Users\paul\Downloads\ComboFix.exe

2015-02-04 10:32 - 2015-02-04 10:32 - 00037494 _____ () C:\Users\paul\Desktop\gmer.txt

2015-02-03 19:38 - 2015-02-03 19:38 - 00020073 _____ () C:\Users\paul\Desktop\Addition.txt

2015-02-03 19:37 - 2015-02-05 12:22 - 00011111 _____ () C:\Users\paul\Desktop\FRST.txt

2015-02-03 19:35 - 2015-02-03 19:36 - 00380416 _____ () C:\Users\paul\Downloads\nvdf6jxn.exe

2015-02-03 19:34 - 2015-02-03 19:34 - 00020073 _____ () C:\Users\paul\Downloads\Addition.txt

2015-02-03 19:33 - 2015-02-05 12:22 - 00000000 ____D () C:\FRST

2015-02-03 19:33 - 2015-02-03 19:34 - 00024311 _____ () C:\Users\paul\Downloads\FRST.txt

2015-02-03 19:32 - 2015-02-05 12:22 - 02131968 _____ (Farbar) C:\Users\paul\Desktop\FRST64.exe

2015-02-03 19:30 - 2015-02-03 19:30 - 00000470 _____ () C:\Users\paul\Downloads\defogger_disable.log

2015-02-03 19:30 - 2015-02-03 19:30 - 00000000 _____ () C:\Users\paul\defogger_reenable

2015-02-03 19:29 - 2015-02-03 19:29 - 00050477 _____ () C:\Users\paul\Downloads\Defogger.exe

2015-02-02 13:12 - 2015-02-02 13:12 - 00000869 _____ () C:\Users\paul\Desktop\BitTorrent.lnk

2015-02-02 13:12 - 2015-02-02 13:12 - 00000849 _____ () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk

2015-02-02 13:11 - 2015-02-02 13:25 - 00000000 ____D () C:\Users\paul\AppData\Roaming\BitTorrent

2015-02-02 13:11 - 2015-02-02 13:11 - 01738840 _____ (BitTorrent Inc.) C:\Users\paul\Downloads\BitTorrent_7.9.2.38398.exe

2015-01-31 22:45 - 2015-01-31 22:46 - 01983604 _____ () C:\Users\paul\Downloads\HoxHud P8.8 Self-installer.exe

2015-01-29 14:16 - 2015-01-29 14:30 - 44769901 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.33_95.exe

2015-01-28 20:54 - 2015-01-28 20:54 - 00001111 _____ () C:\Users\Public\Desktop\Fragen-Lern-CD 4.6.lnk

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\paul\AppData\Roaming\de.wendel.flcd-de

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wendel-Verlag

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Wendel-Verlag

2015-01-27 21:02 - 2015-01-27 21:26 - 00000000 ____D () C:\Users\paul\Downloads\DSfix24

2015-01-27 21:01 - 2015-01-27 21:02 - 00392093 _____ () C:\Users\paul\Downloads\DSfix24.zip

2015-01-27 16:38 - 2015-01-27 16:38 - 00000000 ____D () C:\Users\paul\AppData\Local\NBGI

2015-01-27 16:37 - 2015-01-27 16:37 - 00001338 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Windows\SysWOW64\xlive

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE

2015-01-27 10:13 - 2015-01-27 10:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-25 20:32 - 2015-02-04 11:04 - 00000000 ____D () C:\Users\paul\AppData\Roaming\FLV and Media Player

2015-01-25 20:31 - 2015-01-25 20:31 - 00001325 _____ () C:\Users\Public\Desktop\FLV and Media Player.lnk

2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies

2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\Program Files (x86)\Applian Technologies

2015-01-25 20:29 - 2015-01-25 20:30 - 23750568 _____ () C:\Users\paul\Downloads\FLVPlayer4211Install.exe

2015-01-25 19:34 - 2015-02-04 10:57 - 00000000 ____D () C:\Users\paul\dwhelper

2015-01-25 19:28 - 2015-01-25 19:30 - 00000000 ____D () C:\Users\paul\Downloads\chrome

2015-01-25 19:28 - 2015-01-25 19:28 - 00000979 _____ () C:\Users\Public\Desktop\WinRAR.lnk

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Program Files\WinRAR

2015-01-25 19:28 - 2014-09-05 09:15 - 00003914 _____ () C:\Users\paul\Downloads\chrome.manifest

2015-01-25 19:28 - 2014-09-05 09:15 - 00001956 _____ () C:\Users\paul\Downloads\install.rdf

2015-01-25 19:28 - 2014-09-05 09:15 - 00000000 ____D () C:\Users\paul\Downloads\defaults

2015-01-25 19:27 - 2015-01-25 19:27 - 02060888 _____ () C:\Users\paul\Downloads\winrar-x64-520d.exe

2015-01-25 19:26 - 2015-01-25 19:26 - 00772184 _____ () C:\Users\paul\Downloads\video_downloadhelper-4.9.24-sm_fx.zip

2015-01-24 15:17 - 2015-01-24 15:17 - 00000000 ____D () C:\Users\paul\Documents\nbgi

2015-01-24 14:34 - 2015-01-24 14:34 - 00000222 _____ () C:\Users\paul\Desktop\Dark Souls Prepare to Die Edition.url

2015-01-22 10:37 - 2015-02-05 11:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-22 10:37 - 2015-02-04 22:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-18 02:02 - 2015-01-18 02:02 - 40177100 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.26_95.exe

2015-01-15 01:02 - 2015-01-15 01:02 - 00302688 _____ () C:\Windows\Minidump\011515-40326-01.dmp

2015-01-14 12:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 12:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 12:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 12:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-01-14 12:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-01-14 12:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-01-14 12:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-14 12:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-01-14 12:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-01-14 12:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 12:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-14 12:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2015-01-14 12:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2015-01-13 20:29 - 2015-01-13 20:29 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Wargaming.net

2015-01-11 19:09 - 2015-01-11 19:09 - 00000769 _____ () C:\Users\paul\Desktop\World of Tanks.lnk

2015-01-11 19:09 - 2015-01-11 19:09 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Tanks

2015-01-07 12:05 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-01-07 12:05 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-01-06 20:26 - 2015-01-06 20:26 - 00000000 ____D () C:\Users\paul\AppData\Roaming\OpenOffice
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-05 12:19 - 2014-12-22 12:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2015-02-05 12:18 - 2014-11-29 09:27 - 00109980 _____ () C:\Windows\PFRO.log

2015-02-05 12:18 - 2012-07-18 17:39 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-02-05 12:18 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-05 12:18 - 2009-07-14 05:51 - 00037391 _____ () C:\Windows\setupact.log

2015-02-05 12:16 - 2012-07-18 16:47 - 01328099 _____ () C:\Windows\WindowsUpdate.log

2015-02-05 11:45 - 2014-11-27 10:52 - 00000000 ____D () C:\Program Files (x86)\Steam

2015-02-05 09:52 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-05 09:52 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-04 23:41 - 2012-07-19 15:07 - 1297523543 _____ () C:\Windows\MEMORY.DMP

2015-02-04 23:41 - 2012-07-19 15:07 - 00000000 ____D () C:\Windows\Minidump

2015-02-04 22:50 - 2012-07-18 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-04 22:50 - 2012-07-18 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-04 22:27 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2015-02-04 13:16 - 2014-11-27 11:58 - 00075288 _____ () C:\Windows\DirectX.log

2015-02-03 19:30 - 2012-07-18 17:14 - 00000000 ____D () C:\Users\paul

2015-01-31 13:49 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-01-29 09:45 - 2012-07-18 17:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\ProgramData\Adobe

2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\Program Files (x86)\Adobe

2015-01-28 20:46 - 2014-11-27 10:59 - 00000000 ____D () C:\Users\paul\AppData\Local\Adobe

2015-01-28 20:46 - 2012-07-18 17:36 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Adobe

2015-01-27 16:37 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-01-27 16:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

2015-01-27 13:25 - 2012-07-18 17:37 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Skype

2015-01-24 14:34 - 2014-11-27 11:04 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-01-18 12:52 - 2012-07-18 18:09 - 00065832 _____ () C:\Users\paul\AppData\Local\GDIPFONTCACHEV1.DAT

2015-01-18 12:43 - 2009-07-14 05:45 - 00301632 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-01-17 15:46 - 2012-07-18 18:08 - 00000000 ____D () C:\ProgramData\Apple Computer

2015-01-11 19:09 - 2012-05-08 19:50 - 00000000 ____D () C:\Games

2015-01-11 13:21 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

2015-01-06 20:37 - 2012-07-18 17:37 - 00000000 ____D () C:\Windows.old

2015-01-06 04:36 - 2012-07-18 17:26 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
 

Some content of TEMP:

====================

C:\Users\paul\AppData\Local\Temp\Quarantine.exe

C:\Users\paul\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-04 23:59
 

==================== End Of Log ============================

--- --- ---

Danke für die Hilfe! Wenn was neu gemacht werden muss einfach sagen ^^

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Nur als kurze Zwischenfrage, einige Scanner haben ja anscheinend was gefunden. Habe mich hier im Forum schon etwas umgesehen, bin allerdings noch immer unsicher was die Funde angeht. Handelte es sich dabei um Malware oder waren das mehr oder weniger harmlose Einträge?

Habe außerdem den Link gefunden, auf den ich geklickt habe. Falls du damit was anfangen kannst, poste ich ihn hier.

Zu den Problemen, da ist mir bisher wenig aufgefallen, außer, dass sich Programme teilweise selbst schließen bzw abstürzen und der Pc manchmal beim Hochfahren "festhängt", wobei das auch an der Hardware liegen kann. Ging mir hauptsächlich um das was man eben nicht so einfach bemerkt. Bin bezüglich des Themas Viren auch etwas paranoid muss ich sagen. Bin dir auf jeden Fall für deine Hilfe dankbar!

Code:

Results of screen317's Security Check version 0.99.95  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Kaspersky Anti-Virus   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

  Java 64-bit 8 Update 31  

 Adobe Flash Player 16.0.0.305  

 Adobe Reader XI  

 Mozilla Firefox (35.0.1) 
 ````````Process Check: objlist.exe by Laurent````````  

 Kaspersky Lab Kaspersky Anti-Virus 15.0.1 avp.exe  

 Kaspersky Lab Kaspersky Anti-Virus 15.0.1 avpui.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Beim Log oben hatte er etwas namens Win32/InstallMonetizer.aq gefunden, bin mir nicht sicher, ob das Programm das allerdings auch bereinigt hat.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01

Ran by paul (administrator) on PAUL-PC on 05-02-2015 17:07:43

Running from C:\Users\paul\Desktop

Loaded Profiles: paul & UpdatusUser (Available profiles: paul & UpdatusUser)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)

HKLM-x32\...\Run: [RoccatKone+] => C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE [557056 2013-09-13] (ROCCAT GmbH)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2492140108-2297389676-158246720-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-2492140108-2297389676-158246720-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default

FF SelectedSearchEngine: Google

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()

FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com ()

FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com ()

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2492140108-2297389676-158246720-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF SearchPlugin: C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\searchplugins\trovi.xml

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-03]

FF Extension: DownloadHelper - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-01-25]

FF Extension: Adblock Plus - C:\Users\paul\AppData\Roaming\Mozilla\Firefox\Profiles\qfm7bsca.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-07-25]

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-01-27]

FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com

FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\content_blocker@kaspersky.com [2014-12-22]

FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com

FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2014-12-22]

FF HKU\S-1-5-21-2492140108-2297389676-158246720-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-03]
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)

R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO)

R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2014-12-22] (Kaspersky Lab ZAO)

R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2014-12-22] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO)

R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2014-12-22] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]

U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-05 17:05 - 2015-02-05 17:05 - 00003252 _____ () C:\Windows\System32\Tasks\{6726F217-5D23-4B88-96BC-D68319EDAFA4}

2015-02-05 15:36 - 2015-02-05 15:36 - 00000820 _____ () C:\Users\paul\Desktop\checkup.txt

2015-02-05 15:32 - 2015-02-05 15:32 - 02347384 _____ (ESET) C:\Users\paul\Downloads\esetsmartinstaller_deu.exe

2015-02-05 15:32 - 2015-02-05 15:32 - 00852573 _____ () C:\Users\paul\Downloads\SecurityCheck.exe

2015-02-05 12:24 - 2015-02-05 12:24 - 00026450 _____ () C:\Users\paul\Desktop\FRST1.txt

2015-02-05 12:22 - 2015-02-05 12:22 - 00000000 ____D () C:\Users\paul\Desktop\FRST-OlderVersion

2015-02-05 12:16 - 2015-02-05 12:20 - 00001828 _____ () C:\Users\paul\Desktop\AdwCleaner[S0].txt

2015-02-05 12:16 - 2015-02-05 12:16 - 00001767 _____ () C:\Users\paul\Desktop\AdwCleaner[R0].txt

2015-02-05 12:13 - 2015-02-05 12:33 - 00000000 ____D () C:\AdwCleaner

2015-02-05 12:09 - 2015-02-05 12:09 - 00000940 _____ () C:\Users\paul\Desktop\JRT.txt

2015-02-05 12:04 - 2015-02-05 12:04 - 00001198 _____ () C:\Users\paul\Desktop\mbam.txt

2015-02-05 12:04 - 2015-02-05 12:04 - 00001198 _____ () C:\mbam.txt

2015-02-05 11:49 - 2015-02-05 11:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-02-05 11:49 - 2015-02-05 11:49 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-02-05 11:49 - 2015-02-05 11:49 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-02-05 11:49 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-02-05 11:49 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-02-05 11:49 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-02-05 11:45 - 2015-02-05 11:45 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\paul\Downloads\mbam-setup-2.0.4.1028.exe

2015-02-05 11:45 - 2015-02-05 11:45 - 02194432 _____ () C:\Users\paul\Downloads\AdwCleaner_4.109.exe

2015-02-05 11:45 - 2015-02-05 11:45 - 01388274 _____ (Thisisu) C:\Users\paul\Downloads\JRT.exe

2015-02-04 23:41 - 2015-02-04 23:41 - 00519128 _____ () C:\Windows\Minidump\020415-17908-01.dmp

2015-02-04 22:50 - 2015-02-04 22:50 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2015-02-04 22:28 - 2015-02-04 22:28 - 00018312 _____ () C:\ComboFix.txt

2015-02-04 22:21 - 2015-02-04 22:28 - 00000000 ____D () C:\Windows\erdnt

2015-02-04 22:21 - 2015-02-04 22:28 - 00000000 ____D () C:\Qoobox

2015-02-04 22:21 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2015-02-04 22:21 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2015-02-04 22:21 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2015-02-04 22:21 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2015-02-04 22:18 - 2015-02-04 22:18 - 05611380 ____R (Swearware) C:\Users\paul\Downloads\ComboFix.exe

2015-02-04 10:32 - 2015-02-04 10:32 - 00037494 _____ () C:\Users\paul\Desktop\gmer.txt

2015-02-03 19:38 - 2015-02-03 19:38 - 00020073 _____ () C:\Users\paul\Desktop\Addition.txt

2015-02-03 19:37 - 2015-02-05 17:07 - 00011338 _____ () C:\Users\paul\Desktop\FRST.txt

2015-02-03 19:35 - 2015-02-03 19:36 - 00380416 _____ () C:\Users\paul\Downloads\nvdf6jxn.exe

2015-02-03 19:34 - 2015-02-03 19:34 - 00020073 _____ () C:\Users\paul\Downloads\Addition.txt

2015-02-03 19:33 - 2015-02-05 17:07 - 00000000 ____D () C:\FRST

2015-02-03 19:33 - 2015-02-03 19:34 - 00024311 _____ () C:\Users\paul\Downloads\FRST.txt

2015-02-03 19:32 - 2015-02-05 12:22 - 02131968 _____ (Farbar) C:\Users\paul\Desktop\FRST64.exe

2015-02-03 19:30 - 2015-02-03 19:30 - 00000470 _____ () C:\Users\paul\Downloads\defogger_disable.log

2015-02-03 19:30 - 2015-02-03 19:30 - 00000000 _____ () C:\Users\paul\defogger_reenable

2015-02-03 19:29 - 2015-02-03 19:29 - 00050477 _____ () C:\Users\paul\Downloads\Defogger.exe

2015-02-02 13:12 - 2015-02-02 13:12 - 00000869 _____ () C:\Users\paul\Desktop\BitTorrent.lnk

2015-02-02 13:12 - 2015-02-02 13:12 - 00000849 _____ () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk

2015-02-02 13:11 - 2015-02-02 13:25 - 00000000 ____D () C:\Users\paul\AppData\Roaming\BitTorrent

2015-02-02 13:11 - 2015-02-02 13:11 - 01738840 _____ (BitTorrent Inc.) C:\Users\paul\Downloads\BitTorrent_7.9.2.38398.exe

2015-01-31 22:45 - 2015-01-31 22:46 - 01983604 _____ () C:\Users\paul\Downloads\HoxHud P8.8 Self-installer.exe

2015-01-29 14:16 - 2015-01-29 14:30 - 44769901 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.33_95.exe

2015-01-28 20:54 - 2015-01-28 20:54 - 00001111 _____ () C:\Users\Public\Desktop\Fragen-Lern-CD 4.6.lnk

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\paul\AppData\Roaming\de.wendel.flcd-de

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wendel-Verlag

2015-01-28 20:54 - 2015-01-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Wendel-Verlag

2015-01-27 21:02 - 2015-01-27 21:26 - 00000000 ____D () C:\Users\paul\Downloads\DSfix24

2015-01-27 21:01 - 2015-01-27 21:02 - 00392093 _____ () C:\Users\paul\Downloads\DSfix24.zip

2015-01-27 16:38 - 2015-01-27 16:38 - 00000000 ____D () C:\Users\paul\AppData\Local\NBGI

2015-01-27 16:37 - 2015-01-27 16:37 - 00001338 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Windows\SysWOW64\xlive

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace

2015-01-27 16:37 - 2015-01-27 16:37 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE

2015-01-27 10:13 - 2015-01-27 10:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-25 20:32 - 2015-02-05 16:49 - 00000000 ____D () C:\Users\paul\AppData\Roaming\FLV and Media Player

2015-01-25 20:31 - 2015-01-25 20:31 - 00001325 _____ () C:\Users\Public\Desktop\FLV and Media Player.lnk

2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies

2015-01-25 20:31 - 2015-01-25 20:31 - 00000000 ____D () C:\Program Files (x86)\Applian Technologies

2015-01-25 20:29 - 2015-01-25 20:30 - 23750568 _____ () C:\Users\paul\Downloads\FLVPlayer4211Install.exe

2015-01-25 19:34 - 2015-02-04 10:57 - 00000000 ____D () C:\Users\paul\dwhelper

2015-01-25 19:28 - 2015-01-25 19:30 - 00000000 ____D () C:\Users\paul\Downloads\chrome

2015-01-25 19:28 - 2015-01-25 19:28 - 00000979 _____ () C:\Users\Public\Desktop\WinRAR.lnk

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-01-25 19:28 - 2015-01-25 19:28 - 00000000 ____D () C:\Program Files\WinRAR

2015-01-25 19:28 - 2014-09-05 09:15 - 00003914 _____ () C:\Users\paul\Downloads\chrome.manifest

2015-01-25 19:28 - 2014-09-05 09:15 - 00001956 _____ () C:\Users\paul\Downloads\install.rdf

2015-01-25 19:28 - 2014-09-05 09:15 - 00000000 ____D () C:\Users\paul\Downloads\defaults

2015-01-25 19:27 - 2015-01-25 19:27 - 02060888 _____ () C:\Users\paul\Downloads\winrar-x64-520d.exe

2015-01-25 19:26 - 2015-01-25 19:26 - 00772184 _____ () C:\Users\paul\Downloads\video_downloadhelper-4.9.24-sm_fx.zip

2015-01-24 15:17 - 2015-01-24 15:17 - 00000000 ____D () C:\Users\paul\Documents\nbgi

2015-01-24 14:34 - 2015-01-24 14:34 - 00000222 _____ () C:\Users\paul\Desktop\Dark Souls Prepare to Die Edition.url

2015-01-22 10:37 - 2015-02-05 16:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-22 10:37 - 2015-02-04 22:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-18 02:02 - 2015-01-18 02:02 - 40177100 _____ (Aslain ) C:\Users\paul\Downloads\Aslains_XVM_Mod_Installer_v.4.1.26_95.exe

2015-01-15 01:02 - 2015-01-15 01:02 - 00302688 _____ () C:\Windows\Minidump\011515-40326-01.dmp

2015-01-14 12:42 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 12:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 12:42 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 12:42 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-01-14 12:42 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-01-14 12:42 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-01-14 12:42 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-14 12:42 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-01-14 12:42 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-01-14 12:42 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 12:42 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-14 12:42 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2015-01-14 12:42 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2015-01-13 20:29 - 2015-01-13 20:29 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Wargaming.net

2015-01-11 19:09 - 2015-01-11 19:09 - 00000769 _____ () C:\Users\paul\Desktop\World of Tanks.lnk

2015-01-11 19:09 - 2015-01-11 19:09 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Tanks

2015-01-07 12:05 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-01-07 12:05 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-01-06 20:26 - 2015-01-06 20:26 - 00000000 ____D () C:\Users\paul\AppData\Roaming\OpenOffice
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-05 15:49 - 2012-07-18 16:47 - 01346631 _____ () C:\Windows\WindowsUpdate.log

2015-02-05 14:42 - 2014-11-27 10:52 - 00000000 ____D () C:\Program Files (x86)\Steam

2015-02-05 12:41 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-05 12:41 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-05 12:34 - 2014-12-22 12:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2015-02-05 12:33 - 2014-11-29 09:27 - 00110290 _____ () C:\Windows\PFRO.log

2015-02-05 12:33 - 2012-07-18 17:39 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-02-05 12:33 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-05 12:33 - 2009-07-14 05:51 - 00037447 _____ () C:\Windows\setupact.log

2015-02-04 23:41 - 2012-07-19 15:07 - 1297523543 _____ () C:\Windows\MEMORY.DMP

2015-02-04 23:41 - 2012-07-19 15:07 - 00000000 ____D () C:\Windows\Minidump

2015-02-04 22:50 - 2012-07-18 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-04 22:50 - 2012-07-18 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-04 22:27 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2015-02-04 13:16 - 2014-11-27 11:58 - 00075288 _____ () C:\Windows\DirectX.log

2015-02-03 19:30 - 2012-07-18 17:14 - 00000000 ____D () C:\Users\paul

2015-01-31 13:49 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-01-29 09:45 - 2012-07-18 17:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\ProgramData\Adobe

2015-01-28 20:54 - 2014-11-27 11:00 - 00000000 ____D () C:\Program Files (x86)\Adobe

2015-01-28 20:46 - 2014-11-27 10:59 - 00000000 ____D () C:\Users\paul\AppData\Local\Adobe

2015-01-28 20:46 - 2012-07-18 17:36 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Adobe

2015-01-27 16:37 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-01-27 16:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared

2015-01-27 13:25 - 2012-07-18 17:37 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Skype

2015-01-24 14:34 - 2014-11-27 11:04 - 00000000 ____D () C:\Users\paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-01-18 12:52 - 2012-07-18 18:09 - 00065832 _____ () C:\Users\paul\AppData\Local\GDIPFONTCACHEV1.DAT

2015-01-18 12:43 - 2009-07-14 05:45 - 00301632 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-01-17 15:46 - 2012-07-18 18:08 - 00000000 ____D () C:\ProgramData\Apple Computer

2015-01-11 19:09 - 2012-05-08 19:50 - 00000000 ____D () C:\Games

2015-01-11 13:21 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

2015-01-06 20:37 - 2012-07-18 17:37 - 00000000 ____D () C:\Windows.old

2015-01-06 04:36 - 2012-07-18 17:26 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
 

Some content of TEMP:

====================

C:\Users\paul\AppData\Local\Temp\Quarantine.exe

C:\Users\paul\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-04 23:59
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Edit: Meinte natürlich dieses Log hier, da hatte er was gefunden ...

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=f4482bec19d3ba43aae6e029aa49c416

# engine=22323

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-02-05 03:52:42

# local_time=2015-02-05 04:52:42 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Kaspersky Anti-Virus'

# compatibility_mode=1300 16777213 100 100 15517 50723192 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 184884 174781412 0 0

# scanned=318643

# found=1

# cleaned=0

# scan_time=4117

sh=7BA0A01D63E1511F6101A736D157C4D1F885EDEB ft=1 fh=1aba12d0f1f8efc7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\paul\Downloads\PDFCreator-2_0_0-setup.exe"

Schau doch mal genau hin was gefunden wurde bei ESET ;)

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\paul\Downloads\PDFCreator-2_0_0-setup.exe

Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Malware ist jetzt komplett runter. Kaspersky bitte komplett deinstallieren und neu installieren.

http://www.deeprybka.trojaner-board....r/wraioneu.PNG

Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

http://deeprybka.trojaner-board.de/b...srepair271.png

So, das fixlog wäre hier:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-02-2015 01

Ran by paul at 2015-02-06 14:11:21 Run:1

Running from C:\Users\paul\Desktop

Loaded Profiles: paul & UpdatusUser (Available profiles: paul & UpdatusUser)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

C:\Users\paul\Downloads\PDFCreator-2_0_0-setup.exe

Emptytemp:

         

*****************
 

C:\Users\paul\Downloads\PDFCreator-2_0_0-setup.exe => Moved successfully.

EmptyTemp: => Removed 483.1 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 14:11:26 ====

Kaspersky habe ich neu installiert, allerdings sieht Windows Repair bei mir ein bisschen anders aus. Den Repair-Prozess unter 4 und 5 könnte ich zwar starten, allerdings fragt er vorher nicht danach, ein Back-up zu erstellen. Es erscheint stattdessen eine Meldung, dass das letzte erstellte Back-up fehlerhaft wäre -> "The last scheduled Back-up had errors or failed."

Hast Du das mit den Haken gemacht?

So wie ich das verstanden habe soll man ja eigentlich nur auf Defaults klicken oder? Hab ich so gemacht, allerdings kommt die Fehlermeldung auch wenn ich nichts mache. Auf dem zweiten Screenshot sollte man es sehen.

Habe das ganze heute nochmal anch Anleitung wiederholt und diesmal keine Fehlermeldung beim Back up bekommen, allerdings ist Windows Repair beim Repariervorgang nach ca 10 Minuten abgestürzt. Soweit ich es erkennen konnte gab es ein Problem bei der Behandlung von Windows Updater. Der Pc an sich ist allerdings nicht abgestürzt. Vielleicht lag es daran, dass ich nicht alle aktuellen Updates heruntergeladen habe?