IE & Firefox öffnen eigenständig Seiten http://serve.bannersdontwork.com etc.

schrauber · 09.06.2013, 13:06

Noch nicht, wir versuchen noch was

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Scan.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

pulloverscha · 09.06.2013, 13:22

Hier die Logs:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-06-2013
Ran by Eddy (administrator) on 09-06-2013 14:16:46
Running from C:\Users\Eddy\Desktop
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(DATA BECKER GmbH & Co KG) C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files\ORICOHWRaidManager\XSrvSetup.exe
(pdfforge GbR) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files\PDF Architect\ConversionService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor Corp.) C:\Windows\SOUNDMAN.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
(Silicon Integrated Systems Corporation) C:\Windows\System32\sistray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent [x]
HKLM\...\Run: [SoundMan] SOUNDMAN.EXE [x]
HKLM\...\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-05-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)
HKCU\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [BitTorrent] "C:\Program Files\BitTorrent\BitTorrent.exe"  /MINIMIZED [882520 2013-05-12] (BitTorrent Inc.)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
Startup: C:\ProgramData\Start Menu\Programs\Startup\Utility Tray.lnk
ShortcutTarget: Utility Tray.lnk -> C:\Windows\System32\sistray.exe (Silicon Integrated Systems Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9 01 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 02 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 03 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 04 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 05 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 06 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 07 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 08 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 09 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 10 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 11 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 12 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 13 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 14 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 15 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 16 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 17 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 18 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 19 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 20 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 21 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 22 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 23 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 24 mswsock.dll [20992] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\3aybu4hd.default
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\3aybu4hd.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86752 2013-03-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110816 2013-03-30] (Avira Operations GmbH & Co. KG)
R2 DBService; C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 ORICOHWRaidManager; C:\Program Files\ORICOHWRaidManager\XSrvSetup.exe [69632 2011-05-12] ()
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
S2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC.SYS [4172832 2009-06-18] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-30] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 SiS315; C:\Windows\System32\DRIVERS\sisgrp.sys [321536 2007-08-03] (Silicon Integrated Systems Corporation)
R1 SiSkp; C:\Windows\System32\DRIVERS\srvkp.sys [18688 2007-08-03] (Silicon Integrated Systems Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-24] (Avira GmbH)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-09 14:16 - 2013-06-09 14:16 - 00000000 ____D C:\FRST
2013-06-09 14:15 - 2013-06-09 14:15 - 01358673 ____A (Farbar) C:\Users\Eddy\Desktop\FRST.exe
2013-06-09 14:13 - 2013-06-09 14:14 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-09 14:13 - 2013-06-09 14:14 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-09 14:13 - 2013-06-09 14:14 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-09 14:07 - 2013-06-09 14:07 - 00903072 ____A (Oracle Corporation) C:\Users\Eddy\Desktop\jxpiinstall.exe
2013-06-09 14:06 - 2013-06-09 14:06 - 07872648 ____A (Adobe Systems Inc.) C:\Users\Eddy\Desktop\Shockwave_Installer_Slim.exe
2013-06-09 13:07 - 2013-06-09 13:07 - 00648201 ____A C:\Users\Eddy\Desktop\adwcleaner.exe
2013-06-09 13:02 - 2013-06-09 13:02 - 00000000 ____D C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2013-06-08 19:18 - 2013-06-08 19:18 - 00001109 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-08 19:18 - 2013-06-08 19:18 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Mozilla
2013-06-08 19:18 - 2013-06-08 19:18 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-08 19:17 - 2013-06-08 19:17 - 00001753 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-08 19:16 - 2013-06-08 19:17 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-08 19:16 - 2013-06-08 19:17 - 00000000 ____D C:\Program Files\iTunes
2013-06-08 19:16 - 2013-06-08 19:16 - 00000000 ____D C:\Program Files\iPod
2013-06-08 18:58 - 2013-06-08 21:18 - 00002038 ____A C:\Windows\PFRO.log
2013-06-08 14:50 - 2013-06-08 14:50 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-06-08 14:49 - 2013-06-08 19:34 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-06-08 11:05 - 2013-06-08 11:05 - 00890839 ____A C:\Users\Eddy\Desktop\SecurityCheck.exe
2013-06-07 06:33 - 2013-06-07 06:33 - 00179968 ____A (Kaspersky Lab) C:\Users\Eddy\Downloads\kss12.0.1.117mlg_en_ru_fr_de.exe
2013-06-06 17:32 - 2013-06-06 17:32 - 00000000 ____D C:\_OTL
2013-06-06 17:23 - 2013-06-06 17:23 - 00000000 ____D C:\Windows\ERUNT
2013-06-06 17:22 - 2013-06-09 10:41 - 00000000 ____D C:\JRT
2013-06-06 17:21 - 2013-06-06 17:21 - 00139264 ____A C:\Users\Eddy\Downloads\SystemLook.exe
2013-06-06 17:21 - 2013-06-06 17:21 - 00139264 ____A C:\Users\Eddy\Desktop\SystemLook.exe
2013-06-06 17:20 - 2013-06-06 17:20 - 02347384 ____A (ESET) C:\Users\Eddy\Downloads\esetsmartinstaller_enu.exe
2013-06-06 17:20 - 2013-06-06 17:20 - 02347384 ____A (ESET) C:\Users\Eddy\Desktop\esetsmartinstaller_enu.exe
2013-06-06 17:17 - 2013-06-06 17:17 - 00602112 ____A (OldTimer Tools) C:\Users\Eddy\Downloads\OTL.exe
2013-06-06 17:17 - 2013-06-06 17:17 - 00602112 ____A (OldTimer Tools) C:\Users\Eddy\Desktop\OTL.exe
2013-06-06 17:16 - 2013-06-06 17:16 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Eddy\Downloads\JRT.exe
2013-06-06 17:16 - 2013-06-06 17:16 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Eddy\Desktop\JRT.exe
2013-06-05 19:11 - 2013-06-05 19:11 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\InfraRecorder
2013-06-04 16:48 - 2013-06-09 12:59 - 00001952 ____A C:\Windows\WindowsUpdate.log
2013-06-04 16:31 - 2013-06-09 13:14 - 00002658 ____A C:\Windows\setupact.log
2013-06-04 16:31 - 2013-06-04 16:31 - 00000000 ____A C:\Windows\setuperr.log
2013-06-04 16:29 - 2013-06-04 16:29 - 00000000 _RASH C:\MSDOS.SYS
2013-06-04 16:29 - 2013-06-04 16:29 - 00000000 _RASH C:\IO.SYS
2013-06-02 20:05 - 2013-06-02 20:05 - 00001071 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Malwarebytes
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-02 20:05 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-05-30 17:00 - 2013-05-30 17:00 - 00000000 ____D C:\Program Files\x264 Video Codec
2013-05-19 16:04 - 2013-05-19 16:11 - 00000933 ____A C:\Windows\System32\Drivers\etc\hosts.umbrella
2013-05-19 16:03 - 2013-05-19 16:11 - 00000000 ____D C:\Users\Eddy\Desktop\iphone4
2013-05-18 12:47 - 2013-06-09 13:38 - 00000000 ____D C:\Users\Eddy\Downloads\TomTom Europa v1.14
2013-05-17 20:18 - 2013-06-08 19:18 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-17 16:57 - 2012-08-21 13:01 - 00026840 ____A (GEAR Software Inc.) C:\Windows\System32\Drivers\GEARAspiWDM.sys
2013-05-13 07:07 - 2013-06-09 13:07 - 00000000 ____D C:\Users\Eddy\Downloads\Bud Spencer & Terence Hill

==================== One Month Modified Files and Folders ========

2013-06-09 14:16 - 2013-06-09 14:16 - 00000000 ____D C:\FRST
2013-06-09 14:15 - 2013-06-09 14:15 - 01358673 ____A (Farbar) C:\Users\Eddy\Desktop\FRST.exe
2013-06-09 14:14 - 2013-06-09 14:13 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-09 14:14 - 2013-06-09 14:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-09 14:14 - 2013-06-09 14:13 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-09 14:07 - 2013-06-09 14:07 - 00903072 ____A (Oracle Corporation) C:\Users\Eddy\Desktop\jxpiinstall.exe
2013-06-09 14:06 - 2013-06-09 14:06 - 07872648 ____A (Adobe Systems Inc.) C:\Users\Eddy\Desktop\Shockwave_Installer_Slim.exe
2013-06-09 14:02 - 2012-08-08 16:17 - 00000000 ____D C:\users\Eddy
2013-06-09 13:51 - 2009-07-14 06:34 - 00018000 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-09 13:51 - 2009-07-14 06:34 - 00018000 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-09 13:48 - 2013-03-26 18:38 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-09 13:38 - 2013-05-18 12:47 - 00000000 ____D C:\Users\Eddy\Downloads\TomTom Europa v1.14
2013-06-09 13:37 - 2013-02-27 18:20 - 00337408 __ASH C:\Users\Eddy\Downloads\Thumbs.db
2013-06-09 13:15 - 2012-12-28 19:24 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\BitTorrent
2013-06-09 13:14 - 2013-06-04 16:31 - 00002658 ____A C:\Windows\setupact.log
2013-06-09 13:14 - 2013-03-26 18:38 - 00001090 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-09 13:14 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-09 13:07 - 2013-06-09 13:07 - 00648201 ____A C:\Users\Eddy\Desktop\adwcleaner.exe
2013-06-09 13:07 - 2013-05-13 07:07 - 00000000 ____D C:\Users\Eddy\Downloads\Bud Spencer & Terence Hill
2013-06-09 13:02 - 2013-06-09 13:02 - 00000000 ____D C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2013-06-09 12:59 - 2013-06-04 16:48 - 00001952 ____A C:\Windows\WindowsUpdate.log
2013-06-09 12:57 - 2013-03-26 18:37 - 00000000 ____D C:\Program Files\Google
2013-06-09 12:30 - 2012-08-08 16:17 - 01620910 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-09 10:41 - 2013-06-06 17:22 - 00000000 ____D C:\JRT
2013-06-08 21:18 - 2013-06-08 18:58 - 00002038 ____A C:\Windows\PFRO.log
2013-06-08 19:34 - 2013-06-08 14:49 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-06-08 19:18 - 2013-06-08 19:18 - 00001109 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-08 19:18 - 2013-06-08 19:18 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Mozilla
2013-06-08 19:18 - 2013-06-08 19:18 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-08 19:18 - 2013-05-17 20:18 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-06-08 19:17 - 2013-06-08 19:17 - 00001753 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-08 19:17 - 2013-06-08 19:16 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-08 19:17 - 2013-06-08 19:16 - 00000000 ____D C:\Program Files\iTunes
2013-06-08 19:16 - 2013-06-08 19:16 - 00000000 ____D C:\Program Files\iPod
2013-06-08 19:16 - 2013-02-08 22:19 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-08 14:59 - 2012-08-08 18:15 - 00000000 ____D C:\Users\Eddy\Desktop\Homepage Tools
2013-06-08 14:50 - 2013-06-08 14:50 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-06-08 14:43 - 2012-08-09 09:41 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\ProtectDisc
2013-06-08 11:05 - 2013-06-08 11:05 - 00890839 ____A C:\Users\Eddy\Desktop\SecurityCheck.exe
2013-06-07 06:33 - 2013-06-07 06:33 - 00179968 ____A (Kaspersky Lab) C:\Users\Eddy\Downloads\kss12.0.1.117mlg_en_ru_fr_de.exe
2013-06-06 17:32 - 2013-06-06 17:32 - 00000000 ____D C:\_OTL
2013-06-06 17:23 - 2013-06-06 17:23 - 00000000 ____D C:\Windows\ERUNT
2013-06-06 17:21 - 2013-06-06 17:21 - 00139264 ____A C:\Users\Eddy\Downloads\SystemLook.exe
2013-06-06 17:21 - 2013-06-06 17:21 - 00139264 ____A C:\Users\Eddy\Desktop\SystemLook.exe
2013-06-06 17:20 - 2013-06-06 17:20 - 02347384 ____A (ESET) C:\Users\Eddy\Downloads\esetsmartinstaller_enu.exe
2013-06-06 17:20 - 2013-06-06 17:20 - 02347384 ____A (ESET) C:\Users\Eddy\Desktop\esetsmartinstaller_enu.exe
2013-06-06 17:17 - 2013-06-06 17:17 - 00602112 ____A (OldTimer Tools) C:\Users\Eddy\Downloads\OTL.exe
2013-06-06 17:17 - 2013-06-06 17:17 - 00602112 ____A (OldTimer Tools) C:\Users\Eddy\Desktop\OTL.exe
2013-06-06 17:16 - 2013-06-06 17:16 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Eddy\Downloads\JRT.exe
2013-06-06 17:16 - 2013-06-06 17:16 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Eddy\Desktop\JRT.exe
2013-06-05 19:11 - 2013-06-05 19:11 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\InfraRecorder
2013-06-04 16:31 - 2013-06-04 16:31 - 00000000 ____A C:\Windows\setuperr.log
2013-06-04 16:29 - 2013-06-04 16:29 - 00000000 _RASH C:\MSDOS.SYS
2013-06-04 16:29 - 2013-06-04 16:29 - 00000000 _RASH C:\IO.SYS
2013-06-04 06:58 - 2012-08-08 19:07 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-03 06:51 - 2012-12-05 07:53 - 00000000 ____D C:\Users\Eddy\Desktop\Neuer Ordner (4)
2013-06-03 06:48 - 2009-07-14 10:56 - 00000000 ____D C:\Windows\ShellNew
2013-06-03 06:47 - 2012-12-02 21:06 - 00000000 ____D C:\Users\Eddy\AppData\Local\SENukeX
2013-06-03 06:47 - 2012-11-18 19:15 - 00000000 ____D C:\Users\Eddy\Desktop\E-Mail
2013-06-02 20:05 - 2013-06-02 20:05 - 00001071 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Malwarebytes
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-02 19:58 - 2012-08-08 19:21 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\FileZilla
2013-06-02 13:34 - 2012-08-09 09:40 - 00000000 ____D C:\Program Files\Common Files\DATA BECKER Shared
2013-06-02 13:17 - 2013-03-23 18:06 - 00000000 ____D C:\Users\Eddy\AppData\Local\Google
2013-06-02 13:04 - 2013-04-20 13:05 - 00000000 ____D C:\Windows\System64
2013-06-02 13:04 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-06-02 13:03 - 2013-03-30 21:06 - 00000000 ____D C:\Program Files\Pin Blaster
2013-06-02 13:03 - 2012-10-17 17:13 - 00000000 ____D C:\Program Files\SEO PowerSuite
2013-06-02 13:01 - 2012-10-21 21:56 - 00000000 ____D C:\Windows\System32\appmgmt
2013-06-02 13:01 - 2012-10-21 21:25 - 00000000 ____D C:\Program Files\BacklinkProfitMonster
2013-05-30 17:00 - 2013-05-30 17:00 - 00000000 ____D C:\Program Files\x264 Video Codec
2013-05-23 10:49 - 2012-12-28 19:24 - 00000000 ____D C:\Program Files\BitTorrent
2013-05-19 16:11 - 2013-05-19 16:04 - 00000933 ____A C:\Windows\System32\Drivers\etc\hosts.umbrella
2013-05-19 16:11 - 2013-05-19 16:03 - 00000000 ____D C:\Users\Eddy\Desktop\iphone4
2013-05-18 12:19 - 2013-04-12 05:16 - 00000000 ____D C:\Program Files\Mozilla Firefox.bak
2013-05-15 17:45 - 2012-08-08 19:04 - 00000969 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-05-15 17:45 - 2012-08-08 19:04 - 00000000 ____D C:\Program Files\CCleaner
2013-05-12 21:15 - 2012-08-08 19:22 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\TweetAdder3
2013-05-11 18:52 - 2012-08-08 19:01 - 00000000 ____D C:\ProgramData\Adobe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender


LastRegBack: 2013-06-03 00:26

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 08-06-2013
Ran by Eddy at 2013-06-09 14:17:11 Run:
Running from C:\Users\Eddy\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe Flash Player 11 ActiveX (Version: 11.7.700.202)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Avira Free Antivirus (Version: 13.0.0.3640)
Backlink Cloner (Version: 1.0.0.53)
BitTorrent (Version: 7.7.2.28499)
Blog Blaster
Brother MFL-Pro Suite MFC-7420 (Version: 1.0.1.0)
CCleaner (Version: 4.01)
DATA BECKER Rechnungsdruckerei 2012
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Feed Blaster
FileZilla Client 3.6.0.2 (Version: 3.6.0.2)
Google Update Helper (Version: 1.3.21.145)
HDClone 4.1 Free Edition
iCloud (Version: 2.1.1.3)
IMAPSize 0.3.7
iNSTANT BOOSTER
IrfanView (remove only) (Version: 4.32)
iTunes (Version: 11.0.4.4)
Kobo (Version: 3.1.5)
MacroSoft Email Spider Full (Version: 1.0.0.0)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Mega Robot Bomber (Version: 1.0.41)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 21.0 (x86 de) (Version: 21.0)
Mozilla Maintenance Service (Version: 21.0)
No Hands SEO
Notepad++ (Version: 6.1.6)
ORICO HW RAID Manager (Version: 0.09.43)
PDF Architect (Version: 1.0.41.8362)
PDFCreator (Version: 1.6.0)
Realtek AC'97 Audio
SiS VGA Utilities
SiSAGP driver (Version: 1.22)
Spybot - Search & Destroy (Version: 1.6.2)
swMSM (Version: 12.0.0.1)
TuneUp Utilities Language Pack (en-US) (Version: 13.0.2013.194)
Tweet Adder 3 (Version: 3.0.51)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2687277) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
Update or Uninstall SENukeX (Version: 3.0.0.13)
Video Marketing Blaster (Version: 1.25)
Wiki Bomber (Version: 1.0.7.17)
WinRAR 4.20 (32-Bit) (Version: 4.20.0)

==================== Restore Points  =========================

04-06-2013 14:53:50 Wiederherstellungsvorgang
08-06-2013 12:33:44 Removed Apple Application Support
08-06-2013 12:49:39 Installed SpyHunter
08-06-2013 17:33:11 Removed SpyHunter
08-06-2013 17:34:57 Installed SpyHunter
09-06-2013 10:44:13 Wiederherstellungsvorgang
09-06-2013 11:01:04 Removed SpyHunter
09-06-2013 12:09:10 Removed Microsoft Silverlight
09-06-2013 12:10:06 Removed Java 7 Update 21
09-06-2013 12:11:15 Removed Bonjour

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/09/2013 02:08:11 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 21.0.0.4879, Zeitstempel: 0x518ec3cc
Name des fehlerhaften Moduls: xul.dll, Version: 21.0.0.4879, Zeitstempel: 0x518ec306
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001c9789
ID des fehlerhaften Prozesses: 0xaf8
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3

Error: (06/09/2013 00:58:22 PM) (Source: System Restore) (User: )
Description: Der ausgewählte Wiederherstellungspunkt wurde während der Wiederherstellung beschädigt oder gelöscht (Windows-Sicherung).

Error: (06/09/2013 00:38:07 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/09/2013 00:36:12 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/09/2013 00:00:10 AM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (06/08/2013 09:19:23 PM) (Source: System Restore) (User: )
Description: Der ausgewählte Wiederherstellungspunkt wurde während der Wiederherstellung beschädigt oder gelöscht (Removed Apple Application Support).

Error: (06/08/2013 07:12:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/08/2013 07:12:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/08/2013 07:12:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/08/2013 07:12:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (06/09/2013 01:15:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (06/09/2013 01:15:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (06/09/2013 01:14:45 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1060

Error: (06/09/2013 01:14:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SBSD Security Center Service" ist von folgendem Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert.

Error: (06/09/2013 01:14:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (06/09/2013 01:14:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (06/09/2013 00:58:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (06/09/2013 00:58:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (06/09/2013 00:57:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1060

Error: (06/09/2013 00:57:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SBSD Security Center Service" ist von folgendem Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert.


Microsoft Office Sessions:
=========================
Error: (06/09/2013 02:08:11 PM) (Source: Application Error)(User: )
Description: firefox.exe21.0.0.4879518ec3ccxul.dll21.0.0.4879518ec306c0000005001c9789af801ce650453db7bc1C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll406897e2-d0fd-11e2-b5e0-00301b42b4cf

Error: (06/09/2013 00:58:22 PM) (Source: System Restore)(User: )
Description: Windows-Sicherung

Error: (06/09/2013 00:38:07 AM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*c:\program files\spybot - search & destroy\DelZip179.dllc:\program files\spybot - search & destroy\DelZip179.dll8

Error: (06/09/2013 00:36:12 AM) (Source: SideBySide)(User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Kobo\drivers\dpinst64.exe

Error: (06/09/2013 00:00:10 AM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (06/08/2013 09:19:23 PM) (Source: System Restore)(User: )
Description: Removed Apple Application Support

Error: (06/08/2013 07:12:56 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files\Common Files\Apple\Internet Services\ShellStreams.dll

Error: (06/08/2013 07:12:56 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files\Common Files\Apple\Internet Services\ShellStreams.dll

Error: (06/08/2013 07:12:56 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files\Common Files\Apple\Internet Services\ShellStreams.dll

Error: (06/08/2013 07:12:56 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files\Common Files\Apple\Internet Services\ShellStreams.dll


==================== Memory info =========================== 

Percentage of memory in use: 72%
Total physical RAM: 1983.55 MB
Available physical RAM: 537.58 MB
Total Pagefile: 3967.11 MB
Available Pagefile: 2424.68 MB
Total Virtual: 2047.88 MB
Available Virtual: 1885.21 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:103.66 GB) NTFS
Drive e: (Reparaturdatenträger Windows 7 3) (CDROM) (Total:0.14 GB) (Free:0 GB) UDF
Drive f: (Volume) (Fixed) (Total:1863.01 GB) (Free:1479.06 GB) NTFS
Drive g: (Volume) (Fixed) (Total:1863.01 GB) (Free:1862.86 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: EAB9EAB9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 45181EE6)
Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 444C544E)
Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 09.06.2013, 15:12

Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM\...\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent [x]
HKLM\...\Run: [SoundMan] SOUNDMAN.EXE [x]
HKCU\...\Run: [BitTorrent] "C:\Program Files\BitTorrent\BitTorrent.exe"  /MINIMIZED [882520 2013-05-12] (BitTorrent Inc.)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
FF Extension: No Name - C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\3aybu4hd.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
2013-06-09 13:02 - 2013-06-09 13:02 - 00000000 ____D C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Und ein frisches FRST Log bitte.

pulloverscha · 09.06.2013, 16:16

Istschon fertig hier der Fixlog und ein neues FRst log

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 08-06-2013
Ran by Eddy at 2013-06-09 17:03:44 Run:1
Running from C:\Users\Eddy\Desktop
Boot Mode: Normal

==============================================

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SiSPower => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SoundMan => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\BitTorrent => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableRegistryTools => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableTaskMgr => Value deleted successfully.
Winsock: Catalog5 entry 000000000001\\LibraryPath  was set successfully to %SystemRoot%\system32\NLAapi.dll
Winsock: Catalog5 entry 000000000005\\LibraryPath  was set successfully to %SystemRoot%\System32\mswsock.dll
C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\3aybu4hd.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi => Moved successfully.
C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP => Moved successfully.
"C:\Program Files\Windows Defender" => Deleting reparse point and unlocking started.
"C:\Program Files\Windows Defender\de-DE" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MpAsDesc.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MpClient.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MpCmdRun.exe" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MpCommu.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MpEvMsg.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MpOAV.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MpRTP.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MpSvc.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MSASCui.exe" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MsMpCom.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MsMpLics.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender\MsMpRes.dll" => Deleting reparse point and unlocking completed.
"C:\Program Files\Windows Defender" => Deleting reparse point and unlocking completed.

==== End of Fixlog ====

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-06-2013
Ran by Eddy (administrator) on 09-06-2013 17:10:36
Running from C:\Users\Eddy\Desktop
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(DATA BECKER GmbH & Co KG) C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files\ORICOHWRaidManager\XSrvSetup.exe
(pdfforge GbR) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files\PDF Architect\ConversionService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor Corp.) C:\Windows\SOUNDMAN.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
(Silicon Integrated Systems Corporation) C:\Windows\System32\sistray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-05-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)
HKCU\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Utility Tray.lnk
ShortcutTarget: Utility Tray.lnk -> C:\Windows\System32\sistray.exe (Silicon Integrated Systems Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
Winsock: Catalog5 05 %SystemRoot%\System32\mswsock.dll [232448] ()
Winsock: Catalog9 01 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 02 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 03 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 04 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 05 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 06 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 07 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 08 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 09 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 10 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 11 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 12 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 13 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 14 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 15 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 16 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 17 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 18 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 19 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 20 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 21 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 22 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 23 mswsock.dll [20992] (Microsoft Corporation)
Winsock: Catalog9 24 mswsock.dll [20992] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Eddy\AppData\Roaming\Mozilla\Firefox\Profiles\3aybu4hd.default
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86752 2013-03-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110816 2013-03-30] (Avira Operations GmbH & Co. KG)
R2 DBService; C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 ORICOHWRaidManager; C:\Program Files\ORICOHWRaidManager\XSrvSetup.exe [69632 2011-05-12] ()
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
S2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC.SYS [4172832 2009-06-18] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-30] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 SiS315; C:\Windows\System32\DRIVERS\sisgrp.sys [321536 2007-08-03] (Silicon Integrated Systems Corporation)
R1 SiSkp; C:\Windows\System32\DRIVERS\srvkp.sys [18688 2007-08-03] (Silicon Integrated Systems Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-24] (Avira GmbH)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-09 14:39 - 2013-06-09 14:39 - 00001151 ____A C:\Users\Eddy\Desktop\Outlook Backup Assistant.lnk
2013-06-09 14:39 - 2013-06-09 14:39 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Priotecs
2013-06-09 14:39 - 2013-06-09 14:39 - 00000000 ____D C:\Program Files\Outlook Backup Assistant
2013-06-09 14:38 - 2013-06-09 14:38 - 02800249 ____A C:\Users\Eddy\Desktop\Outlook Backup Assistant 7.1.0.zip
2013-06-09 14:17 - 2013-06-09 14:17 - 00015924 ____A C:\Users\Eddy\Desktop\Addition.txt
2013-06-09 14:16 - 2013-06-09 17:03 - 00000000 ____D C:\FRST
2013-06-09 14:15 - 2013-06-09 14:15 - 01358673 ____A (Farbar) C:\Users\Eddy\Desktop\FRST.exe
2013-06-09 14:13 - 2013-06-09 16:30 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-09 14:13 - 2013-06-09 14:14 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-09 14:13 - 2013-06-09 14:14 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-09 13:07 - 2013-06-09 13:07 - 00648201 ____A C:\Users\Eddy\Desktop\adwcleaner.exe
2013-06-08 19:18 - 2013-06-08 19:18 - 00001109 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-08 19:18 - 2013-06-08 19:18 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Mozilla
2013-06-08 19:18 - 2013-06-08 19:18 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-08 19:17 - 2013-06-08 19:17 - 00001753 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-08 19:16 - 2013-06-08 19:17 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-08 19:16 - 2013-06-08 19:17 - 00000000 ____D C:\Program Files\iTunes
2013-06-08 19:16 - 2013-06-08 19:16 - 00000000 ____D C:\Program Files\iPod
2013-06-08 18:58 - 2013-06-08 21:18 - 00002038 ____A C:\Windows\PFRO.log
2013-06-08 14:50 - 2013-06-08 14:50 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-06-08 14:49 - 2013-06-08 19:34 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-06-08 11:05 - 2013-06-08 11:05 - 00890839 ____A C:\Users\Eddy\Desktop\SecurityCheck.exe
2013-06-07 06:33 - 2013-06-07 06:33 - 00179968 ____A (Kaspersky Lab) C:\Users\Eddy\Downloads\kss12.0.1.117mlg_en_ru_fr_de.exe
2013-06-06 17:32 - 2013-06-06 17:32 - 00000000 ____D C:\_OTL
2013-06-06 17:23 - 2013-06-06 17:23 - 00000000 ____D C:\Windows\ERUNT
2013-06-06 17:22 - 2013-06-09 10:41 - 00000000 ____D C:\JRT
2013-06-06 17:21 - 2013-06-06 17:21 - 00139264 ____A C:\Users\Eddy\Downloads\SystemLook.exe
2013-06-06 17:21 - 2013-06-06 17:21 - 00139264 ____A C:\Users\Eddy\Desktop\SystemLook.exe
2013-06-06 17:20 - 2013-06-06 17:20 - 02347384 ____A (ESET) C:\Users\Eddy\Downloads\esetsmartinstaller_enu.exe
2013-06-06 17:20 - 2013-06-06 17:20 - 02347384 ____A (ESET) C:\Users\Eddy\Desktop\esetsmartinstaller_enu.exe
2013-06-06 17:17 - 2013-06-06 17:17 - 00602112 ____A (OldTimer Tools) C:\Users\Eddy\Downloads\OTL.exe
2013-06-06 17:17 - 2013-06-06 17:17 - 00602112 ____A (OldTimer Tools) C:\Users\Eddy\Desktop\OTL.exe
2013-06-06 17:16 - 2013-06-06 17:16 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Eddy\Downloads\JRT.exe
2013-06-06 17:16 - 2013-06-06 17:16 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Eddy\Desktop\JRT.exe
2013-06-05 19:11 - 2013-06-05 19:11 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\InfraRecorder
2013-06-04 16:48 - 2013-06-09 12:59 - 00001952 ____A C:\Windows\WindowsUpdate.log
2013-06-04 16:31 - 2013-06-09 13:14 - 00002658 ____A C:\Windows\setupact.log
2013-06-04 16:31 - 2013-06-04 16:31 - 00000000 ____A C:\Windows\setuperr.log
2013-06-04 16:29 - 2013-06-04 16:29 - 00000000 _RASH C:\MSDOS.SYS
2013-06-04 16:29 - 2013-06-04 16:29 - 00000000 _RASH C:\IO.SYS
2013-06-02 20:05 - 2013-06-02 20:05 - 00001071 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Malwarebytes
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-02 20:05 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-05-30 17:00 - 2013-05-30 17:00 - 00000000 ____D C:\Program Files\x264 Video Codec
2013-05-19 16:04 - 2013-05-19 16:11 - 00000933 ____A C:\Windows\System32\Drivers\etc\hosts.umbrella
2013-05-19 16:03 - 2013-05-19 16:11 - 00000000 ____D C:\Users\Eddy\Desktop\iphone4
2013-05-18 12:47 - 2013-06-09 13:38 - 00000000 ____D C:\Users\Eddy\Downloads\TomTom Europa v1.14
2013-05-17 20:18 - 2013-06-08 19:18 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-17 16:57 - 2012-08-21 13:01 - 00026840 ____A (GEAR Software Inc.) C:\Windows\System32\Drivers\GEARAspiWDM.sys
2013-05-13 07:07 - 2013-06-09 13:07 - 00000000 ____D C:\Users\Eddy\Downloads\Bud Spencer & Terence Hill

==================== One Month Modified Files and Folders ========

2013-06-09 17:03 - 2013-06-09 14:16 - 00000000 ____D C:\FRST
2013-06-09 16:48 - 2013-03-26 18:38 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-09 16:30 - 2013-06-09 14:13 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-09 14:47 - 2013-02-21 07:28 - 00000000 ____D C:\Users\Eddy\Desktop\Sicherung Domains
2013-06-09 14:40 - 2012-11-17 17:58 - 00000000 ____D C:\Users\Eddy\Desktop\Outlook Mails sichern
2013-06-09 14:39 - 2013-06-09 14:39 - 00001151 ____A C:\Users\Eddy\Desktop\Outlook Backup Assistant.lnk
2013-06-09 14:39 - 2013-06-09 14:39 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Priotecs
2013-06-09 14:39 - 2013-06-09 14:39 - 00000000 ____D C:\Program Files\Outlook Backup Assistant
2013-06-09 14:38 - 2013-06-09 14:38 - 02800249 ____A C:\Users\Eddy\Desktop\Outlook Backup Assistant 7.1.0.zip
2013-06-09 14:21 - 2009-07-14 06:34 - 00018000 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-09 14:21 - 2009-07-14 06:34 - 00018000 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-09 14:17 - 2013-06-09 14:17 - 00015924 ____A C:\Users\Eddy\Desktop\Addition.txt
2013-06-09 14:15 - 2013-06-09 14:15 - 01358673 ____A (Farbar) C:\Users\Eddy\Desktop\FRST.exe
2013-06-09 14:14 - 2013-06-09 14:13 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-09 14:14 - 2013-06-09 14:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-09 14:02 - 2012-08-08 16:17 - 00000000 ____D C:\users\Eddy
2013-06-09 13:38 - 2013-05-18 12:47 - 00000000 ____D C:\Users\Eddy\Downloads\TomTom Europa v1.14
2013-06-09 13:37 - 2013-02-27 18:20 - 00337408 __ASH C:\Users\Eddy\Downloads\Thumbs.db
2013-06-09 13:15 - 2012-12-28 19:24 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\BitTorrent
2013-06-09 13:14 - 2013-06-04 16:31 - 00002658 ____A C:\Windows\setupact.log
2013-06-09 13:14 - 2013-03-26 18:38 - 00001090 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-09 13:14 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-09 13:07 - 2013-06-09 13:07 - 00648201 ____A C:\Users\Eddy\Desktop\adwcleaner.exe
2013-06-09 13:07 - 2013-05-13 07:07 - 00000000 ____D C:\Users\Eddy\Downloads\Bud Spencer & Terence Hill
2013-06-09 12:59 - 2013-06-04 16:48 - 00001952 ____A C:\Windows\WindowsUpdate.log
2013-06-09 12:57 - 2013-03-26 18:37 - 00000000 ____D C:\Program Files\Google
2013-06-09 12:30 - 2012-08-08 16:17 - 01620910 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-09 10:41 - 2013-06-06 17:22 - 00000000 ____D C:\JRT
2013-06-08 21:18 - 2013-06-08 18:58 - 00002038 ____A C:\Windows\PFRO.log
2013-06-08 19:34 - 2013-06-08 14:49 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-06-08 19:18 - 2013-06-08 19:18 - 00001109 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-08 19:18 - 2013-06-08 19:18 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Mozilla
2013-06-08 19:18 - 2013-06-08 19:18 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-08 19:18 - 2013-05-17 20:18 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-06-08 19:17 - 2013-06-08 19:17 - 00001753 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-08 19:17 - 2013-06-08 19:16 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-08 19:17 - 2013-06-08 19:16 - 00000000 ____D C:\Program Files\iTunes
2013-06-08 19:16 - 2013-06-08 19:16 - 00000000 ____D C:\Program Files\iPod
2013-06-08 19:16 - 2013-02-08 22:19 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-08 14:59 - 2012-08-08 18:15 - 00000000 ____D C:\Users\Eddy\Desktop\Homepage Tools
2013-06-08 14:50 - 2013-06-08 14:50 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-06-08 14:43 - 2012-08-09 09:41 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\ProtectDisc
2013-06-08 11:05 - 2013-06-08 11:05 - 00890839 ____A C:\Users\Eddy\Desktop\SecurityCheck.exe
2013-06-07 06:33 - 2013-06-07 06:33 - 00179968 ____A (Kaspersky Lab) C:\Users\Eddy\Downloads\kss12.0.1.117mlg_en_ru_fr_de.exe
2013-06-06 17:32 - 2013-06-06 17:32 - 00000000 ____D C:\_OTL
2013-06-06 17:23 - 2013-06-06 17:23 - 00000000 ____D C:\Windows\ERUNT
2013-06-06 17:21 - 2013-06-06 17:21 - 00139264 ____A C:\Users\Eddy\Downloads\SystemLook.exe
2013-06-06 17:21 - 2013-06-06 17:21 - 00139264 ____A C:\Users\Eddy\Desktop\SystemLook.exe
2013-06-06 17:20 - 2013-06-06 17:20 - 02347384 ____A (ESET) C:\Users\Eddy\Downloads\esetsmartinstaller_enu.exe
2013-06-06 17:20 - 2013-06-06 17:20 - 02347384 ____A (ESET) C:\Users\Eddy\Desktop\esetsmartinstaller_enu.exe
2013-06-06 17:17 - 2013-06-06 17:17 - 00602112 ____A (OldTimer Tools) C:\Users\Eddy\Downloads\OTL.exe
2013-06-06 17:17 - 2013-06-06 17:17 - 00602112 ____A (OldTimer Tools) C:\Users\Eddy\Desktop\OTL.exe
2013-06-06 17:16 - 2013-06-06 17:16 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Eddy\Downloads\JRT.exe
2013-06-06 17:16 - 2013-06-06 17:16 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Eddy\Desktop\JRT.exe
2013-06-05 19:11 - 2013-06-05 19:11 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\InfraRecorder
2013-06-04 16:31 - 2013-06-04 16:31 - 00000000 ____A C:\Windows\setuperr.log
2013-06-04 16:29 - 2013-06-04 16:29 - 00000000 _RASH C:\MSDOS.SYS
2013-06-04 16:29 - 2013-06-04 16:29 - 00000000 _RASH C:\IO.SYS
2013-06-04 06:58 - 2012-08-08 19:07 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-03 06:51 - 2012-12-05 07:53 - 00000000 ____D C:\Users\Eddy\Desktop\Neuer Ordner (4)
2013-06-03 06:48 - 2009-07-14 10:56 - 00000000 ____D C:\Windows\ShellNew
2013-06-03 06:47 - 2012-12-02 21:06 - 00000000 ____D C:\Users\Eddy\AppData\Local\SENukeX
2013-06-03 06:47 - 2012-11-18 19:15 - 00000000 ____D C:\Users\Eddy\Desktop\E-Mail
2013-06-02 20:05 - 2013-06-02 20:05 - 00001071 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\Malwarebytes
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-02 20:05 - 2013-06-02 20:05 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-02 19:58 - 2012-08-08 19:21 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\FileZilla
2013-06-02 13:34 - 2012-08-09 09:40 - 00000000 ____D C:\Program Files\Common Files\DATA BECKER Shared
2013-06-02 13:17 - 2013-03-23 18:06 - 00000000 ____D C:\Users\Eddy\AppData\Local\Google
2013-06-02 13:04 - 2013-04-20 13:05 - 00000000 ____D C:\Windows\System64
2013-06-02 13:04 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-06-02 13:03 - 2013-03-30 21:06 - 00000000 ____D C:\Program Files\Pin Blaster
2013-06-02 13:03 - 2012-10-17 17:13 - 00000000 ____D C:\Program Files\SEO PowerSuite
2013-06-02 13:01 - 2012-10-21 21:56 - 00000000 ____D C:\Windows\System32\appmgmt
2013-06-02 13:01 - 2012-10-21 21:25 - 00000000 ____D C:\Program Files\BacklinkProfitMonster
2013-05-30 17:00 - 2013-05-30 17:00 - 00000000 ____D C:\Program Files\x264 Video Codec
2013-05-23 10:49 - 2012-12-28 19:24 - 00000000 ____D C:\Program Files\BitTorrent
2013-05-19 16:11 - 2013-05-19 16:04 - 00000933 ____A C:\Windows\System32\Drivers\etc\hosts.umbrella
2013-05-19 16:11 - 2013-05-19 16:03 - 00000000 ____D C:\Users\Eddy\Desktop\iphone4
2013-05-18 12:19 - 2013-04-12 05:16 - 00000000 ____D C:\Program Files\Mozilla Firefox.bak
2013-05-15 17:45 - 2012-08-08 19:04 - 00000969 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-05-15 17:45 - 2012-08-08 19:04 - 00000000 ____D C:\Program Files\CCleaner
2013-05-12 21:15 - 2012-08-08 19:22 - 00000000 ____D C:\Users\Eddy\AppData\Roaming\TweetAdder3
2013-05-11 18:52 - 2012-08-08 19:01 - 00000000 ____D C:\ProgramData\Adobe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-03 00:26

==================== End Of Log ============================

schrauber · 09.06.2013, 16:18

Windows-taste+R > schreibe

netsh winsock repair

und drücke Enter. Reboot. Was machen deine Probleme?

pulloverscha · 09.06.2013, 16:59

erledigt - Leider sind noch die besagten Probleme da "Ads Werbung links" und jetzt neu wenn ich über den link gehe steht dort "click to Conitinue < by text-Enhance"

schrauber · 09.06.2013, 18:15

Kannst mir davon nen Screenshot machen? Kommt das in beiden Browsern?

pulloverscha · 10.06.2013, 05:36

nach langen hin und her überlegen habe ich nun über Nacht den PC lieber neu gemacht.

Es tut mir leid ich danke Dir dennoch sehr

schrauber · 10.06.2013, 06:57

Alles klar.

09.06.2013, 16:18	#20
schrauber /// the machine /// TB-Ausbilder	IE & Firefox öffnen eigenständig Seiten http://serve.bannersdontwork.com etc. Windows-taste+R > schreibe netsh winsock repair und drücke Enter. Reboot. Was machen deine Probleme? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

09.06.2013, 18:15	#22
schrauber /// the machine /// TB-Ausbilder	IE & Firefox öffnen eigenständig Seiten http://serve.bannersdontwork.com etc. Kannst mir davon nen Screenshot machen? Kommt das in beiden Browsern? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

10.06.2013, 06:57	#24
schrauber /// the machine /// TB-Ausbilder	IE & Firefox öffnen eigenständig Seiten http://serve.bannersdontwork.com etc. Alles klar. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

IE & Firefox öffnen eigenständig Seiten http://serve.bannersdontwork.com etc.

Log-Analyse und Auswertung: IE & Firefox öffnen eigenständig Seiten http://serve.bannersdontwork.com etc.