Hallo

Ich hab mir Heute leider diesen GVU Virus ausversehen runtergeladen.
Mein Betriebssystem ist Windows 8.
Da ich leider keine Ahnung habe wollte ich schon los gehen und 100 Euro Paysafekarten kaufen,aber nach kurzer Recherche hat sich ergeben, dass es ein "berühmter?" Virus ist.
Seid dem die Anzeige da ist kann ich nichts mehr mit dem Pc machen. Ich wollte den Taskmanager auf machen aber, es hat nicht Funktioniert.
Ich habe zunächst hitman pro versucht, aber das Booten vom USB hat nicht geklappt und der PC zeigt an dass Windows nicht wiederhergestellt werden konnte. Ich habe danach aber auch gelesen, dass dieses Programm nicht mit Windows 8 kompatibel ist.
Ich hab sonst noch nichts gemacht und freu mich auf eine Antwort.

ich weiß nicht ob es hilft, aber ich habe noch ein Bild gemacht.


gruß anchos

hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

• Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit
• Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
• Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

• Starte den Rechner neu.
• Während dem Hochfahren drücke mehrmals die F8 Taste
• Wähle nun Computer reparieren.
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

• Lege die Windows CD in dein Laufwerk.
• Starte den Rechner neu und starte von der CD.
• Wähle die Spracheinstellungen und klicke "Weiter".
• Klicke auf Computerreparaturoptionen !
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

• Gib nun bitte notepad ein und drücke Enter.
• Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
  Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
• Schließe Notepad wieder
• Gib nun bitte folgenden Befehl ein.
  e:\frst.exe bzw. e:\frst64.exe
  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
• Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

hat ein bischen gedauert aber ich habs.


FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03
Ran by SYSTEM on 30-07-2013 12:49:16
Running from D:\
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKU\Anchos\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-10-30] ()
HKU\Anchos\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe [x]
HKU\Anchos\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1807272 2013-07-26] (Valve Corporation)
HKU\Anchos\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)
HKU\Anchos\...\Run: [Dargon] - C:\Dargon\DargonD.exe [x]
HKU\Anchos\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19603048 2013-06-03] (Skype Technologies S.A.)
HKU\Anchos\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Anchos\AppData\Local\Temp\vjoavddrqbuqgtyii.exe [74752 2013-07-30] () <===== ATTENTION
HKU\Anchos\...\Winlogon: [Shell] cmd.exe [404992 2012-07-26] (Microsoft Corporation) <==== ATTENTION 
HKU\Anchos\...\Command Processor: "C:\Users\Anchos\AppData\Local\Temp\vjoavddrqbuqgtyii.exe" <===== ATTENTION!
Startup: C:\Users\Anchos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [121344 2012-02-07] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-04-28] ()
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
S3 BrSerIf; C:\Windows\system32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
S1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2012-11-13] (DT Soft Ltd)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S1 frszqiil; \??\C:\Windows\system32\drivers\frszqiil.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-30 12:49 - 2013-07-30 12:49 - 00000000 ____D C:\FRST
2013-07-30 11:10 - 2013-07-30 11:10 - 00000000 _____ C:\Windows\setuperr.log
2013-07-30 11:10 - 2013-07-30 11:10 - 00000000 _____ C:\Windows\setupact.log
2013-07-30 09:16 - 2013-07-30 09:21 - 00018040 _____ C:\Windows\WindowsUpdate.log
2013-07-30 08:50 - 2013-07-30 08:50 - 00163068 _____ C:\Users\Anchos\AppData\Local\2433f433
2013-07-30 08:50 - 2013-07-30 08:50 - 00163042 _____ C:\Users\Anchos\AppData\Roaming\2433f433
2013-07-30 08:50 - 2013-07-30 08:50 - 00163009 _____ C:\ProgramData\2433f433
2013-07-21 20:32 - 2013-07-21 20:32 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-07-20 12:50 - 2013-07-20 12:50 - 00307904 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-17 13:52 - 2013-06-01 12:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-07-17 13:51 - 2013-06-16 23:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys
2013-07-17 13:51 - 2013-06-01 12:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\sdbus.sys
2013-07-17 13:51 - 2013-06-01 12:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dumpsd.sys
2013-07-17 13:51 - 2013-06-01 12:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-17 13:51 - 2013-06-01 12:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\USBXHCI.SYS
2013-07-17 13:51 - 2013-06-01 12:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\UCX01000.SYS
2013-07-17 13:51 - 2013-06-01 12:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-07-17 13:51 - 2013-06-01 12:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\volsnap.sys
2013-07-17 13:51 - 2013-06-01 11:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-17 13:51 - 2013-06-01 10:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-17 13:51 - 2013-06-01 10:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-17 13:51 - 2013-06-01 10:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-17 13:51 - 2013-06-01 10:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-17 13:51 - 2013-06-01 10:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-17 13:51 - 2013-06-01 10:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-17 13:51 - 2013-06-01 10:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\System32\vds.exe
2013-07-17 13:51 - 2013-06-01 10:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\System32\XpsGdiConverter.dll
2013-07-17 13:51 - 2013-06-01 10:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-07-17 13:51 - 2013-06-01 10:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\System32\vdsutil.dll
2013-07-17 13:51 - 2013-06-01 10:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\System32\MbaeParserTask.exe
2013-07-17 13:51 - 2013-06-01 10:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\System32\samsrv.dll
2013-07-17 13:51 - 2013-06-01 10:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\System32\samlib.dll
2013-07-17 13:51 - 2013-06-01 10:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\System32\dwmcore.dll
2013-07-17 13:51 - 2013-06-01 10:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\System32\mfcore.dll
2013-07-17 13:51 - 2013-06-01 10:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\System32\mfasfsrcsnk.dll
2013-07-17 13:51 - 2013-06-01 10:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\System32\mscms.dll
2013-07-17 13:51 - 2013-06-01 10:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\System32\audiosrv.dll
2013-07-17 13:51 - 2013-06-01 10:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\System32\DeviceSetupManager.dll
2013-07-17 13:51 - 2013-06-01 04:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\BthAvrcpTg.sys
2013-07-17 13:51 - 2013-05-24 23:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\System32\winload.efi
2013-07-17 13:51 - 2013-05-24 23:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\System32\winload.exe
2013-07-17 13:51 - 2013-05-24 23:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\System32\winresume.efi
2013-07-17 13:51 - 2013-05-24 23:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\System32\winresume.exe
2013-07-17 13:51 - 2013-05-20 01:08 - 00386642 _____ C:\Windows\System32\ApnDatabase.xml
2013-07-10 11:34 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 11:34 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 11:34 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 11:34 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 11:34 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 11:34 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 11:34 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 11:34 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 11:34 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-10 11:34 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-10 11:34 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-10 11:34 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-10 11:34 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-10 11:34 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-10 11:34 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-10 11:34 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-10 11:34 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-10 11:34 - 2013-06-01 10:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 11:34 - 2013-06-01 10:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-10 11:34 - 2013-05-31 00:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-10 11:34 - 2013-04-11 23:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 11:34 - 2013-04-11 23:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-10 11:32 - 2013-05-04 07:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-10 11:32 - 2013-05-04 05:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

==================== One Month Modified Files and Folders =======

2013-07-30 11:38 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-30 11:34 - 2012-07-26 11:27 - 00751892 _____ C:\Windows\System32\perfh007.dat
2013-07-30 11:34 - 2012-07-26 11:27 - 00155620 _____ C:\Windows\System32\perfc007.dat
2013-07-30 11:34 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-30 11:10 - 2013-07-30 11:10 - 00000000 _____ C:\Windows\setuperr.log
2013-07-30 11:10 - 2013-07-30 11:10 - 00000000 _____ C:\Windows\setupact.log
2013-07-30 11:08 - 2012-10-26 16:19 - 00000868 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-07-30 09:21 - 2013-07-30 09:16 - 00018040 _____ C:\Windows\WindowsUpdate.log
2013-07-30 09:21 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\System32\config\BBI
2013-07-30 09:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\System32\sru
2013-07-30 08:50 - 2013-07-30 08:50 - 00163068 _____ C:\Users\Anchos\AppData\Local\2433f433
2013-07-30 08:50 - 2013-07-30 08:50 - 00163042 _____ C:\Users\Anchos\AppData\Roaming\2433f433
2013-07-30 08:50 - 2013-07-30 08:50 - 00163009 _____ C:\ProgramData\2433f433
2013-07-30 08:40 - 2012-11-13 19:21 - 00000000 ____D C:\Program Files (x86)\Steam
2013-07-30 08:34 - 2012-10-30 18:42 - 00000000 ____D C:\Users\Anchos\AppData\Local\PMB Files
2013-07-29 23:46 - 2012-11-14 20:58 - 00000000 ____D C:\Users\Anchos\AppData\Roaming\Skype
2013-07-29 22:23 - 2012-10-30 18:42 - 00000000 ____D C:\ProgramData\PMB Files
2013-07-27 14:05 - 2012-10-26 16:19 - 00000870 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-07-27 06:48 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-07-22 17:20 - 2012-10-30 17:54 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3704050743-3055777684-322982769-1001
2013-07-21 20:32 - 2013-07-21 20:32 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-07-20 12:50 - 2013-07-20 12:50 - 00307904 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-15 14:38 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\System32\oobe
2013-07-11 16:59 - 2012-07-26 11:29 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 09:44 - 2012-11-14 20:58 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-07-11 09:44 - 2012-11-14 20:58 - 00000000 ____D C:\ProgramData\Skype
2013-07-10 11:58 - 2012-12-13 17:51 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-07-07 17:28 - 2012-07-26 09:12 - 00000000 __RHD C:\Users\Public\Libraries
2013-07-01 14:23 - 2012-12-28 20:38 - 00000000 ____D C:\Users\Anchos\Documents\StarCraft II

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3704050743-3055777684-322982769-1001\$a3d01b147d7878bced732bb7b3a6ce14

Files to move or delete:
====================
C:\Users\Anchos\AppData\Local\Temp\vjoavddrqbuqgtyii.exe
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\Users\Anchos\8632409.exe

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\de-DE => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

TDL4: custom:26000022 <===== ATTENTION!

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-07-14 22:17:56
Restore point made on: 2013-07-17 18:18:13
Restore point made on: 2013-07-27 10:49:56

==================== Memory info =========================== 

Percentage of memory in use: 10%
Total physical RAM: 8085.03 MB
Available physical RAM: 7266.94 MB
Total Pagefile: 8085.03 MB
Available Pagefile: 7282.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.42 GB) (Free:273.03 GB) NTFS (Disk=0 Partition=2)
Drive d: (USB STICK) (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.34 GB) (Free:0.11 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]
ATTENTION: Malware custom entry on BCD on drive y: detected.

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 7F658C67)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: A5A64F94)
Partition 1: (Active) - (Size=2 GB) - (Type=0B)


LastRegBack: 2013-07-22 17:20

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---


[/CODE]

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!
HKU\Anchos\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Anchos\AppData\Local\Temp\vjoavddrqbuqgtyii.exe [74752 2013-07-30] () <===== ATTENTION
HKU\Anchos\...\Winlogon: [Shell] cmd.exe [404992 2012-07-26] (Microsoft Corporation) <==== ATTENTION 
HKU\Anchos\...\Command Processor: "C:\Users\Anchos\AppData\Local\Temp\vjoavddrqbuqgtyii.exe" <===== ATTENTION!
2013-07-30 08:50 - 2013-07-30 08:50 - 00163068 _____ C:\Users\Anchos\AppData\Local\2433f433
2013-07-30 08:50 - 2013-07-30 08:50 - 00163042 _____ C:\Users\Anchos\AppData\Roaming\2433f433
2013-07-30 08:50 - 2013-07-30 08:50 - 00163009 _____ C:\ProgramData\2433f433
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3704050743-3055777684-322982769-1001\$a3d01b147d7878bced732bb7b3a6ce14
C:\Users\Anchos\AppData\Local\Temp\vjoavddrqbuqgtyii.exe
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\Users\Anchos\8632409.exe
DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
TDL4: custom:26000022 <===== ATTENTION!
         

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

• Starte deinen Rechner erneut in die Reparaturoptionen
• Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


neu booten

O.O Der Virus ist weg . WOW danke danke. Alles klappt wie vorher und die Daten sind auch alle noch da. Ich bedanke mich herzlich, auch für deine schnelle Antwort.

Hier der Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-07-2013 03
Ran by SYSTEM at 2013-07-31 00:20:32 Run:1
Running from E:\
Boot Mode: Recovery
==============================================

HKLM\Software\Classes\CLSID\{750fdf10-2a26-11d1-a3ea-080036587f03}\InprocServer32\\Default => Value was restored successfully.
HKU\Anchos\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.
HKU\Anchos\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\Anchos\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\Anchos\AppData\Local\2433f433 => Moved successfully.
C:\Users\Anchos\AppData\Roaming\2433f433 => Moved successfully.
C:\ProgramData\2433f433 => Moved successfully.
C:\$Recycle.Bin\S-1-5-21-3704050743-3055777684-322982769-1001\$a3d01b147d7878bced732bb7b3a6ce14 => Moved successfully.
C:\Users\Anchos\AppData\Local\Temp\vjoavddrqbuqgtyii.exe => Moved successfully.
C:\ProgramData\dsgsdgdsgdsgw.pad => Moved successfully.
C:\Users\Anchos\8632409.exe => Moved successfully.
Error: DeleteJunctionsIndirectory: C:\Program Files\Windows Defender => entry should be fixed outside recovery mode.

Der Vorgang wurde erfolgreich beendet.
Der Vorgang wurde erfolgreich beendet.

==== End of Fixlog ====
         

Dann jetzt Kontrollscans im normalen Modus:

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

sry i hatte deine antwort nicht weiter verfolgt. Hat jetzt 1monat gedauert aber ich habs.

erstes

# AdwCleaner v3.001 - Report created 30/08/2013 at 23:27:06
# Updated 24/08/2013 by Xplode
# Operating System : Windows 8  (64 bits)
# Username : Anchos - CHELLY
# Running from : C:\Users\Anchos\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Anchos\AppData\Roaming\OpenCandy

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\Software\Iminent

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Mozilla Firefox v

[ File : C:\Users\Anchos\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js ]


*************************

AdwCleaner[R0].txt - [2451 octets] - [30/08/2013 23:26:43]
AdwCleaner[S0].txt - [2310 octets] - [30/08/2013 23:27:06]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2370 octets] ##########
         

zweites

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.5 (08.28.2013:1)
OS: Windows 8 x64
Ran by Anchos on 30.08.2013 at 23:32:01,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.08.2013 at 23:34:15,50
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

und der frst.txt


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01
Ran by Anchos (administrator) on CHELLY on 30-08-2013 23:41:30
Running from E:\
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Roccat GmbH) C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-10-30] ()
HKCU\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe [x]
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)
HKCU\...\Run: [Dargon] - C:\Dargon\DargonD.exe [x]
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19603048 2013-06-03] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [RoccatKova+] - C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE [539688 2011-03-17] (Roccat GmbH)
Startup: C:\Users\Anchos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {784797A8-342D-4072-9486-03C8D0F2F0A1} hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.203.0.cab
DPF: HKLM-x32 {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.96.0.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

==================== Services (Whitelisted) =================

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [121344 2012-02-07] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-04-28] ()
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
S3 BrSerIf; C:\Windows\system32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2012-11-13] (DT Soft Ltd)
R3 KovaPlusFltr; C:\Windows\system32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S1 frszqiil; \??\C:\Windows\system32\drivers\frszqiil.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-30 23:32 - 2013-08-30 23:32 - 00000000 ____D C:\Windows\ERUNT
2013-08-30 23:31 - 2013-08-30 23:31 - 01023533 _____ (Thisisu) C:\Users\Anchos\Desktop\JRT.exe
2013-08-30 23:26 - 2013-08-30 23:27 - 00000000 ____D C:\AdwCleaner
2013-08-30 23:25 - 2013-08-30 23:25 - 00994642 _____ C:\Users\Anchos\Desktop\adwcleaner.exe
2013-08-30 10:44 - 2013-08-30 10:44 - 00002025 _____ C:\Users\Anchos\Desktop\Entfernen des Avira DE-Cleaners.lnk
2013-08-30 10:44 - 2013-08-30 10:44 - 00001954 _____ C:\Users\Anchos\Desktop\Avira DE-Cleaner.lnk
2013-08-29 18:37 - 2013-08-29 18:37 - 00000000 ____D C:\Program Files (x86)\ROCCAT
2013-08-23 13:30 - 2013-08-25 09:14 - 00000000 ____D C:\SC2Replay Archive
2013-08-18 00:12 - 2013-08-18 00:13 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 11:11 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 11:11 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 11:11 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-08-14 11:11 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-08-14 11:11 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 11:11 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 11:11 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 11:11 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 11:11 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 11:11 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 11:11 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 11:11 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 11:11 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 11:11 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-08-14 11:11 - 2013-07-09 08:07 - 02233168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 11:11 - 2013-07-02 03:21 - 00057504 _____ (Microsoft Corporation) C:\Windows\system32\config\MpAsDesc.dll.mui
2013-08-14 11:11 - 2013-07-02 03:21 - 00040608 _____ (Microsoft Corporation) C:\Windows\system32\config\MpEvMsg.dll.mui
2013-08-14 11:11 - 2013-07-02 02:44 - 00036288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2013-08-14 11:11 - 2013-07-02 00:08 - 00247216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2013-08-14 11:11 - 2013-07-02 00:08 - 00105120 _____ (Microsoft Corporation) C:\Windows\system32\config\MsMpRes.dll.mui
2013-08-14 11:11 - 2013-07-02 00:08 - 00008864 _____ (Microsoft Corporation) C:\Windows\system32\config\EppManifest.dll.mui
2013-08-14 11:11 - 2013-05-24 01:02 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 11:11 - 2013-05-24 00:25 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 11:07 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 11:07 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 11:07 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 11:07 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2013-08-14 11:07 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2013-08-14 11:07 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 11:07 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 11:07 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2013-08-14 11:07 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2013-08-03 09:16 - 2013-08-03 09:16 - 00000000 ____D C:\Users\Anchos\Documents\NFS SHIFT
2013-08-03 09:12 - 2013-08-03 09:12 - 00000000 ____D C:\Windows\SysWOW64\AGEIA
2013-08-03 09:12 - 2013-08-03 09:12 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2013-07-31 09:31 - 2013-07-31 09:31 - 00000295 _____ C:\Users\Anchos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Papierkorb.lnk

==================== One Month Modified Files and Folders =======

2013-08-30 23:34 - 2013-08-30 23:34 - 00000685 _____ C:\Users\Anchos\Desktop\JRT.txt
2013-08-30 23:32 - 2013-08-30 23:32 - 00000000 ____D C:\Windows\ERUNT
2013-08-30 23:31 - 2013-08-30 23:31 - 01023533 _____ (Thisisu) C:\Users\Anchos\Desktop\JRT.exe
2013-08-30 23:29 - 2012-10-26 17:19 - 00000868 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-08-30 23:28 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-30 23:27 - 2013-08-30 23:26 - 00000000 ____D C:\AdwCleaner
2013-08-30 23:27 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-08-30 23:25 - 2013-08-30 23:25 - 00994642 _____ C:\Users\Anchos\Desktop\adwcleaner.exe
2013-08-30 23:23 - 2012-07-26 12:27 - 00751892 _____ C:\Windows\system32\perfh007.dat
2013-08-30 23:23 - 2012-07-26 12:27 - 00155620 _____ C:\Windows\system32\perfc007.dat
2013-08-30 23:23 - 2012-07-26 09:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-30 23:20 - 2012-10-30 19:42 - 00000000 ____D C:\Users\Anchos\AppData\Local\PMB Files
2013-08-30 23:18 - 2012-11-14 21:58 - 00000000 ____D C:\Users\Anchos\AppData\Roaming\Skype
2013-08-30 23:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-30 15:05 - 2012-10-26 17:19 - 00000870 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-08-30 12:00 - 2012-10-30 18:54 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3704050743-3055777684-322982769-1001
2013-08-30 10:49 - 2012-11-13 20:21 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-30 10:44 - 2013-08-30 10:44 - 00002025 _____ C:\Users\Anchos\Desktop\Entfernen des Avira DE-Cleaners.lnk
2013-08-30 10:44 - 2013-08-30 10:44 - 00001954 _____ C:\Users\Anchos\Desktop\Avira DE-Cleaner.lnk
2013-08-30 10:43 - 2012-10-30 19:44 - 00000000 ____D C:\Users\Anchos\Desktop\Picture
2013-08-30 08:02 - 2012-10-30 19:42 - 00000000 ____D C:\ProgramData\PMB Files
2013-08-29 23:39 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-29 18:37 - 2013-08-29 18:37 - 00000000 ____D C:\Program Files (x86)\ROCCAT
2013-08-29 18:37 - 2012-10-26 17:16 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-27 19:57 - 2012-12-28 21:38 - 00000000 ____D C:\Users\Anchos\Documents\StarCraft II
2013-08-25 09:14 - 2013-08-23 13:30 - 00000000 ____D C:\SC2Replay Archive
2013-08-20 08:13 - 2012-12-28 21:38 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2013-08-20 00:23 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-18 14:06 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-18 14:05 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-18 00:13 - 2013-08-18 00:12 - 00000000 ____D C:\Windows\system32\MRT
2013-08-18 00:12 - 2012-12-13 18:51 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-03 09:23 - 2012-10-30 18:48 - 00000000 ____D C:\Users\Anchos\AppData\Local\VirtualStore
2013-08-03 09:16 - 2013-08-03 09:16 - 00000000 ____D C:\Users\Anchos\Documents\NFS SHIFT
2013-08-03 09:12 - 2013-08-03 09:12 - 00000000 ____D C:\Windows\SysWOW64\AGEIA
2013-08-03 09:12 - 2013-08-03 09:12 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2013-07-31 09:31 - 2013-07-31 09:31 - 00000295 _____ C:\Users\Anchos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Papierkorb.lnk
2013-07-31 01:20 - 2012-10-30 18:48 - 00000000 ____D C:\Users\Anchos

Files to move or delete:
====================
C:\Users\Anchos\AppData\Local\Temp\Quarantine.exe
C:\Users\Anchos\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
C:\Users\Anchos\AppData\Local\Temp\decleaner\avnetworkloader.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\avnetworkLoaderGUI.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\avwebloader.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\DE-Cleaner-Install.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\msvcr90.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\rcimage.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\rcNwLoad_de.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\scewxmlw.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\update.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aebb.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aecore.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aeemu.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aeexp.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aegen.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aehelp.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aeheur.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aeoffice.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aepack.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aerdl.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aesbx.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aescn.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aescript.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aevdf.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avevtlog.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avevtrc.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avipc.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\Avira-DE-Cleaner-starten.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avpref.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avreg.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avrep.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avscan.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avscan.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avscplr.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avwinll.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\ccavscanex.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\ccavscanexrc.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\ccwkrlib.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\cfglib.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\decleaner.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\extdlgfw.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\luke.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\mfc90u.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\msvcp90.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\msvcr90.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\rcimage.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\rctext.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\scewxmlw.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\sqlite3.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\unacev2.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\de-DE => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender


LastRegBack: 2013-08-20 14:11

==================== End Of Log ============================
         

--- --- ---

--- --- ---


und der Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-08-2013 01
Ran by Anchos at 2013-08-30 23:41:46
Running from E:\
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
AMD Accelerated Video Transcoding (Version: 12.5.100.20928)
AMD APP SDK Runtime (Version: 10.0.1016.4)
AMD Catalyst Install Manager (Version: 8.0.891.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.70405.2224)
Apple Application Support (x32 Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (x32 Version: 2.1.3.127)
ASRock App Charger v1.0.5
Bandisoft MPEG-1 Decoder (x32)
Bonjour (Version: 3.0.0.10)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2012.0928.1532.26058)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0928.1532.26058)
Catalyst Control Center InstallProxy (x32 Version: 2012.0928.1532.26058)
Catalyst Control Center Localization All (x32 Version: 2012.0928.1532.26058)
CCC Help Chinese Standard (x32 Version: 2012.0928.1531.26058)
CCC Help Chinese Traditional (x32 Version: 2012.0928.1531.26058)
CCC Help Czech (x32 Version: 2012.0928.1531.26058)
CCC Help Danish (x32 Version: 2012.0928.1531.26058)
CCC Help Dutch (x32 Version: 2012.0928.1531.26058)
CCC Help English (x32 Version: 2012.0928.1531.26058)
CCC Help Finnish (x32 Version: 2012.0928.1531.26058)
CCC Help French (x32 Version: 2012.0928.1531.26058)
CCC Help German (x32 Version: 2012.0928.1531.26058)
CCC Help Greek (x32 Version: 2012.0928.1531.26058)
CCC Help Hungarian (x32 Version: 2012.0928.1531.26058)
CCC Help Italian (x32 Version: 2012.0928.1531.26058)
CCC Help Japanese (x32 Version: 2012.0928.1531.26058)
CCC Help Korean (x32 Version: 2012.0928.1531.26058)
CCC Help Norwegian (x32 Version: 2012.0928.1531.26058)
CCC Help Polish (x32 Version: 2012.0928.1531.26058)
CCC Help Portuguese (x32 Version: 2012.0928.1531.26058)
CCC Help Russian (x32 Version: 2012.0928.1531.26058)
CCC Help Spanish (x32 Version: 2012.0928.1531.26058)
CCC Help Swedish (x32 Version: 2012.0928.1531.26058)
CCC Help Thai (x32 Version: 2012.0928.1531.26058)
CCC Help Turkish (x32 Version: 2012.0928.1531.26058)
ccc-utility64 (Version: 2012.0928.1532.26058)
CCleaner (Version: 4.00)
Craving Explorer Version 1.5.0 (x32 Version: 1.5.0.0)
DAEMON Tools Lite (x32 Version: 4.46.1.0327)
Dota 2 (x32)
Fraps (x32)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Manageability Engine Firmware Recovery Agent (x32 Version: 1.0.0.35342)
Intel(R) Management Engine Components (x32 Version: 8.0.2.1410)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2867)
Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032)
Intel® Trusted Connect Service Client (Version: 1.23.605.1)
iTunes (Version: 11.0.1.12)
Java 7 Update 9 (64-bit) (Version: 7.0.90)
Java 7 Update 9 (x32 Version: 7.0.90)
Java Auto Updater (x32 Version: 2.1.9.0)
League of Legends (x32 Version: 1.3)
LOLReplay (x32 Version: 0.8.2.1)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Nexon Game Manager (x32)
NVIDIA PhysX (x32 Version: 9.09.0720)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Pando Media Booster (x32 Version: 2.6.0.8)
PunkBuster Services (x32 Version: 0.990)
Realtek Ethernet Controller Driver (x32 Version: 7.48.823.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6482)
ROCCAT Kova[+] Mouse Driver (x32 Version: 1.10)
Skype Click to Call (x32 Version: 6.3.11079)
Skype™ 6.5 (x32 Version: 6.5.158)
StarCraft II (x32 Version: 2.0.11.26825)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (Version: 3.0.10)
The Elder Scrolls V: Skyrim (x32)
Update for Japanese Microsoft IME Postal Code Dictionary (x32 Version: 15.0.552)
Update for Japanese Microsoft IME Standard Dictionary (x32 Version: 15.0.913)
Update for Japanese Microsoft IME Standard Extended Dictionary (x32 Version: 15.0.913)
us Mod Manager (Version: 0.34.0)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)

==================== Restore Points  =========================

12-08-2013 10:52:37 Geplanter Prüfpunkt
17-08-2013 22:10:01 Windows Modules Installer
28-08-2013 08:26:09 Geplanter Prüfpunkt
30-08-2013 19:16:40 Avira DE-Cleaner - 30.08.2013 21:16

==================== Hosts content: ==========================

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {10D85952-E3F6-47A1-96CF-5E1C2D874EA6} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe [2012-07-26] (Microsoft Corporation)
Task: {13A2AC02-B682-48CC-9155-2E2673580117} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical
Task: {17644F17-DC4C-4AC8-9444-7AAA52EB5CDC} - System32\Tasks\Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => C:\Windows\System32\sysmain.dll [2013-05-04] (Microsoft Corporation)
Task: {1DB7C2F1-876C-4F24-AD17-8428211113F9} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents
Task: {1E1E158A-F40D-4FD8-9E8A-55EA9895B3E1} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start => C:\Windows\system32\sc.exe [2012-07-26] (Microsoft Corporation)
Task: {1F596418-3C88-40ED-87E7-D3D29F809ADE} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUSessionConnect
Task: {214B24F4-FEB4-4C59-AF1F-70136065199C} - System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance
Task: {23700E5C-0E77-499D-908A-415D5C6252F4} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => C:\Windows\System32\WSClient.dll [2012-09-20] (Microsoft Corporation)
Task: {2C6B9EA8-7F5A-4ABA-BF96-8D352D02A743} - System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh
Task: {2D31A374-AC55-4544-86BF-35D74CB29FB3} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {2E030FA7-3D7C-4E1D-8CFE-56ADB26FD402} - System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks
Task: {3054485A-F517-4E95-9977-4DD827B1E9B3} - System32\Tasks\Microsoft\Windows\WS\Badge Update
Task: {378401BA-A703-444A-A79C-3C47AD2DC5B6} - System32\Tasks\Microsoft\Windows\TaskScheduler\Maintenance Configurator
Task: {3AE164E7-30CD-40BC-9422-3EC7A5618965} - System32\Tasks\Microsoft\Windows\WS\WSTask
Task: {3C490ABD-D849-41AF-9AC4-87DD759B0996} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
Task: {4073C1B3-6E16-4AA8-B7F3-C6A6D35D5071} - System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance
Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - System32\Tasks\Microsoft\Windows\Live\Roaming\SynchronizeWithStorage
Task: {483A8F5C-5D26-44B5-B49E-AF6741D1BBEB} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\Windows\System32\MbaeParserTask.exe [2013-06-01] (Microsoft Corporation)
Task: {4B952129-9AE9-41A3-BE2B-8AD2E06F66B6} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon
Task: {53C791BD-1B76-45D3-AD31-64C7CEFC5BB5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd)
Task: {5755E746-D7ED-4C20-A472-66C11834CDE4} - System32\Tasks\Microsoft\Windows\TaskScheduler\Manual Maintenance
Task: {5C4EFB77-EFA6-45DF-A373-D795C0725BFF} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required
Task: {627441F3-8526-4B62-BF9A-1A3EA414E71A} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\Windows\system32\SpaceAgent.exe [2012-07-26] (Microsoft Corporation)
Task: {6E9DE125-5583-4031-B572-FEE48F25CFFF} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\Windows\System32\wpcmon.exe [2012-09-20] (Microsoft Corporation)
Task: {6FDDEA7C-6310-428D-AEB2-54FFC72811EF} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319
Task: {74096F94-B654-4DB0-96F5-3C3408B92FE3} - System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update
Task: {7D9A9A1C-499C-40A6-8F8A-5BCC4CC9A87C} - System32\Tasks\Microsoft\Windows\TaskScheduler\Regular Maintenance
Task: {845CB020-68B5-4C6B-9876-7BEC7B3E27AC} - System32\Tasks\Microsoft\Windows\TaskScheduler\Idle Maintenance
Task: {87354DAA-66DF-4B41-9346-15958D96E1D2} - System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode)
Task: {876DB7D6-5511-4943-B176-92EF6C924C6B} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {888288F7-1C6A-4878-9DC5-158BE5F220D5} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe [2012-08-15] (Microsoft Corporation)
Task: {921A1D4E-32FB-46D7-B6C0-6F467884074D} - System32\Tasks\Microsoft\Windows\WS\Sync Licenses
Task: {9479EF8E-11D4-41B3-9783-CC65070D592D} - System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime
Task: {94DCF254-64FB-4C4E-8E12-5F4055C10C2A} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64
Task: {981A018C-F499-41EF-987F-5B6B222C4519} - System32\Tasks\task1783923453 => C:\Windows\System32\cmd.exe [2012-07-26] (Microsoft Corporation)
Task: {989A7C6D-BE82-4C3C-AF96-6116039E336B} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic
Task: {A16E29B5-DE13-4C79-9425-96057605E5C9} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUScheduledInstall
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => C:\Windows\System32\WSClient.dll [2012-09-20] (Microsoft Corporation)
Task: {A800277E-E202-4492-AD38-3312641CBC04} - System32\Tasks\Microsoft\Windows\Live\Roaming\MaintenanceTask
Task: {A8CF5AA7-9A33-43D0-8D14-C0D2DA4AEF64} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\MpCmdRun.exe [2013-07-02] (Microsoft Corporation)
Task: {AB62FA47-2C99-44B1-A5D0-D4161423BE43} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefresh
Task: {AC6259DE-AC59-459E-849E-6ADFFD1ADE63} - System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask
Task: {AEB0B5BD-B9E5-458A-898A-E559BD9EB51B} - System32\Tasks\Microsoft\Windows\SettingSync\BackgroundUploadTask
Task: {AF549BD8-337C-4BF7-8681-36A182E30507} - System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan
Task: {BAEBC26C-A93E-4B65-BC2E-4B13E77719A9} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup
Task: {BC76AEF7-2CF0-4EB6-B65B-A8803E0B5E12} - System32\Tasks\Microsoft\Windows\AppID\SmartScreenSpecific
Task: {C1ACCD1E-4385-4FB2-B5E4-7F2A57A626A2} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan
Task: {C391A8D1-7229-4E06-A074-47DE6094FE89} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\MpCmdRun.exe [2013-07-02] (Microsoft Corporation)
Task: {C3C22889-18E2-4138-92F7-A5CCCFDD60D7} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\MpCmdRun.exe [2013-07-02] (Microsoft Corporation)
Task: {C463FD1E-31C7-4C20-AB65-08E514CA152D} - System32\Tasks\Microsoft\Windows\IME\SQM data sender
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => C:\Windows\System32\Windows.Storage.ApplicationData.dll [2012-07-26] (Microsoft Corporation)
Task: {CA7EE155-4EAF-45C6-BF5C-240D28AB4B48} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\MpCmdRun.exe [2013-07-02] (Microsoft Corporation)
Task: {CD1054FF-8005-4904-8B9C-436EAB1E2021} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork
Task: {D69FD0F9-F716-4081-AD82-8B9425C35698} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DBCF6E1B-CE0A-441E-B7A5-219C8BE50C65} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical
Task: {DECE5921-598D-454B-9A04-B2DE95EFC1B3} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery
Task: {E4DFE66F-E089-4CC3-A70F-957223D565F4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask
Task: {E8DAA09B-DF2A-4951-9134-6FA9587793F9} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\Windows\System32\drvinst.exe [2012-09-20] (Microsoft Corporation)
Task: {EBC5BCCA-61FD-4E62-BAFF-2EA42CD9EBB0} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUFirmwareInstall
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => C:\Windows\System32\Startupscan.dll [2012-07-26] (Microsoft Corporation)
Task: {ED0C1F69-C3A2-41EA-B8C3-3F0D83A1F6C0} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\BthSQM
Task: {F2AE3B7D-4925-4743-B934-32826B6B14A0} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3704050743-3055777684-322982769-1001
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

==================== Loaded Modules (whitelisted) =============

2012-10-31 18:57 - 2012-09-20 08:30 - 01743872 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\combase.dll
2012-11-17 23:45 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\SHCORE.dll
2012-07-26 01:55 - 2012-07-26 05:07 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\WINMMBASE.dll
2012-07-26 04:13 - 2012-07-26 05:06 - 01044992 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\OPENGL32.dll
2012-07-26 01:55 - 2012-07-26 05:07 - 00180224 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\WINMMBASE.dll
2012-07-26 04:21 - 2012-07-26 05:05 - 00164352 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\GLU32.dll
2012-07-26 01:45 - 2012-07-26 05:05 - 00542208 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\DDRAW.dll
2012-12-12 19:15 - 2012-11-08 06:20 - 00014336 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\DCIMAN32.dll
2012-11-17 23:45 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\SHCORE.DLL
2012-10-10 03:22 - 2012-10-10 03:22 - 00110592 _____ (Intel Corporation) C:\Windows\System32\hccutils.DLL
2012-10-10 03:22 - 2012-10-10 03:22 - 00063488 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.dll
2012-10-10 03:22 - 2012-10-10 03:22 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-10-10 03:22 - 2012-10-10 03:22 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrDEU.lrc
2012-11-17 23:45 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\System32\SHCORE.dll
2012-11-17 23:45 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\SHCORE.dll
2012-07-26 04:34 - 2012-07-26 04:34 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\oleaccrc.dll
2012-07-26 04:19 - 2012-07-26 05:06 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\pcacli.dll
2012-07-26 10:14 - 2013-06-28 00:05 - 00537464 _____ (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.dll
2012-07-26 04:09 - 2012-07-26 05:05 - 00196096 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\DINPUT8.dll
2012-10-31 18:57 - 2012-09-20 08:33 - 00699392 _____ (Microsoft Corporation) C:\Windows\System32\twinapi.dll
2013-06-14 23:09 - 2013-05-04 08:57 - 00389120 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\Bcp47Langs.dll
2013-06-14 23:09 - 2013-05-04 08:58 - 10116096 _____ (Microsoft Corporation) C:\Windows\System32\twinui.dll
2012-11-17 23:45 - 2012-10-11 07:46 - 01395712 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Immersive.dll
2012-07-26 01:33 - 2012-07-26 05:07 - 00069632 _____ (Microsoft Corporation) C:\Windows\System32\windows.immersiveshell.serviceprovider.dll
2012-11-17 23:45 - 2012-10-11 07:45 - 00093184 _____ (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TipBand.dll
2012-07-26 01:54 - 2012-07-26 05:05 - 00171008 _____ (Microsoft Corporation) C:\Windows\System32\IDStore.dll
2013-05-18 10:57 - 2013-04-09 06:51 - 00456704 _____ (Microsoft Corporation) C:\Windows\System32\wpncore.dll
2012-07-26 04:06 - 2012-07-26 05:07 - 00119296 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\sppc.dll
2012-07-25 22:22 - 2012-09-28 03:41 - 01120768 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SYSTEM32\aticfx64.dll
2012-07-25 22:23 - 2012-09-28 03:11 - 00129536 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SYSTEM32\atiuxp64.dll
2012-07-25 22:22 - 2012-09-28 03:22 - 07167488 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SYSTEM32\atidxx64.dll
2012-07-26 02:05 - 2012-07-26 05:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\dcomp.dll
2012-07-26 01:31 - 2012-07-26 05:08 - 00343552 _____ (Microsoft Corporation) C:\Windows\System32\wlidprov.dll
2012-07-26 01:24 - 2012-07-26 05:05 - 00186368 _____ (Microsoft Corporation) C:\Windows\System32\InputSwitch.dll
2012-07-26 02:04 - 2012-07-26 05:07 - 00046592 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\windows.globalization.fontgroups.dll
2012-07-26 01:22 - 2012-07-26 05:06 - 00601600 _____ (Microsoft Corporation) C:\Windows\System32\MrmCoreR.dll
2013-03-14 19:39 - 2013-02-02 10:23 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\Windows.Networking.Connectivity.dll
2012-10-31 18:57 - 2012-09-20 08:33 - 00866304 _____ (Microsoft Corporation) C:\Windows\System32\WinTypes.dll
2011-08-31 00:05 - 2011-08-31 00:05 - 00132968 _____ (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll
2012-07-26 03:37 - 2012-07-26 05:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\NcaApi.dll
2012-07-26 01:33 - 2012-07-26 05:06 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\NetworkStatus.dll
2012-07-26 01:54 - 2012-07-26 05:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\System32\BluetoothApis.dll
2012-07-26 03:06 - 2012-07-26 05:06 - 00454144 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2012-07-26 01:55 - 2012-07-26 05:07 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\windowscodecsext.dll
2013-08-14 11:07 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\apprepapi.dll
2012-07-26 04:19 - 2012-07-26 05:06 - 00023040 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\pcacli.dll
2012-07-26 02:59 - 2012-07-26 05:05 - 00465408 _____ (Microsoft Corporation) C:\Windows\System32\dlnashext.dll
2013-04-13 19:13 - 2013-03-02 04:45 - 00951808 _____ (Microsoft Corporation) C:\Windows\System32\Windows.Globalization.dll
2012-07-26 04:33 - 2012-07-26 04:33 - 00629760 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\UIRibbonRes.dll
2012-07-26 04:13 - 2012-07-26 05:05 - 00024064 _____ (Microsoft Corporation) C:\Windows\System32\drprov.dll
2012-07-26 02:04 - 2012-07-26 05:06 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\ntlanman.dll
2012-07-26 03:37 - 2012-07-26 05:05 - 00103424 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll
2012-07-26 04:22 - 2012-07-26 05:05 - 00025088 _____ (Microsoft Corporation) C:\Windows\System32\DAVHLPR.dll
2012-10-31 18:57 - 2012-09-20 08:33 - 01304064 _____ (Microsoft Corporation) C:\Windows\System32\Windows.Media.Streaming.dll
2013-04-13 19:13 - 2013-03-02 04:44 - 00049152 _____ (Microsoft Corporation) C:\Windows\System32\DevDispItemProvider.dll
2012-07-26 02:12 - 2012-07-26 06:55 - 01326784 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\webservices.dll
2012-11-17 23:45 - 2012-10-11 07:45 - 00590848 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\shcore.dll
2012-07-26 03:37 - 2012-07-26 05:05 - 00531456 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\IEUI.dll
2012-07-26 02:10 - 2012-07-26 05:05 - 00013824 _____ (Microsoft Corporation) C:\Windows\SYSTEM32\DPAPI.dll
2012-07-26 01:57 - 2012-07-26 05:07 - 00093184 _____ (Microsoft Corporation) C:\Windows\System32\vaultcli.dll
2012-07-26 02:21 - 2012-07-26 05:08 - 01059840 _____ (Microsoft Corporation) C:\Windows\System32\Wpc.dll
2012-10-31 18:57 - 2012-09-20 08:32 - 01019392 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.dll
2013-06-14 23:09 - 2013-05-04 08:57 - 00389120 _____ (Microsoft Corporation) C:\Windows\System32\Bcp47Langs.dll

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/30/2013 10:43:41 AM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (08/30/2013 10:43:23 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.2.9200.16628, Zeitstempel: 0x51a94434
Name des fehlerhaften Moduls: twinui.dll, Version: 6.2.9200.16604, Zeitstempel: 0x5184a60b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000a43e6
ID des fehlerhaften Prozesses: 0x9f0
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5

Error: (08/29/2013 11:42:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Agent.exe, Version: 1.7.2.2045, Zeitstempel: 0x51e5fff2
Name des fehlerhaften Moduls: dlnashext.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5010975d
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x6c9576d4
ID des fehlerhaften Prozesses: 0x6a0
Startzeit der fehlerhaften Anwendung: 0xAgent.exe0
Pfad der fehlerhaften Anwendung: Agent.exe1
Pfad des fehlerhaften Moduls: Agent.exe2
Berichtskennung: Agent.exe3
Vollständiger Name des fehlerhaften Pakets: Agent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Agent.exe5

Error: (08/29/2013 06:45:44 PM) (Source: Application Hang) (User: )
Description: Programm glcnd.exe, Version 6.2.8516.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 4138

Startzeit: 01cea4d728272960

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\Microsoft.Reader_6.2.8516.0_x64__8wekyb3d8bbwe\glcnd.exe

Berichts-ID: 6f8a94a9-10ca-11e3-bead-bc5ff44b035f

Vollständiger Name des fehlerhaften Pakets: Microsoft.Reader_6.2.8516.0_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Microsoft.Reader

Error: (08/29/2013 06:45:39 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: Chelly)
Description: Die App „Microsoft.Reader_8wekyb3d8bbwe!Microsoft.Reader“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (08/25/2013 06:19:20 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Agent.exe, Version: 1.7.2.2045, Zeitstempel: 0x51e5fff2
Name des fehlerhaften Moduls: dlnashext.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5010975d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x6562635b
ID des fehlerhaften Prozesses: 0x4574
Startzeit der fehlerhaften Anwendung: 0xAgent.exe0
Pfad der fehlerhaften Anwendung: Agent.exe1
Pfad des fehlerhaften Moduls: Agent.exe2
Berichtskennung: Agent.exe3
Vollständiger Name des fehlerhaften Pakets: Agent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Agent.exe5

Error: (08/25/2013 06:19:18 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Agent.exe, Version: 1.7.2.2045, Zeitstempel: 0x51e5fff2
Name des fehlerhaften Moduls: dlnashext.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5010975d
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x65639254
ID des fehlerhaften Prozesses: 0x4574
Startzeit der fehlerhaften Anwendung: 0xAgent.exe0
Pfad der fehlerhaften Anwendung: Agent.exe1
Pfad des fehlerhaften Moduls: Agent.exe2
Berichtskennung: Agent.exe3
Vollständiger Name des fehlerhaften Pakets: Agent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Agent.exe5

Error: (08/23/2013 03:32:38 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Agent.exe, Version: 1.7.2.2045, Zeitstempel: 0x51e5fff2
Name des fehlerhaften Moduls: combase.dll, Version: 6.2.9200.16420, Zeitstempel: 0x505a976e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00012b7c
ID des fehlerhaften Prozesses: 0x6e0
Startzeit der fehlerhaften Anwendung: 0xAgent.exe0
Pfad der fehlerhaften Anwendung: Agent.exe1
Pfad des fehlerhaften Moduls: Agent.exe2
Berichtskennung: Agent.exe3
Vollständiger Name des fehlerhaften Pakets: Agent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Agent.exe5

Error: (08/23/2013 03:32:36 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Agent.exe, Version: 1.7.2.2045, Zeitstempel: 0x51e5fff2
Name des fehlerhaften Moduls: wpdshext.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x50108d6a
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x69c576d4
ID des fehlerhaften Prozesses: 0x6e0
Startzeit der fehlerhaften Anwendung: 0xAgent.exe0
Pfad der fehlerhaften Anwendung: Agent.exe1
Pfad des fehlerhaften Moduls: Agent.exe2
Berichtskennung: Agent.exe3
Vollständiger Name des fehlerhaften Pakets: Agent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Agent.exe5

Error: (08/22/2013 07:51:01 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Agent.exe, Version: 1.7.2.2045, Zeitstempel: 0x51e5fff2
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00010001
ID des fehlerhaften Prozesses: 0x3e60
Startzeit der fehlerhaften Anwendung: 0xAgent.exe0
Pfad der fehlerhaften Anwendung: Agent.exe1
Pfad des fehlerhaften Moduls: Agent.exe2
Berichtskennung: Agent.exe3
Vollständiger Name des fehlerhaften Pakets: Agent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Agent.exe5


System errors:
=============
Error: (08/30/2013 11:38:25 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:38:25 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:38:24 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:38:09 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:38:09 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:37:51 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:37:27 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:37:27 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:37:26 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.

Error: (08/30/2013 11:37:24 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.


Microsoft Office Sessions:
=========================
Error: (08/30/2013 10:43:41 AM) (Source: MsiInstaller)(User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (08/30/2013 10:43:23 AM) (Source: Application Error)(User: )
Description: Explorer.EXE6.2.9200.1662851a94434twinui.dll6.2.9200.166045184a60bc000000500000000000a43e69f001cea55cf771bd71C:\Windows\Explorer.EXEC:\Windows\System32\twinui.dll3a10892b-1150-11e3-beae-bc5ff44b035f

Error: (08/29/2013 11:42:57 PM) (Source: Application Error)(User: )
Description: Agent.exe1.7.2.204551e5fff2dlnashext.dll_unloaded0.0.0.05010975dc00001a56c9576d46a001cea500b71dd863C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exedlnashext.dllf7479cf8-10f3-11e3-bead-bc5ff44b035f

Error: (08/29/2013 06:45:44 PM) (Source: Application Hang)(User: )
Description: glcnd.exe6.2.8516.0413801cea4d7282729604294967295C:\Program Files\WindowsApps\Microsoft.Reader_6.2.8516.0_x64__8wekyb3d8bbwe\glcnd.exe6f8a94a9-10ca-11e3-bead-bc5ff44b035fMicrosoft.Reader_6.2.8516.0_x64__8wekyb3d8bbweMicrosoft.Reader

Error: (08/29/2013 06:45:39 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: Chelly)
Description: Microsoft.Reader_8wekyb3d8bbwe!Microsoft.Reader

Error: (08/25/2013 06:19:20 PM) (Source: Application Error)(User: )
Description: Agent.exe1.7.2.204551e5fff2dlnashext.dll_unloaded0.0.0.05010975dc00000056562635b457401cea1adbd487dbaC:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exedlnashext.dll1863a222-0da2-11e3-bead-bc5ff44b035f

Error: (08/25/2013 06:19:18 PM) (Source: Application Error)(User: )
Description: Agent.exe1.7.2.204551e5fff2dlnashext.dll_unloaded0.0.0.05010975dc00001a565639254457401cea1adbd487dbaC:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exedlnashext.dll16ed4a97-0da2-11e3-bead-bc5ff44b035f

Error: (08/23/2013 03:32:38 PM) (Source: Application Error)(User: )
Description: Agent.exe1.7.2.204551e5fff2combase.dll6.2.9200.16420505a976ec000000500012b7c6e001cea00536f85989C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exeC:\Windows\SYSTEM32\combase.dll79d3e0bf-0bf8-11e3-bead-bc5ff44b035f

Error: (08/23/2013 03:32:36 PM) (Source: Application Error)(User: )
Description: Agent.exe1.7.2.204551e5fff2wpdshext.dll_unloaded0.0.0.050108d6ac00001a569c576d46e001cea00536f85989C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exewpdshext.dll78b5c1a2-0bf8-11e3-bead-bc5ff44b035f

Error: (08/22/2013 07:51:01 AM) (Source: Application Error)(User: )
Description: Agent.exe1.7.2.204551e5fff2unknown0.0.0.000000000c0000005000100013e6001ce9efb89bf0454C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exeunknownd2f73710-0aee-11e3-bead-bc5ff44b035f


==================== Memory info =========================== 

Percentage of memory in use: 16%
Total physical RAM: 8085.03 MB
Available physical RAM: 6770.21 MB
Total Pagefile: 9301.03 MB
Available Pagefile: 7838.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.42 GB) (Free:272.74 GB) NTFS
Drive e: (USB STICK) (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 7F658C67)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: A5A64F94)
Partition 1: (Active) - (Size=2 GB) - (Type=0B)

==================== End Of Log ============================
         

Ich bitte um Entschuldigung, dass ich nicht weiter gelesen habe. Ich hoffe du findest meine Antwort trotzdem noch.

vielen Dank.

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2013 04
Ran by Anchos (administrator) on CHELLY on 01-09-2013 01:02:11
Running from E:\
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Roccat GmbH) C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Blizzard Entertainment, Inc.) C:\Program Files (x86)\StarCraft II\Versions\Base26490\SC2.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.38\deploy\LolClient.exe
() C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.240\deploy\League of Legends.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-10-30] ()
HKCU\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe [x]
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)
HKCU\...\Run: [Dargon] - C:\Dargon\DargonD.exe [x]
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19603048 2013-06-03] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [RoccatKova+] - C:\Program Files (x86)\ROCCAT\Kova[+] Mouse\Kova[+]Monitor.EXE [539688 2011-03-17] (Roccat GmbH)
Startup: C:\Users\Anchos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {784797A8-342D-4072-9486-03C8D0F2F0A1} hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.203.0.cab
DPF: HKLM-x32 {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.96.0.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

==================== Services (Whitelisted) =================

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [121344 2012-02-07] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-04-28] ()
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
S3 BrSerIf; C:\Windows\system32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2012-11-13] (DT Soft Ltd)
R3 KovaPlusFltr; C:\Windows\system32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S1 frszqiil; \??\C:\Windows\system32\drivers\frszqiil.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-31 23:29 - 2013-08-31 23:29 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-31 23:28 - 2013-08-31 23:28 - 02347384 _____ (ESET) C:\Users\Anchos\Desktop\esetsmartinstaller_enu.exe
2013-08-31 10:03 - 2013-08-31 11:16 - 00064367 _____ C:\Windows\WindowsUpdate.log
2013-08-30 23:34 - 2013-08-30 23:34 - 00000685 _____ C:\Users\Anchos\Desktop\JRT.txt
2013-08-30 23:32 - 2013-08-30 23:32 - 00000000 ____D C:\Windows\ERUNT
2013-08-30 23:31 - 2013-08-30 23:31 - 01023533 _____ (Thisisu) C:\Users\Anchos\Desktop\JRT.exe
2013-08-30 23:26 - 2013-08-30 23:27 - 00000000 ____D C:\AdwCleaner
2013-08-30 23:25 - 2013-08-30 23:25 - 00994642 _____ C:\Users\Anchos\Desktop\adwcleaner.exe
2013-08-30 10:44 - 2013-08-30 10:44 - 00002025 _____ C:\Users\Anchos\Desktop\Entfernen des Avira DE-Cleaners.lnk
2013-08-30 10:44 - 2013-08-30 10:44 - 00001954 _____ C:\Users\Anchos\Desktop\Avira DE-Cleaner.lnk
2013-08-29 18:37 - 2013-08-29 18:37 - 00000000 ____D C:\Program Files (x86)\ROCCAT
2013-08-23 13:30 - 2013-08-25 09:14 - 00000000 ____D C:\SC2Replay Archive
2013-08-18 00:12 - 2013-08-18 00:13 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 11:11 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 11:11 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 11:11 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-08-14 11:11 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-08-14 11:11 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 11:11 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 11:11 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 11:11 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 11:11 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 11:11 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 11:11 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 11:11 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 11:11 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 11:11 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 11:11 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 11:11 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-08-14 11:11 - 2013-07-09 08:07 - 02233168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 11:11 - 2013-07-02 03:21 - 00057504 _____ (Microsoft Corporation) C:\Windows\system32\config\MpAsDesc.dll.mui
2013-08-14 11:11 - 2013-07-02 03:21 - 00040608 _____ (Microsoft Corporation) C:\Windows\system32\config\MpEvMsg.dll.mui
2013-08-14 11:11 - 2013-07-02 02:44 - 00036288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2013-08-14 11:11 - 2013-07-02 00:08 - 00247216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2013-08-14 11:11 - 2013-07-02 00:08 - 00105120 _____ (Microsoft Corporation) C:\Windows\system32\config\MsMpRes.dll.mui
2013-08-14 11:11 - 2013-07-02 00:08 - 00008864 _____ (Microsoft Corporation) C:\Windows\system32\config\EppManifest.dll.mui
2013-08-14 11:11 - 2013-05-24 01:02 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 11:11 - 2013-05-24 00:25 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 11:07 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 11:07 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 11:07 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 11:07 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2013-08-14 11:07 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2013-08-14 11:07 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 11:07 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 11:07 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2013-08-14 11:07 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2013-08-03 09:16 - 2013-08-03 09:16 - 00000000 ____D C:\Users\Anchos\Documents\NFS SHIFT
2013-08-03 09:12 - 2013-08-03 09:12 - 00000000 ____D C:\Windows\SysWOW64\AGEIA
2013-08-03 09:12 - 2013-08-03 09:12 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies

==================== One Month Modified Files and Folders =======

2013-09-01 01:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-09-01 00:59 - 2012-10-30 19:42 - 00000000 ____D C:\Users\Anchos\AppData\Local\PMB Files
2013-09-01 00:59 - 2012-10-30 19:42 - 00000000 ____D C:\ProgramData\PMB Files
2013-09-01 00:52 - 2012-11-14 21:58 - 00000000 ____D C:\Users\Anchos\AppData\Roaming\Skype
2013-08-31 23:30 - 2013-08-31 23:30 - 00891115 _____ C:\Users\Anchos\Desktop\SecurityCheck.exe
2013-08-31 23:29 - 2013-08-31 23:29 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-31 23:28 - 2013-08-31 23:28 - 02347384 _____ (ESET) C:\Users\Anchos\Desktop\esetsmartinstaller_enu.exe
2013-08-31 23:19 - 2012-10-26 17:19 - 00000868 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-08-31 15:05 - 2012-10-26 17:19 - 00000870 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-08-31 11:16 - 2013-08-31 10:03 - 00064367 _____ C:\Windows\WindowsUpdate.log
2013-08-31 10:03 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-30 23:34 - 2013-08-30 23:34 - 00000685 _____ C:\Users\Anchos\Desktop\JRT.txt
2013-08-30 23:32 - 2013-08-30 23:32 - 00000000 ____D C:\Windows\ERUNT
2013-08-30 23:31 - 2013-08-30 23:31 - 01023533 _____ (Thisisu) C:\Users\Anchos\Desktop\JRT.exe
2013-08-30 23:28 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-30 23:27 - 2013-08-30 23:26 - 00000000 ____D C:\AdwCleaner
2013-08-30 23:27 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-08-30 23:25 - 2013-08-30 23:25 - 00994642 _____ C:\Users\Anchos\Desktop\adwcleaner.exe
2013-08-30 23:23 - 2012-07-26 12:27 - 00751892 _____ C:\Windows\system32\perfh007.dat
2013-08-30 23:23 - 2012-07-26 12:27 - 00155620 _____ C:\Windows\system32\perfc007.dat
2013-08-30 23:23 - 2012-07-26 09:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-30 12:00 - 2012-10-30 18:54 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3704050743-3055777684-322982769-1001
2013-08-30 10:49 - 2012-11-13 20:21 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-30 10:44 - 2013-08-30 10:44 - 00002025 _____ C:\Users\Anchos\Desktop\Entfernen des Avira DE-Cleaners.lnk
2013-08-30 10:44 - 2013-08-30 10:44 - 00001954 _____ C:\Users\Anchos\Desktop\Avira DE-Cleaner.lnk
2013-08-30 10:43 - 2012-10-30 19:44 - 00000000 ____D C:\Users\Anchos\Desktop\Picture
2013-08-29 18:37 - 2013-08-29 18:37 - 00000000 ____D C:\Program Files (x86)\ROCCAT
2013-08-29 18:37 - 2012-10-26 17:16 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-27 19:57 - 2012-12-28 21:38 - 00000000 ____D C:\Users\Anchos\Documents\StarCraft II
2013-08-25 09:14 - 2013-08-23 13:30 - 00000000 ____D C:\SC2Replay Archive
2013-08-20 08:13 - 2012-12-28 21:38 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2013-08-20 00:23 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-18 14:06 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-18 14:05 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-18 00:13 - 2013-08-18 00:12 - 00000000 ____D C:\Windows\system32\MRT
2013-08-18 00:12 - 2012-12-13 18:51 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-03 09:23 - 2012-10-30 18:48 - 00000000 ____D C:\Users\Anchos\AppData\Local\VirtualStore
2013-08-03 09:16 - 2013-08-03 09:16 - 00000000 ____D C:\Users\Anchos\Documents\NFS SHIFT
2013-08-03 09:12 - 2013-08-03 09:12 - 00000000 ____D C:\Windows\SysWOW64\AGEIA
2013-08-03 09:12 - 2013-08-03 09:12 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies

Files to move or delete:
====================
C:\Users\Anchos\AppData\Local\Temp\Quarantine.exe
C:\Users\Anchos\AppData\Local\Temp\RarSFX0\SecurityCheck\Objlist.exe
C:\Users\Anchos\AppData\Local\Temp\RarSFX0\SecurityCheck\runprocesses.exe
C:\Users\Anchos\AppData\Local\Temp\RarSFX0\SecurityCheck\uninstalllist.exe
C:\Users\Anchos\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\cmdinfo.exe
C:\Users\Anchos\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\nircmdc.exe
C:\Users\Anchos\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\sed.exe
C:\Users\Anchos\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\swreg.exe
C:\Users\Anchos\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
C:\Users\Anchos\AppData\Local\Temp\decleaner\avnetworkloader.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\avnetworkLoaderGUI.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\avwebloader.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\DE-Cleaner-Install.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\msvcr90.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\rcimage.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\rcNwLoad_de.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\scewxmlw.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\update.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aebb.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aecore.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aeemu.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aeexp.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aegen.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aehelp.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aeheur.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aeoffice.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aepack.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aerdl.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aesbx.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aescn.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aescript.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\aevdf.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avevtlog.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avevtrc.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avipc.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\Avira-DE-Cleaner-starten.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avpref.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avreg.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avrep.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avscan.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avscan.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avscplr.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\avwinll.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\ccavscanex.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\ccavscanexrc.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\ccwkrlib.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\cfglib.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\decleaner.exe
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\extdlgfw.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\luke.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\mfc90u.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\msvcp90.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\msvcr90.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\rcimage.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\rctext.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\scewxmlw.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\sqlite3.dll
C:\Users\Anchos\AppData\Local\Temp\decleaner\decleaner\setup\unacev2.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\de-DE => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender


LastRegBack: 2013-08-31 10:50

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1304a59c03bbcb449bcd5b3d265c9e6a
# engine=14968
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-31 10:59:48
# local_time=2013-09-01 12:59:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT 
# compatibility_mode=5893 16776573 100 94 50994 5273463 0 0
# scanned=210164
# found=0
# cleaned=0
# scan_time=4973
         

 Results of screen317's Security Check version 0.99.72  
   x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 9  
 Java version out of Date! 
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe 
 Windows Defender MsMpEng.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

jo hab alles.

Java updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

S1 frszqiil; \??\C:\Windows\system32\drivers\frszqiil.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Downloade dir bitte Farbar Service Scanner

• Starte das Tool mit Doppelklick auf die FSS.exe
• Gehe sicher, dass folgende Optionen angehakt sind.
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender
  • Other Services
• Klicke auf Scan.
• Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-09-2013
Ran by Anchos at 2013-09-01 11:51:53 Run:2
Running from E:\
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
S1 frszqiil; \??\C:\Windows\system32\drivers\frszqiil.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
*****************

frszqiil => Service deleted successfully.
X6va011 => Service deleted successfully.

==== End of Fixlog ====
         

Farbar Service Scanner Version: 28-08-2013
Ran by Anchos (administrator) on 01-09-2013 at 11:53:35
Running from "C:\Users\Anchos\Desktop"
Microsoft Windows 8  (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is set to Demand. The default start type is Auto.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.


Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MsMpEng.exe => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****
         

fertig.

Downloade dir bitte Windows Repair (All In One) von hier.

• Installiere das Programm. Starte es, nachdem die Installation abgeschlossen wurde.
• Klicke auf Step 2 und drücke unter Check Disk auf Do It.
  
  
• Wenn der Vorgang abgeschlossen ist, klicke auf Step 3 und drücke unter System File Check auf Do It.
  
  
• Nachdem der Vorgang abgeschlossen ist, klicke auf Start Repairs, wähle den Advanced Mode und drücke Start.
  
  
• Gehe bitte sicher, dass die Kästchen wie unten zu sehen angehakt sind. Bitte hake zusätzlich noch Set Windows Services to Default Startup an.
• Hake Restart System when Finished an.
• Drücke Start.
  
  

ich konnte leider bei reset restry permission keinen haken setzten da, "Disabled in Windows 8 duo to App Store bug". Ich habs also ohne diesen gestartet. Hoffe es ist trotzdem alles ok.

jup.

frisches FSS log bitte.

Farbar Service Scanner Version: 28-08-2013
Ran by Anchos (administrator) on 01-09-2013 at 20:22:14
Running from "C:\Users\Anchos\Desktop"
Microsoft Windows 8  (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.


Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MsMpEng.exe => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****
         

hier.