Windows Vista 64 bit: IE, Skript dauert zu lange, delta-search

gonzales · 02.08.2013, 22:51

Hi,

meine Mutter hat heute versucht eine PDF-Datei zu ändern und hat dabei wohl ein Virus heruntergeladen. Sie sagt sie hätte ein Pdf Creater installiert. Avast Antivir findet nichts und beim "Browser Cleanen" wurde ein DPeal oder so deinstalliert, sorry hab da nicht so darauf geachtet, dachte erst es sei nicht so schlimm. Beim Abfragen der e-Mails über Freenet beleibt der Internet Explorer hängen.
Klickt man dann im Fenster herum kommt: Das Skript braucht zu lange und verhindert das abrufen der Seite. Will man es beenden hängt sich der Internet Explorer auf. Ich hab schon diverse Programme vom Rechner deinstalliert aber läuft immer noch nicht reibungslos, sprich die e-Mails sind immernoch nicht abrufbar.
QTrax (was auch immer das ist), hab ich schon deinstalliert.

Germ hat den Scan ausgeführt, aber beim versuch es zu speichern kommt nichts, ich kann euch daher keine Log Datei von Germ geben!

Anbei aber die anderen Logs:

defoger-disable.txt:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:08 on 02/08/2013 (Admin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-

FRST:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by Admin (administrator) on 02-08-2013 23:16:45
Running from E:\Internet
Windows Vista (TM) Ultimate Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Sonix) C:\Windows\vsnp2uvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [snp2uvc] - C:\Windows\vsnp2uvc.exe [662016 2009-06-22] (Sonix)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
MountPoints2: {66a1f43b-1ae3-11e2-aa51-00044b168d8f} - I:\setup.exe
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2011-05-19] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" [x]
HKU\UpdatusUser\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\UpdatusUser\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
AppInit_DLLs:       [0 ] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.freenet.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKCU - {C6CFC481-9BAC-4D9F-8951-EE29AC99A6C2} URL = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: LyricXeeker - {17E58097-6CA5-448B-830F-2A19678248FB} - C:\Program Files (x86)\LyriXeeker\125.dll (LyriXeeker Tech)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {3BFFE033-BF43-11D5-A271-00A024A51325} https://mail.gs.hfwu.de/iNotes6W.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
DPF: HKLM-x32 {6B75345B-AA36-438A-BBE6-4078B4C6984D} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: HKLM-x32 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ipp - No CLSID Value - 
Handler: msdaipp - No CLSID Value - 
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: ipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{7A29ADAD-F175-45A7-926D-6EAE78AA6EBF}: [NameServer]8.26.56.26,156.154.70.22
Tcpip\..\Interfaces\{A825E656-1D03-4955-A39E-99A1A7F2D232}: [NameServer]8.26.56.26,156.154.70.22

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [920064 2008-02-01] ()
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [193024 2008-02-01] ()
R2 OMSI download service; D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)

==================== Drivers (Whitelisted) ====================

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [58496 2008-01-21] (Microsoft Corporation)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [59144 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R3 NmPar; C:\Windows\System32\DRIVERS\NmPar.sys [95232 2007-01-10] (Windows (R) Codename Longhorn DDK provider)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3531136 2009-06-23] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [860656 2008-10-26] (Duplex Secure Ltd.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-02 23:16 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-02 23:08 - 2013-08-02 23:08 - 00000582 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:02 - 2013-08-02 17:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:59 - 2013-08-02 14:59 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DealPly
2013-08-02 14:58 - 2013-08-02 23:11 - 00000388 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-02 14:58 - 2013-08-02 22:58 - 00000286 _____ C:\Windows\Tasks\DSite.job
2013-08-02 14:58 - 2013-08-02 14:58 - 00003224 _____ C:\Windows\System32\Tasks\DSite
2013-08-02 14:58 - 2013-08-02 14:58 - 00003036 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DSite
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Babylon
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\Program Files (x86)\LyriXeeker
2013-07-10 19:51 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 19:51 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 19:51 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 19:51 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 19:51 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 19:51 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 19:51 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 19:51 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 19:51 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 19:51 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 19:51 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 19:51 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 19:50 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 19:38 - 2013-06-01 06:19 - 00619008 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 19:38 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:29 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:27 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 13:02 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01556480 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01149440 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-10 19:37 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 19:34 - 2013-05-08 06:18 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 19:34 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 19:30 - 2013-06-04 04:03 - 02775040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2013-08-02 23:16 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-02 23:11 - 2013-08-02 14:58 - 00000388 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-02 23:10 - 2012-07-08 17:52 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-02 23:10 - 2011-02-27 17:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-02 23:10 - 2008-05-09 13:21 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-02 23:10 - 2006-11-02 17:40 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-02 23:10 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-02 23:10 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-02 23:09 - 2008-01-21 03:53 - 02062464 _____ C:\Windows\WindowsUpdate.log
2013-08-02 23:09 - 2006-11-02 17:40 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-02 23:08 - 2013-08-02 23:08 - 00000582 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 23:08 - 2008-05-09 12:50 - 00000000 ____D C:\Users\Admin
2013-08-02 22:58 - 2013-08-02 14:58 - 00000286 _____ C:\Windows\Tasks\DSite.job
2013-08-02 22:54 - 2012-04-16 23:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-02 22:39 - 2012-02-26 13:03 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-02 22:36 - 2011-02-27 17:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-02 22:35 - 2013-03-11 18:55 - 00004798 _____ C:\Windows\PFRO.log
2013-08-02 22:34 - 2008-07-27 18:00 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-02 22:19 - 2008-07-27 18:06 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-08-02 17:39 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 15:00 - 2012-06-01 10:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:59 - 2013-08-02 14:59 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DealPly
2013-08-02 14:58 - 2013-08-02 14:58 - 00003224 _____ C:\Windows\System32\Tasks\DSite
2013-08-02 14:58 - 2013-08-02 14:58 - 00003036 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DSite
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Babylon
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\Program Files (x86)\LyriXeeker
2013-08-02 14:47 - 2011-04-09 11:09 - 00003686 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{9A3DF808-9D9B-4BA1-A429-776C5B2827EE}
2013-08-01 22:05 - 2012-03-06 21:22 - 00011048 _____ C:\Windows\system32\spsys.log
2013-07-31 10:30 - 2008-01-21 12:47 - 01560144 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-31 10:30 - 2008-01-21 12:46 - 00671424 _____ C:\Windows\system32\perfh007.dat
2013-07-31 10:30 - 2008-01-21 12:46 - 00144592 _____ C:\Windows\system32\perfc007.dat
2013-07-20 16:23 - 2011-11-21 22:43 - 01539214 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-19 19:29 - 2013-05-20 16:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2013-07-19 19:25 - 2013-04-22 15:02 - 00000796 _____ C:\Windows\setupact.log
2013-07-16 07:31 - 2011-02-27 17:19 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-16 07:31 - 2011-02-27 17:19 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 13:34 - 2008-10-04 13:24 - 00000000 ____D C:\Users\Admin\AppData\Local\Pinnacle
2013-07-13 13:33 - 2008-10-04 12:51 - 00000349 _____ C:\Users\Public\Documents\PCLECHAL.INI
2013-07-11 09:32 - 2008-05-10 14:17 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-07-11 09:29 - 2012-04-16 23:03 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 09:29 - 2012-04-16 23:03 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 09:29 - 2011-06-28 01:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 09:22 - 2006-11-02 17:21 - 00423736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 20:06 - 2006-11-02 14:35 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-02 23:16

==================== End Of Log ============================

Und die Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-08-2013
Ran by Admin at 2013-08-02 23:17:13
Running from E:\Internet
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
15355 Webcam Live (x32 Version: 1.0.0.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Photoshop Elements 2.0 (x32 Version: 2.0)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Akamai NetSession Interface (HKCU)
Akamai NetSession Interface Service (x32)
Apple Application Support (x32 Version: 2.3)
Apple Software Update (x32 Version: 2.1.3.127)
Avanquest update (x32 Version: 1.29)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
Boris Graffiti (x32 Version: 5.20.200)
Brother MFL-Pro Suite MFC-J5910DW (x32 Version: 1.0.5.0)
Canon Camera TWAIN Driver (x32 Version: 5.2)
Canon Camera Window DC_DV 6 for ZoomBrowser EX (x32 Version: 6.4.0.9)
Canon Camera Window MC 6 for ZoomBrowser EX (x32 Version: 6.3.0.8)
Canon EOS Kiss REBEL 300D TWAIN-Treiber (x32 Version: 5.2)
Canon G.726 WMP-Decoder (x32 Version: 1.1.0.4)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (x32 Version: 1.3.1.5)
Canon Internet Library for ZoomBrowser EX (x32 Version: 1.5.1.4)
Canon MovieEdit Task for ZoomBrowser EX (x32 Version: 2.4.0.14)
Canon PhotoRecord (x32 Version: 02.00.00029)
Canon RAW Image Task for ZoomBrowser EX (x32 Version: 2.5.0.8)
Canon RemoteCapture Task for ZoomBrowser EX (x32 Version: 0.9.0)
Canon RemoteCapture Task for ZoomBrowser EX (x32 Version: 1.7.0.8)
Canon Utilities File Viewer Utility 1.3 (x32 Version: 1.3.2)
Canon Utilities PhotoStitch 3.1 (x32 Version: 3.1.10)
Canon Utilities RemoteCapture 2.7 (x32 Version: 2.7.5)
Canon Utilities ZoomBrowser EX (x32 Version: 5.8.0.74)
CDBurnerXP (x32 Version: 4.5.1.4003)
Click to Call with Skype (x32 Version: 5.6.8153)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
ElsterFormular 2007/2008 (x32 Version: 9.0.0.0)
ElsterFormular 2008/2009 (x32 Version: 10.3.1.0)
EPSON Scan (x32)
File Viewer Utility 1.3.2 (x32 Version: 1.3.2)
Free DWG Viewer 7.0 (x32 Version: 7.0.1)
FreePDF (Remove only) (x32)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
GPL Ghostscript 8.70 (x32)
HP Product Detection (x32 Version: 4.0.0009)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
LyricXeeker (x32)
Magic Bullet Looks Studio (x32)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Access 2002 Runtime (x32 Version: 10.0.6626.0)
Microsoft Office 2000 SR-1 Disc 2 (x32 Version: 9.00.3821)
Microsoft Office 2000 SR-1 Professional (x32 Version: 9.00.3821)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)
MosChip Multi-IO Controller
MSXML 4.0 SP2 (KB936181) (x32 Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (x32 Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
neroxml (x32 Version: 1.0.0)
Nuance PaperPort 12 (x32 Version: 12.1.0000)
Nuance PDF Viewer Plus (x32 Version: 5.30.3290)
NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)
NVIDIA Display Control Panel (Version: 6.14.12.5896)
NVIDIA Drivers (Version: 1.10.62.40)
NVIDIA ForceWare Network Access Manager (Version: 1.00.6777)
NVIDIA ForceWare Network Access Manager (x32)
NVIDIA Grafiktreiber 311.06 (Version: 311.06)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA PhysX (x32 Version: 9.10.0129)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
PaperPort Image Printer 64-bit (Version: 1.00.0001)
Partition Wizard Home Edition 5.0 (x32)
PDFCreator (x32 Version: 0.9.5)
PhotoStitch (x32 Version: 3.1.10)
Pinnacle Instant DVD Recorder (x32 Version: 2.5.0.090)
Pinnacle Studio 12 (x32 Version: 12.1.3.6605)
Pinnacle Studio 12 Ultimate Plugins (x32 Version: 12.0.0.0)
Pinnacle Video Treiber (Version: 12.00.0017)
proDAD Vitascene 1.0 (x32)
PVSonyDll (Version: 1.00.0001)
QuickTime (x32 Version: 7.68.75.0)
RedMon - Redirection Port Monitor
RemoteCapture 2.7.5 (x32 Version: 2.7.5)
RemoteCapture Task (x32 Version: 0.9.0)
rosoft .NET Framework 3.5 Language Pack SP1 - DEU
Scansoft PDF Professional (x32)
SilverFast Epson (SE, Photoshop Plugin) (x32 Version: 6.0)
SilverFast Epson (SE, TWAIN Plugin) (x32 Version: 6.0)
SilverFast Epson-SE 6.6.1r7 (x32)
Skype™ 6.1 (x32 Version: 6.1.129)
Sony Ericsson PC Companion 1.50.52 (x32 Version: 1.50.52)
Sony Ericsson PC Suite 6.009.00 (x32 Version: 6.009.00)
Spelling Dictionaries Support For Adobe Reader 9 (x32 Version: 9.0.0)
SureThing Express Labeler (x32)
System Requirements Lab (x32)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (x32 Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Mipony Download Manager (HKCU)
VCRedistSetup (x32 Version: 1.0.0)
VLC media player 2.0.6 (x32 Version: 2.0.6)
Windows-Soundschemas
WinRAR (x32)

==================== Restore Points  =========================

20-07-2013 14:15:17 Windows Update
21-07-2013 17:27:21 Geplanter Prüfpunkt
22-07-2013 16:36:41 Geplanter Prüfpunkt
23-07-2013 18:24:52 Windows Update
26-07-2013 20:31:43 Windows Update
28-07-2013 16:27:39 Geplanter Prüfpunkt
30-07-2013 16:27:35 Windows Update
31-07-2013 17:20:56 Geplanter Prüfpunkt
02-08-2013 13:01:07 Windows Defender Checkpoint

==================== Hosts content: ==========================

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0C3CE2AF-0985-4190-9669-EBD907D6B8F2} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {5688C673-3B36-42D6-9403-6C1844385185} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-24] (Microsoft Corporation)
Task: {67CDAE0E-6CAC-4787-8D69-C4EAFB4754CE} - System32\Tasks\LyricXeeker Update => C:\Program Files (x86)\LyriXeeker\LyriXupdate.exe [2013-07-27] (LyriXeeker Tech)
Task: {9475DD97-BB54-4FD8-A31A-032B4833F6AA} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {95159655-4F51-4E73-B5EE-2C8DCEEFAD2C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-02-27] (Google Inc.)
Task: {97BB7762-03CE-4329-9382-3520E3CBCF70} - System32\Tasks\User_Feed_Synchronization-{9A3DF808-9D9B-4BA1-A429-776C5B2827EE} => C:\Windows\system32\msfeedssync.exe [2011-04-09] (Microsoft Corporation)
Task: {9DD274CD-A40C-448C-B1B3-BBE0794273DF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-11] (Adobe Systems Incorporated)
Task: {A3BEDE36-982D-4D1E-88E4-CE8EA5D96CAE} - System32\Tasks\DealPly => C:\Users\Admin\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE No File
Task: {A5811A40-7184-4947-843F-1C1A75212D1E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-02-27] (Google Inc.)
Task: {AA105019-BFFB-4713-B627-81B47F4419F0} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {B4A68F0B-05B8-45F7-97CD-AB3D0953F845} - System32\Tasks\DSite => C:\Users\Admin\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE [2013-08-02] ()
Task: {B7E22618-BA12-4D8C-B7BD-EFC8D0524814} - System32\Tasks\{29BA290F-F65E-4E01-8D8E-3523DF4A70AB} => C:\Program Files (x86)\Internet Explorer\iexplore.exe [2013-05-29] (Microsoft Corporation)
Task: {C0B38178-CA76-4475-90EB-B2F41221156B} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {C28278BF-1ABF-4595-BB2A-15201DDF25E3} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {C37E69D3-C7E1-4A69-B359-1975B0EF248B} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {C41E9FD5-A5DB-4DEF-9715-E4F7BAFEE730} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {CF2719EC-FDF1-42D4-98F1-DF45AD7E939A} - System32\Tasks\{40EB5FE2-A11D-4064-B296-677C59F823D6} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-01-08] (Skype Technologies S.A.)
Task: {D1849F70-8D65-4263-957C-27FD3AAE933A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)
Task: {D4A89977-D422-41BF-A293-50CA5D9A7C05} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {DDB6E9AC-2A31-44AB-BFA9-B01D70CC5868} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Admin => C:\Program Files (x86)\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {F5D0108A-3A77-4FDE-93D4-4041495A6339} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)
Task: {F9325E2F-EE1D-4DA5-879D-135006386D2D} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DSite.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\LyricXeeker Update.job => C:\Program Files (x86)\LyriXeeker\LyriXupdate.exe

==================== Faulty Device Manager Devices =============

Name: Epson F-3200
Description: Epson F-3200
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Hamrick Software
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: epson perfektion3200 photo
Description: Acer/BenQ 1240
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Hamrick Software
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Epson F-3200 #2
Description: Epson F-3200
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Hamrick Software
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/02/2013 11:12:01 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/02/2013 10:58:29 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16496 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: e98
Anfangszeit: 01ce8fc0f15f76c3
Zeitpunkt der Beendigung: 40

Error: (08/02/2013 10:36:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/02/2013 10:24:55 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16496 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 1230
Anfangszeit: 01ce8fbdfb0ee544
Zeitpunkt der Beendigung: 31

Error: (08/02/2013 10:17:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/02/2013 05:57:07 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16496 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 1998
Anfangszeit: 01ce8f98cf4ac334
Zeitpunkt der Beendigung: 210

Error: (08/02/2013 05:55:48 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16496 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 1720
Anfangszeit: 01ce8f98b5d50824
Zeitpunkt der Beendigung: 40

Error: (08/02/2013 05:54:19 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16496 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 1334
Anfangszeit: 01ce8f979f746224
Zeitpunkt der Beendigung: 90

Error: (08/02/2013 05:47:35 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16496 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 490
Anfangszeit: 01ce8f978cae4ac4
Zeitpunkt der Beendigung: 47

Error: (08/02/2013 05:47:10 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16496 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 12e4
Anfangszeit: 01ce8f974db70784
Zeitpunkt der Beendigung: 62


System errors:
=============
Error: (08/02/2013 11:13:28 PM) (Source: Service Control Manager) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (08/02/2013 11:13:28 PM) (Source: Service Control Manager) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (08/02/2013 10:37:54 PM) (Source: Service Control Manager) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (08/02/2013 10:37:54 PM) (Source: Service Control Manager) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (08/02/2013 10:18:11 PM) (Source: Service Control Manager) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (08/02/2013 10:18:11 PM) (Source: Service Control Manager) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (08/02/2013 05:27:37 PM) (Source: DCOM) (User: RODRIGO)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}RODRIGOAdminS-1-5-21-959472266-1724037261-2564462381-1000LocalHost (unter Verwendung von LRPC)

Error: (08/02/2013 05:27:32 PM) (Source: Service Control Manager) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (08/02/2013 05:27:32 PM) (Source: Service Control Manager) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (08/02/2013 05:24:48 PM) (Source: Print) (User: NT-AUTORITÄT)
Description: Der Druckspooler konnte den Drucker hp color inkjet cp1700 nicht unter dem Namen hp color inkjet cp1700 freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden.


Microsoft Office Sessions:
=========================
Error: (08/02/2013 11:12:01 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/02/2013 10:58:29 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.16496e9801ce8fc0f15f76c340

Error: (08/02/2013 10:36:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/02/2013 10:24:55 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.16496123001ce8fbdfb0ee54431

Error: (08/02/2013 10:17:10 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/02/2013 05:57:07 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.16496199801ce8f98cf4ac334210

Error: (08/02/2013 05:55:48 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.16496172001ce8f98b5d5082440

Error: (08/02/2013 05:54:19 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.16496133401ce8f979f74622490

Error: (08/02/2013 05:47:35 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.1649649001ce8f978cae4ac447

Error: (08/02/2013 05:47:10 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.1649612e401ce8f974db7078462


CodeIntegrity Errors:
===================================
  Date: 2013-03-30 17:28:11.051
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 17:28:06.367
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-23 16:08:35.519
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-23 16:03:31.955
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-22 17:29:17.951
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-22 17:23:43.762
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-17 18:01:50.966
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-16 15:35:57.478
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-04 17:16:02.019
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-02-23 14:30:29.157
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\dxgi.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 67%
Total physical RAM: 2045.76 MB
Available physical RAM: 656.01 MB
Total Pagefile: 6087.02 MB
Available Pagefile: 4335.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:98.79 GB) (Free:22.34 GB) NTFS (Disk=0 Partition=1) ==>[Drive with boot components (obtained from BCD)]
Drive d: (Daten1) (Fixed) (Total:366.97 GB) (Free:288.81 GB) NTFS (Disk=0 Partition=2)
Drive e: (Daten2) (Fixed) (Total:465.76 GB) (Free:359.38 GB) NTFS (Disk=1 Partition=1)
Drive h: (Expansion Drive) (Fixed) (Total:1863.01 GB) (Free:1272.11 GB) NTFS (Disk=2 Partition=1)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 460D6538)
Partition 1: (Active) - (Size=99 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=367 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: F73D269D)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 1863 GB) (Disk ID: 56361731)
Partition 1: (Not Active) - (Size=-198626934272) - (Type=07 NTFS)

==================== End Of Log ============================

Danke schonmal für eure Hilfe!

schrauber · 02.08.2013, 22:59

hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

gonzales · 02.08.2013, 23:26

Anbei die Combifix Log Datei:

Code:

ATTFilter

ComboFix 13-08-02.01 - Admin 03.08.2013   0:14.1.2 - x64
Microsoft® Windows Vista™ Ultimate   6.0.6002.2.1252.49.1031.18.2046.674 [GMT 2:00]
ausgeführt von:: e:\internet\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
 ADS - Windows: deleted 48 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\LyriXeeker\125.dll
c:\programdata\hpe318B.dll
c:\programdata\hpe9434.dll
c:\programdata\Sony Ericsson PC Software.ico
c:\windows\IsUn0407.exe
H:\Autorun.inf
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-07-02 bis 2013-08-02  ))))))))))))))))))))))))))))))
.
.
2013-08-02 21:16 . 2013-08-02 21:16	--------	d-----w-	C:\FRST
2013-08-02 13:02 . 2013-08-02 15:39	--------	d-----w-	c:\users\Admin\AppData\Roaming\Mipony
2013-08-02 13:02 . 2013-08-02 13:02	--------	d-----w-	c:\users\Admin\Qtrax
2013-08-02 13:00 . 2013-08-02 13:00	--------	d-----w-	c:\users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 13:00 . 2013-08-02 13:00	--------	d-----w-	c:\windows\SysWow64\Extensions
2013-08-02 13:00 . 2013-08-02 13:00	--------	d-----w-	c:\windows\SysWow64\searchplugins
2013-08-02 12:59 . 2013-08-02 12:59	--------	d-----w-	c:\users\Admin\AppData\Roaming\DealPly
2013-08-02 12:58 . 2013-08-02 22:21	--------	d-----w-	c:\program files (x86)\LyriXeeker
2013-08-02 12:58 . 2013-08-02 12:58	--------	d-----w-	c:\users\Admin\AppData\Roaming\DSite
2013-08-02 12:58 . 2013-08-02 12:58	--------	d-----w-	c:\users\Admin\AppData\Roaming\Babylon
2013-08-02 12:58 . 2013-08-02 12:58	--------	d-----w-	c:\programdata\Babylon
2013-08-02 11:37 . 2013-07-02 08:34	9460976	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{4CFC52FD-0BFA-4B4B-96D3-614045383C29}\mpengine.dll
2013-07-10 17:38 . 2013-06-01 04:19	619008	----a-w-	c:\windows\system32\qedit.dll
2013-07-10 17:38 . 2013-06-01 04:06	505344	----a-w-	c:\windows\SysWow64\qedit.dll
2013-07-10 17:38 . 2013-04-09 04:08	1815552	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2013-07-10 17:38 . 2013-04-09 04:07	1500672	----a-w-	c:\program files\Windows Journal\JNWDRV.dll
2013-07-10 17:38 . 2013-04-09 04:07	1447936	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 17:38 . 2013-04-09 04:07	1476608	----a-w-	c:\program files\Windows Journal\JNTFiltr.dll
2013-07-10 17:38 . 2013-04-09 03:51	936960	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 17:34 . 2013-05-08 04:04	1548288	----a-w-	c:\windows\SysWow64\WMVDECOD.DLL
2013-07-10 17:34 . 2013-05-08 04:18	1706496	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-10 17:30 . 2013-06-04 02:03	2775040	----a-w-	c:\windows\system32\win32k.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-11 07:29 . 2012-04-16 21:03	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-11 07:29 . 2011-06-27 23:27	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-10 18:06 . 2006-11-02 12:35	78185248	----a-w-	c:\windows\system32\mrt.exe
2013-06-29 21:11 . 2013-06-29 21:11	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-29 21:11 . 2012-07-05 22:58	867240	----a-w-	c:\windows\SysWow64\npdeployJava1.dll
2013-06-29 21:11 . 2010-05-06 07:50	789416	----a-w-	c:\windows\SysWow64\deployJava1.dll
2013-06-28 15:29 . 2013-03-01 21:50	189936	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-06-28 15:29 . 2012-02-26 11:03	378944	----a-w-	c:\windows\system32\drivers\aswSP.sys
2013-06-28 15:29 . 2012-02-26 11:03	1030952	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-05-09 08:59 . 2013-03-01 21:50	65336	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2012-02-26 11:03	64288	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2012-02-26 11:03	59144	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2013-05-09 08:59 . 2012-02-26 11:03	33400	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:59 . 2012-02-26 11:03	80816	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:58 . 2012-02-26 11:02	41664	----a-w-	c:\windows\avastSS.scr
2013-05-09 08:58 . 2012-02-26 11:03	287840	----a-w-	c:\windows\system32\aswBoot.exe
2013-05-08 04:50 . 2013-06-12 17:36	1423720	----a-w-	c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"Akamai NetSession Interface"="c:\users\Admin\AppData\Local\Akamai\netsession_win.exe" [2013-06-04 4489472]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"ControlCenter4"="c:\program files (x86)\ControlCenter4\BrCcBoot.exe" [2011-04-20 139264]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2011-05-19 2629632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office\OSA9.EXE -b -l [2000-1-21 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - PWLDRPOB
*Deregistered* - pwldrpob
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
Themes
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-16 07:29]
.
2013-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-27 15:19]
.
2013-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-27 15:19]
.
2013-08-02 c:\windows\Tasks\LyricXeeker Update.job
- c:\program files (x86)\LyriXeeker\LyriXupdate.exe [2013-07-27 21:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58	133840	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2009-06-22 662016]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.freenet.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>
IE: Mit Mipony herunterladen - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
Trusted Zone: designer-ohne-grenzen.com
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{7A29ADAD-F175-45A7-926D-6EAE78AA6EBF}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{A825E656-1D03-4955-A39E-99A1A7F2D232}: NameServer = 8.26.56.26,156.154.70.22
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{17E58097-6CA5-448B-830F-2A19678248FB} - c:\program files (x86)\LyriXeeker\125.dll
Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Adobe Photoshop Elements 2.0 - c:\windows\ISUN0407.EXE
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-08-03  00:24:43
ComboFix-quarantined-files.txt  2013-08-02 22:24
.
Vor Suchlauf: 15 Verzeichnis(se), 23.570.649.088 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 23.950.012.416 Bytes frei
.
- - End Of File - - DF33EBE072185330E694A963B8F5ED8B
5C616939100B85E558DA92B899A0FC36

Danke, dass du dir Zeit nimmst

schrauber · 03.08.2013, 07:39

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

und ein frisches FRST log bitte

gonzales · 03.08.2013, 12:25

Also hab jetzt mal alles befolgt, was du mir gesagt hast.

Hier die ADWCleaner Log Datei:

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 03/08/2013 um 12:59:09 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Ultimate Service Pack 2 (64 bits)
# Benutzer : Admin - RODRIGO
# Bootmodus : Normal
# Ausgeführt unter : E:\Internet\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Gelöscht mit Neustart : C:\ProgramData\Ask
Gelöscht mit Neustart : C:\ProgramData\Babylon
Gelöscht mit Neustart : C:\Users\Admin\AppData\Roaming\Babylon
Gelöscht mit Neustart : C:\Users\Admin\AppData\Roaming\DealPly
Gelöscht mit Neustart : C:\Users\Admin\AppData\Roaming\DSite

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DealPly
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\82dcdebd69ed45
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16496

[OK] Die Registrierungsdatenbank ist sauber.

*************************

AdwCleaner[S1].txt - [3042 octets] - [03/08/2013 12:59:09]

########## EOF - C:\AdwCleaner[S1].txt - [3102 octets] ##########

Hier ist die Malwarebytes Log-Datei:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.03.03

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: RODRIGO [Administrator]

Schutz: Aktiviert

03.08.2013 13:11:10
mbam-log-2013-08-03 (13-11-10).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 242113
Laufzeit: 2 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 5
HKCR\CLSID\{17E58097-6CA5-448B-830F-2A19678248FB} (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{17E58097-6CA5-448B-830F-2A19678248FB} (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{17E58097-6CA5-448B-830F-2A19678248FB} (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{17E58097-6CA5-448B-830F-2A19678248FB} (PUP.Optional.LyricXeeker.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lyrix@lyrixeeker.co (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Program Files (x86)\LyriXeeker (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 8
C:\Program Files (x86)\LyriXeeker\chrome.manifest (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyriXeeker\125.crx (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyriXeeker\125.dat (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyriXeeker\125.xpi (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyriXeeker\LyriXupdate.exe (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyriXeeker\sqlite3.dll (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\LyriXeeker\Uninstall.exe (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Tasks\LyricXeeker Update.job (PUP.Optional.Lyrixeeker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Und hier noch der neue FRST Log:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by Admin (administrator) on 03-08-2013 13:18:53
Running from E:\Internet
Windows Vista (TM) Ultimate Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Sonix) C:\Windows\vsnp2uvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [snp2uvc] - C:\Windows\vsnp2uvc.exe [662016 2009-06-22] (Sonix)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2011-05-19] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" [x]
HKU\UpdatusUser\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\UpdatusUser\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.freenet.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {C6CFC481-9BAC-4D9F-8951-EE29AC99A6C2} URL = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {3BFFE033-BF43-11D5-A271-00A024A51325} https://mail.gs.hfwu.de/iNotes6W.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
DPF: HKLM-x32 {6B75345B-AA36-438A-BBE6-4078B4C6984D} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: HKLM-x32 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ipp - No CLSID Value - 
Handler: msdaipp - No CLSID Value - 
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: ipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{7A29ADAD-F175-45A7-926D-6EAE78AA6EBF}: [NameServer]8.26.56.26,156.154.70.22
Tcpip\..\Interfaces\{A825E656-1D03-4955-A39E-99A1A7F2D232}: [NameServer]8.26.56.26,156.154.70.22

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [920064 2008-02-01] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [193024 2008-02-01] ()
R2 OMSI download service; D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)

==================== Drivers (Whitelisted) ====================

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [58496 2008-01-21] (Microsoft Corporation)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [59144 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NmPar; C:\Windows\System32\DRIVERS\NmPar.sys [95232 2007-01-10] (Windows (R) Codename Longhorn DDK provider)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3531136 2009-06-23] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [860656 2008-10-26] (Duplex Secure Ltd.)
S1 Beep; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-03 13:09 - 2013-08-03 13:09 - 00000954 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-03 13:09 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-03 13:02 - 2013-08-03 13:02 - 00003167 _____ C:\Users\Admin\Desktop\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00003167 _____ C:\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00000284 _____ C:\Windows\DeleteOnReboot.bat
2013-08-03 00:24 - 2013-08-03 00:24 - 00015036 _____ C:\ComboFix.txt
2013-08-03 00:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-03 00:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-03 00:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-03 00:12 - 2013-08-03 00:24 - 00000000 ____D C:\Qoobox
2013-08-03 00:11 - 2013-08-03 00:23 - 00000000 ____D C:\Windows\erdnt
2013-08-02 23:17 - 2013-08-02 23:17 - 00025962 _____ C:\Users\Admin\Desktop\FRST.txt
2013-08-02 23:17 - 2013-08-02 23:17 - 00024411 _____ C:\Users\Admin\Desktop\Addition.txt
2013-08-02 23:16 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-02 23:08 - 2013-08-02 23:08 - 00000582 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:02 - 2013-08-02 17:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon
2013-07-10 19:51 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 19:51 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 19:51 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 19:51 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 19:51 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 19:51 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 19:51 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 19:51 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 19:51 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 19:51 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 19:51 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 19:51 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 19:50 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 19:38 - 2013-06-01 06:19 - 00619008 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 19:38 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:29 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:27 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 13:02 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01556480 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01149440 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-10 19:37 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 19:34 - 2013-05-08 06:18 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 19:34 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 19:30 - 2013-06-04 04:03 - 02775040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2013-08-03 13:16 - 2013-03-11 18:55 - 00007458 _____ C:\Windows\PFRO.log
2013-08-03 13:16 - 2012-07-08 17:52 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-03 13:16 - 2011-02-27 17:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-03 13:16 - 2008-05-09 13:21 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-03 13:16 - 2006-11-02 17:40 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-03 13:16 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-03 13:16 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-03 13:15 - 2008-01-21 03:53 - 01061163 _____ C:\Windows\WindowsUpdate.log
2013-08-03 13:15 - 2006-11-02 17:40 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-03 13:09 - 2013-08-03 13:09 - 00000954 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-03 13:02 - 2013-08-03 13:02 - 00003167 _____ C:\Users\Admin\Desktop\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00003167 _____ C:\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00000284 _____ C:\Windows\DeleteOnReboot.bat
2013-08-03 12:53 - 2012-04-16 23:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-03 00:36 - 2011-02-27 17:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-03 00:24 - 2013-08-03 00:24 - 00015036 _____ C:\ComboFix.txt
2013-08-03 00:24 - 2013-08-03 00:12 - 00000000 ____D C:\Qoobox
2013-08-03 00:24 - 2006-11-02 15:33 - 00000000 __RHD C:\Users\Default
2013-08-03 00:23 - 2013-08-03 00:11 - 00000000 ____D C:\Windows\erdnt
2013-08-03 00:22 - 2006-11-02 14:34 - 00000215 _____ C:\Windows\system.ini
2013-08-02 23:17 - 2013-08-02 23:17 - 00025962 _____ C:\Users\Admin\Desktop\FRST.txt
2013-08-02 23:17 - 2013-08-02 23:17 - 00024411 _____ C:\Users\Admin\Desktop\Addition.txt
2013-08-02 23:16 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-02 23:08 - 2013-08-02 23:08 - 00000582 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 23:08 - 2008-05-09 12:50 - 00000000 ____D C:\Users\Admin
2013-08-02 22:39 - 2012-02-26 13:03 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-02 22:34 - 2012-11-07 10:27 - 00000000 ____D C:\Program Files\Google
2013-08-02 22:34 - 2008-07-27 18:00 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-02 22:19 - 2008-07-27 18:06 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-08-02 17:39 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 15:00 - 2012-06-01 10:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon
2013-08-02 14:47 - 2011-04-09 11:09 - 00003686 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{9A3DF808-9D9B-4BA1-A429-776C5B2827EE}
2013-08-01 22:05 - 2012-03-06 21:22 - 00011048 _____ C:\Windows\system32\spsys.log
2013-07-31 10:30 - 2008-01-21 12:47 - 01560144 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-31 10:30 - 2008-01-21 12:46 - 00671424 _____ C:\Windows\system32\perfh007.dat
2013-07-31 10:30 - 2008-01-21 12:46 - 00144592 _____ C:\Windows\system32\perfc007.dat
2013-07-20 16:23 - 2011-11-21 22:43 - 01539214 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-19 19:29 - 2013-05-20 16:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2013-07-19 19:25 - 2013-04-22 15:02 - 00000796 _____ C:\Windows\setupact.log
2013-07-16 07:31 - 2011-02-27 17:19 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-16 07:31 - 2011-02-27 17:19 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 13:34 - 2008-10-04 13:24 - 00000000 ____D C:\Users\Admin\AppData\Local\Pinnacle
2013-07-13 13:33 - 2008-10-04 12:51 - 00000349 _____ C:\Users\Public\Documents\PCLECHAL.INI
2013-07-11 09:32 - 2008-05-10 14:17 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-07-11 09:29 - 2012-04-16 23:03 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 09:29 - 2012-04-16 23:03 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 09:29 - 2011-06-28 01:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 09:22 - 2006-11-02 17:21 - 00423736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 20:06 - 2006-11-02 14:35 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-03 13:07

==================== End Of Log ============================

--- --- ---

Kann ich jetzt Malwarebytes wieder deinstalieren und Avast Antivir wieder aktivieren?

Danke dir und liebe Grüße von meiner Mutter

schrauber · 04.08.2013, 09:26

Malwarebytes kannste auch drauf lassen um später ab und zu mal zu scannen.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

gonzales · 04.08.2013, 14:48

Okay hab alles abgearbeitet Eset zeigt keine Infektionen und der SecurityCheck hat paar veraltet Programme gefunden.

Eset Log:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cf95c86b0013734492c9d5ba9d933d7f
# engine=14644
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-04 01:15:54
# local_time=2013-08-04 03:15:54 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=774 16777213 85 91 146210 152332026 0 0
# compatibility_mode=5892 16776574 100 100 168398 213146154 0 0
# scanned=400114
# found=0
# cleaned=0
# scan_time=6601

SecurityCheck Log:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.71  
 Windows Vista Service Pack 2 x64 (UAC is enabled)  
 Internet Explorer 9  
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
avast! Antivirus   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 25  
 Adobe Reader 9 Adobe Reader out of Date! 
 Adobe Reader 10.1.7 Adobe Reader out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

Und der neue FSRT Log:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by Admin (administrator) on 04-08-2013 15:42:28
Running from E:\Internet
Windows Vista (TM) Ultimate Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(Sonix) C:\Windows\vsnp2uvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_94_ActiveX.exe
(Microsoft Corporation) C:\Windows\splwow64.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [snp2uvc] - C:\Windows\vsnp2uvc.exe [662016 2009-06-22] (Sonix)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2011-05-19] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" [x]
HKU\UpdatusUser\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\UpdatusUser\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.freenet.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {C6CFC481-9BAC-4D9F-8951-EE29AC99A6C2} URL = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {3BFFE033-BF43-11D5-A271-00A024A51325} https://mail.gs.hfwu.de/iNotes6W.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
DPF: HKLM-x32 {6B75345B-AA36-438A-BBE6-4078B4C6984D} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: HKLM-x32 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ipp - No CLSID Value - 
Handler: msdaipp - No CLSID Value - 
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: ipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{7A29ADAD-F175-45A7-926D-6EAE78AA6EBF}: [NameServer]8.26.56.26,156.154.70.22
Tcpip\..\Interfaces\{A825E656-1D03-4955-A39E-99A1A7F2D232}: [NameServer]8.26.56.26,156.154.70.22

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [920064 2008-02-01] ()
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [193024 2008-02-01] ()
R2 OMSI download service; D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)

==================== Drivers (Whitelisted) ====================

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [58496 2008-01-21] (Microsoft Corporation)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [59144 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R3 NmPar; C:\Windows\System32\DRIVERS\NmPar.sys [95232 2007-01-10] (Windows (R) Codename Longhorn DDK provider)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3531136 2009-06-23] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [860656 2008-10-26] (Duplex Secure Ltd.)
S1 Beep; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-04 15:41 - 2013-08-04 15:41 - 00000875 _____ C:\Users\Admin\Desktop\checkup.txt
2013-08-04 15:39 - 2013-08-04 15:39 - 00891098 _____ C:\Users\Admin\Desktop\SecurityCheck.exe
2013-08-03 13:19 - 2013-08-03 13:19 - 00027380 _____ C:\Users\Admin\Desktop\FRST-old2.txt
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-03 13:02 - 2013-08-03 13:02 - 00003167 _____ C:\Users\Admin\Desktop\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00003167 _____ C:\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00000284 _____ C:\Windows\DeleteOnReboot.bat
2013-08-03 00:24 - 2013-08-03 00:24 - 00015036 _____ C:\ComboFix.txt
2013-08-03 00:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-03 00:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-03 00:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-03 00:12 - 2013-08-03 00:24 - 00000000 ____D C:\Qoobox
2013-08-03 00:11 - 2013-08-03 00:23 - 00000000 ____D C:\Windows\erdnt
2013-08-02 23:17 - 2013-08-02 23:17 - 00025962 _____ C:\Users\Admin\Desktop\FRST-old.txt
2013-08-02 23:17 - 2013-08-02 23:17 - 00024411 _____ C:\Users\Admin\Desktop\Addition.txt
2013-08-02 23:16 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-02 23:08 - 2013-08-02 23:08 - 00000582 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:02 - 2013-08-02 17:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon
2013-07-10 19:51 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 19:51 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 19:51 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 19:51 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 19:51 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 19:51 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 19:51 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 19:51 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 19:51 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 19:51 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 19:51 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 19:51 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 19:50 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 19:38 - 2013-06-01 06:19 - 00619008 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 19:38 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:29 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:27 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 13:02 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01556480 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01149440 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-10 19:37 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 19:34 - 2013-05-08 06:18 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 19:34 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 19:30 - 2013-06-04 04:03 - 02775040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2013-08-04 15:41 - 2013-08-04 15:41 - 00000875 _____ C:\Users\Admin\Desktop\checkup.txt
2013-08-04 15:39 - 2013-08-04 15:39 - 00891098 _____ C:\Users\Admin\Desktop\SecurityCheck.exe
2013-08-04 15:36 - 2011-02-27 17:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-04 15:14 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-04 15:14 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-04 14:55 - 2008-01-21 03:53 - 01134267 _____ C:\Windows\WindowsUpdate.log
2013-08-04 14:53 - 2012-04-16 23:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-04 13:14 - 2011-02-27 17:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-04 13:14 - 2008-05-09 13:21 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-04 13:14 - 2006-11-02 17:40 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-04 13:13 - 2006-11-02 17:40 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-03 18:17 - 2011-04-09 11:09 - 00003686 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{9A3DF808-9D9B-4BA1-A429-776C5B2827EE}
2013-08-03 18:09 - 2012-07-08 17:52 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-03 13:19 - 2013-08-03 13:19 - 00027380 _____ C:\Users\Admin\Desktop\FRST-old2.txt
2013-08-03 13:16 - 2013-03-11 18:55 - 00007458 _____ C:\Windows\PFRO.log
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-03 13:02 - 2013-08-03 13:02 - 00003167 _____ C:\Users\Admin\Desktop\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00003167 _____ C:\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00000284 _____ C:\Windows\DeleteOnReboot.bat
2013-08-03 00:24 - 2013-08-03 00:24 - 00015036 _____ C:\ComboFix.txt
2013-08-03 00:24 - 2013-08-03 00:12 - 00000000 ____D C:\Qoobox
2013-08-03 00:24 - 2006-11-02 15:33 - 00000000 __RHD C:\Users\Default
2013-08-03 00:23 - 2013-08-03 00:11 - 00000000 ____D C:\Windows\erdnt
2013-08-03 00:22 - 2006-11-02 14:34 - 00000215 _____ C:\Windows\system.ini
2013-08-02 23:17 - 2013-08-02 23:17 - 00025962 _____ C:\Users\Admin\Desktop\FRST-old.txt
2013-08-02 23:17 - 2013-08-02 23:17 - 00024411 _____ C:\Users\Admin\Desktop\Addition.txt
2013-08-02 23:16 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-02 23:08 - 2013-08-02 23:08 - 00000582 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 23:08 - 2008-05-09 12:50 - 00000000 ____D C:\Users\Admin
2013-08-02 22:39 - 2012-02-26 13:03 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-02 22:34 - 2012-11-07 10:27 - 00000000 ____D C:\Program Files\Google
2013-08-02 22:34 - 2008-07-27 18:00 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-02 22:19 - 2008-07-27 18:06 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-08-02 17:39 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 15:00 - 2012-06-01 10:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon
2013-08-01 22:05 - 2012-03-06 21:22 - 00011048 _____ C:\Windows\system32\spsys.log
2013-07-31 10:30 - 2008-01-21 12:47 - 01560144 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-31 10:30 - 2008-01-21 12:46 - 00671424 _____ C:\Windows\system32\perfh007.dat
2013-07-31 10:30 - 2008-01-21 12:46 - 00144592 _____ C:\Windows\system32\perfc007.dat
2013-07-20 16:23 - 2011-11-21 22:43 - 01539214 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-19 19:29 - 2013-05-20 16:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2013-07-19 19:25 - 2013-04-22 15:02 - 00000796 _____ C:\Windows\setupact.log
2013-07-16 07:31 - 2011-02-27 17:19 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-16 07:31 - 2011-02-27 17:19 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 13:34 - 2008-10-04 13:24 - 00000000 ____D C:\Users\Admin\AppData\Local\Pinnacle
2013-07-13 13:33 - 2008-10-04 12:51 - 00000349 _____ C:\Users\Public\Documents\PCLECHAL.INI
2013-07-11 09:32 - 2008-05-10 14:17 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-07-11 09:29 - 2012-04-16 23:03 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 09:29 - 2012-04-16 23:03 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 09:29 - 2011-06-28 01:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 09:22 - 2006-11-02 17:21 - 00423736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 20:06 - 2006-11-02 14:35 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-04 13:21

==================== End Of Log ============================

--- --- ---

Achja ich hätte da noch eine Frage, meine Eltern haben sich bei diversen Seiten mit ihren Passwörter angemeldet unter Anderem e-mail usw. Müssen sie sich neue Passwörter zulegen? Also war da auch ein Keylogger dabei?

Liebe Grüße und Danke für die ganze Arbeit

schrauber · 05.08.2013, 07:29

Nee aber Passwörter ändern ist Pflicht.

Zitat:

Tcpip\..\Interfaces\{7A29ADAD-F175-45A7-926D-6EAE78AA6EBF}: [NameServer]8.26.56.26,156.154.70.22
Tcpip\..\Interfaces\{A825E656-1D03-4955-A39E-99A1A7F2D232}: [NameServer]8.26.56.26,156.154.70.22

Warum steht bei euch eine IP aus den USA drin?

gonzales · 05.08.2013, 09:28

Das ist eine Berechtigte Frage, die ich so nicht erklären kann. Auf jedenfall läuft dieser Rechner nicht über ein Proxy. Und nach "wieistmeineip.de" kommt für die eigengenutzte IP ganz normal ne Deutsche IP-Aderesse: 88.65.**** heraus.

Wofür steht die IP-Adresse denn da drin, also für den Internetzugang kann es ja nicht sein?

Und Danke dir für all dein Bemühen

schrauber · 05.08.2013, 11:32

Windows-Taste+R, schreibe

netsh winsock reset

und drücke Enter. Poste dann bitte wieder ein frisches FRST log.

gonzales · 05.08.2013, 23:29

Hi,
hab das ganze jetzt mal ausgeführt über die Dos-Box. Erst kam, das man erhöhte Rechte braucht, dann hab ich das ganze "als Administrator" öffnen gmeacht und es hat funktioniert. Jedoch tauchen weiterhin diese Amerikanische Ip-Adressen im FRST Log auf (trotz Neustart)

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-08-2013
Ran by Admin (administrator) on 06-08-2013 00:25:11
Running from E:\Internet
Windows Vista (TM) Ultimate Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Sonix) C:\Windows\vsnp2uvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\system32\prevhost.exe
(Microsoft Corporation) C:\Windows\syswow64\prevhost.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [snp2uvc] - C:\Windows\vsnp2uvc.exe [662016 2009-06-22] (Sonix)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2011-05-19] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" [x]
HKU\UpdatusUser\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\UpdatusUser\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.freenet.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {C6CFC481-9BAC-4D9F-8951-EE29AC99A6C2} URL = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {3BFFE033-BF43-11D5-A271-00A024A51325} https://mail.gs.hfwu.de/iNotes6W.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
DPF: HKLM-x32 {6B75345B-AA36-438A-BBE6-4078B4C6984D} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: HKLM-x32 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ipp - No CLSID Value - 
Handler: msdaipp - No CLSID Value - 
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: ipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{7A29ADAD-F175-45A7-926D-6EAE78AA6EBF}: [NameServer]8.26.56.26,156.154.70.22
Tcpip\..\Interfaces\{A825E656-1D03-4955-A39E-99A1A7F2D232}: [NameServer]8.26.56.26,156.154.70.22

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [920064 2008-02-01] ()
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [193024 2008-02-01] ()
R2 OMSI download service; D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)

==================== Drivers (Whitelisted) ====================

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [58496 2008-01-21] (Microsoft Corporation)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [59144 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R3 NmPar; C:\Windows\System32\DRIVERS\NmPar.sys [95232 2007-01-10] (Windows (R) Codename Longhorn DDK provider)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3531136 2009-06-23] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [860656 2008-10-26] (Duplex Secure Ltd.)
S1 Beep; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-03 12:59 - 2013-08-03 12:59 - 00003167 _____ C:\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00000284 _____ C:\Windows\DeleteOnReboot.bat
2013-08-03 00:24 - 2013-08-03 00:24 - 00015036 _____ C:\ComboFix.txt
2013-08-03 00:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-03 00:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-03 00:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-03 00:12 - 2013-08-03 00:24 - 00000000 ____D C:\Qoobox
2013-08-03 00:11 - 2013-08-03 00:23 - 00000000 ____D C:\Windows\erdnt
2013-08-02 23:16 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:02 - 2013-08-02 17:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon
2013-07-10 19:51 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 19:51 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 19:51 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 19:51 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 19:51 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 19:51 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 19:51 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 19:51 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 19:51 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 19:51 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 19:51 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 19:51 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 19:50 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 19:38 - 2013-06-01 06:19 - 00619008 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 19:38 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:29 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:27 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 13:02 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01556480 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01149440 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-10 19:37 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 19:34 - 2013-05-08 06:18 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 19:34 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 19:30 - 2013-06-04 04:03 - 02775040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2013-08-06 00:22 - 2012-07-08 17:52 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-06 00:21 - 2011-02-27 17:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-06 00:21 - 2008-05-09 13:21 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-06 00:21 - 2006-11-02 17:40 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-06 00:21 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-06 00:21 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-06 00:20 - 2008-01-21 03:53 - 01180748 _____ C:\Windows\WindowsUpdate.log
2013-08-06 00:20 - 2006-11-02 17:40 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-04 18:58 - 2011-04-09 11:09 - 00003686 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{9A3DF808-9D9B-4BA1-A429-776C5B2827EE}
2013-08-04 18:53 - 2012-04-16 23:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-04 18:49 - 2013-03-11 18:55 - 00008284 _____ C:\Windows\PFRO.log
2013-08-04 16:36 - 2011-02-27 17:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-03 12:59 - 2013-08-03 12:59 - 00003167 _____ C:\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00000284 _____ C:\Windows\DeleteOnReboot.bat
2013-08-03 00:24 - 2013-08-03 00:24 - 00015036 _____ C:\ComboFix.txt
2013-08-03 00:24 - 2013-08-03 00:12 - 00000000 ____D C:\Qoobox
2013-08-03 00:24 - 2006-11-02 15:33 - 00000000 __RHD C:\Users\Default
2013-08-03 00:23 - 2013-08-03 00:11 - 00000000 ____D C:\Windows\erdnt
2013-08-03 00:22 - 2006-11-02 14:34 - 00000215 _____ C:\Windows\system.ini
2013-08-02 23:16 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 23:08 - 2008-05-09 12:50 - 00000000 ____D C:\Users\Admin
2013-08-02 22:39 - 2012-02-26 13:03 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-02 22:34 - 2012-11-07 10:27 - 00000000 ____D C:\Program Files\Google
2013-08-02 22:34 - 2008-07-27 18:00 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-02 22:19 - 2008-07-27 18:06 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-08-02 17:39 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 15:00 - 2012-06-01 10:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon
2013-08-01 22:05 - 2012-03-06 21:22 - 00011048 _____ C:\Windows\system32\spsys.log
2013-07-31 10:30 - 2008-01-21 12:47 - 01560144 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-31 10:30 - 2008-01-21 12:46 - 00671424 _____ C:\Windows\system32\perfh007.dat
2013-07-31 10:30 - 2008-01-21 12:46 - 00144592 _____ C:\Windows\system32\perfc007.dat
2013-07-20 16:23 - 2011-11-21 22:43 - 01539214 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-19 19:29 - 2013-05-20 16:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2013-07-19 19:25 - 2013-04-22 15:02 - 00000796 _____ C:\Windows\setupact.log
2013-07-16 07:31 - 2011-02-27 17:19 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-16 07:31 - 2011-02-27 17:19 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 13:34 - 2008-10-04 13:24 - 00000000 ____D C:\Users\Admin\AppData\Local\Pinnacle
2013-07-13 13:33 - 2008-10-04 12:51 - 00000349 _____ C:\Users\Public\Documents\PCLECHAL.INI
2013-07-11 09:32 - 2008-05-10 14:17 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-07-11 09:29 - 2012-04-16 23:03 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 09:29 - 2012-04-16 23:03 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 09:29 - 2011-06-28 01:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 09:22 - 2006-11-02 17:21 - 00423736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 20:06 - 2006-11-02 14:35 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-06 00:19

==================== End Of Log ============================

--- --- ---

Danke für deine Mühe

schrauber · 06.08.2013, 16:23

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Tcpip\..\Interfaces\{7A29ADAD-F175-45A7-926D-6EAE78AA6EBF}: [NameServer]8.26.56.26,156.154.70.22
Tcpip\..\Interfaces\{A825E656-1D03-4955-A39E-99A1A7F2D232}: [NameServer]8.26.56.26,156.154.70.22
S3 61883; C:\Windows\System32\DRIVERS\61883.sys [58496 2008-01-21] (Microsoft Corporation)
C:\Windows\System32\DRIVERS\61883.sys
2013-08-02 15:02 - 2013-08-02 17:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony
2013-08-02 15:02 - 2013-08-02 15:02 - 00000000 ____D C:\Users\Admin\Qtrax
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages
2013-08-02 14:59 - 2013-08-02 14:59 - 00003418 _____ C:\Windows\System32\Tasks\DealPly
2013-08-02 14:58 - 2013-08-02 14:58 - 00000000 ____D C:\ProgramData\Babylon

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

gonzales · 06.08.2013, 21:31

Hat scheinbar alles geklappt

Fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-08-2013
Ran by Admin at 2013-08-06 22:22:16 Run:1
Running from E:\Internet
Boot Mode: Normal
==============================================

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7A29ADAD-F175-45A7-926D-6EAE78AA6EBF}\\NameServer => Value deleted successfully.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A825E656-1D03-4955-A39E-99A1A7F2D232}\\NameServer => Value deleted successfully.
61883 => Service deleted successfully.
Could not move "C:\Windows\System32\DRIVERS\61883.sys" => Scheduled to move on reboot.
C:\Users\Admin\AppData\Roaming\Mipony => Moved successfully.
C:\Users\Admin\Qtrax => Moved successfully.
C:\Users\Admin\AppData\Roaming\Mipony Download Manager Packages => Moved successfully.
C:\Windows\System32\Tasks\DealPly => Moved successfully.
C:\ProgramData\Babylon => Moved successfully.

=========== Result of Scheduled Files to move ===========

C:\Windows\System32\DRIVERS\61883.sys => File moved successfully.

==== End of Fixlog ====

und eine FRST Log Datei :
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-08-2013
Ran by Admin (administrator) on 06-08-2013 22:25:44
Running from E:\Internet
Windows Vista (TM) Ultimate Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Sonix) C:\Windows\vsnp2uvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Akamai Technologies, Inc.) C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
(Microsoft Corporation) C:\Windows\system32\prevhost.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [snp2uvc] - C:\Windows\vsnp2uvc.exe [662016 2009-06-22] (Sonix)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2011-05-19] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" [x]
HKU\UpdatusUser\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [Akamai NetSession Interface] - C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\UpdatusUser\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
SSODL-x32: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.freenet.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {C6CFC481-9BAC-4D9F-8951-EE29AC99A6C2} URL = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {3BFFE033-BF43-11D5-A271-00A024A51325} https://mail.gs.hfwu.de/iNotes6W.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
DPF: HKLM-x32 {6B75345B-AA36-438A-BBE6-4078B4C6984D} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: HKLM-x32 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ipp - No CLSID Value - 
Handler: msdaipp - No CLSID Value - 
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: ipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [920064 2008-02-01] ()
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [193024 2008-02-01] ()
R2 OMSI download service; D:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [59144 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R3 NmPar; C:\Windows\System32\DRIVERS\NmPar.sys [95232 2007-01-10] (Windows (R) Codename Longhorn DDK provider)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3531136 2009-06-23] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [860656 2008-10-26] (Duplex Secure Ltd.)
S1 Beep; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-03 12:59 - 2013-08-03 12:59 - 00003167 _____ C:\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00000284 _____ C:\Windows\DeleteOnReboot.bat
2013-08-03 00:24 - 2013-08-03 00:24 - 00015036 _____ C:\ComboFix.txt
2013-08-03 00:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-03 00:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-03 00:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-03 00:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-03 00:12 - 2013-08-03 00:24 - 00000000 ____D C:\Qoobox
2013-08-03 00:11 - 2013-08-03 00:23 - 00000000 ____D C:\Windows\erdnt
2013-08-02 23:16 - 2013-08-06 22:25 - 00000000 ____D C:\FRST
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-07-10 19:51 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 19:51 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 19:51 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 19:51 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 19:51 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 19:51 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 19:51 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 19:51 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 19:51 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 19:51 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 19:51 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 19:51 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 19:51 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 19:51 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 19:51 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 19:51 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 19:51 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 19:51 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 19:51 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 19:51 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 19:51 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 19:50 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 19:38 - 2013-06-01 06:19 - 00619008 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 19:38 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 14:32 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:29 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-07-10 19:37 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-07-10 19:37 - 2013-04-17 13:27 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 13:02 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01556480 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:37 - 2013-04-17 12:58 - 01149440 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-10 19:37 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-07-10 19:37 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-07-10 19:37 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-07-10 19:37 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 19:34 - 2013-05-08 06:18 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 19:34 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 19:30 - 2013-06-04 04:03 - 02775040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2013-08-06 22:25 - 2013-08-02 23:16 - 00000000 ____D C:\FRST
2013-08-06 22:23 - 2012-03-06 21:22 - 00011560 _____ C:\Windows\system32\spsys.log
2013-08-06 22:23 - 2011-02-27 17:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-06 22:23 - 2008-05-09 13:21 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-06 22:23 - 2006-11-02 17:40 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-06 22:23 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-06 22:23 - 2006-11-02 17:21 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-06 22:22 - 2008-05-09 12:50 - 00000000 ____D C:\Users\Admin
2013-08-06 22:22 - 2008-01-21 03:53 - 01243425 _____ C:\Windows\WindowsUpdate.log
2013-08-06 22:22 - 2006-11-02 17:40 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-06 22:17 - 2012-07-08 17:52 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-06 20:53 - 2012-04-16 23:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-06 18:36 - 2011-02-27 17:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-06 17:28 - 2011-04-09 11:09 - 00003686 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{9A3DF808-9D9B-4BA1-A429-776C5B2827EE}
2013-08-04 18:49 - 2013-03-11 18:55 - 00008284 _____ C:\Windows\PFRO.log
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-08-03 13:09 - 2013-08-03 13:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-03 12:59 - 2013-08-03 12:59 - 00003167 _____ C:\AdwCleaner[S1].txt
2013-08-03 12:59 - 2013-08-03 12:59 - 00000284 _____ C:\Windows\DeleteOnReboot.bat
2013-08-03 00:24 - 2013-08-03 00:24 - 00015036 _____ C:\ComboFix.txt
2013-08-03 00:24 - 2013-08-03 00:12 - 00000000 ____D C:\Qoobox
2013-08-03 00:24 - 2006-11-02 15:33 - 00000000 __RHD C:\Users\Default
2013-08-03 00:23 - 2013-08-03 00:11 - 00000000 ____D C:\Windows\erdnt
2013-08-03 00:22 - 2006-11-02 14:34 - 00000215 _____ C:\Windows\system.ini
2013-08-02 23:08 - 2013-08-02 23:08 - 00000020 _____ C:\Users\Admin\defogger_reenable
2013-08-02 22:39 - 2012-02-26 13:03 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-02 22:34 - 2012-11-07 10:27 - 00000000 ____D C:\Program Files\Google
2013-08-02 22:34 - 2008-07-27 18:00 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-02 22:19 - 2008-07-27 18:06 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-08-02 15:58 - 2013-08-02 15:58 - 00000057 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2013-08-02 15:58 - 2013-08-02 15:58 - 00000005 _____ C:\Users\Admin\AppData\Roaming\WBPU-TTL.DAT
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-08-02 15:00 - 2013-08-02 15:00 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-08-02 15:00 - 2012-06-01 10:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-31 10:30 - 2008-01-21 12:47 - 01560144 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-31 10:30 - 2008-01-21 12:46 - 00671424 _____ C:\Windows\system32\perfh007.dat
2013-07-31 10:30 - 2008-01-21 12:46 - 00144592 _____ C:\Windows\system32\perfc007.dat
2013-07-20 16:23 - 2011-11-21 22:43 - 01539214 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-19 19:29 - 2013-05-20 16:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2013-07-19 19:25 - 2013-04-22 15:02 - 00000796 _____ C:\Windows\setupact.log
2013-07-16 07:31 - 2011-02-27 17:19 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-16 07:31 - 2011-02-27 17:19 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 13:34 - 2008-10-04 13:24 - 00000000 ____D C:\Users\Admin\AppData\Local\Pinnacle
2013-07-13 13:33 - 2008-10-04 12:51 - 00000349 _____ C:\Users\Public\Documents\PCLECHAL.INI
2013-07-11 09:32 - 2008-05-10 14:17 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-07-11 09:29 - 2012-04-16 23:03 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 09:29 - 2012-04-16 23:03 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 09:29 - 2011-06-28 01:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 09:22 - 2006-11-02 17:21 - 00423736 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-11 09:21 - 2006-11-02 17:06 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 20:06 - 2006-11-02 14:35 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-06 20:46

==================== End Of Log ============================

--- --- ---

Danke dir jetzt sollte alles behoben sein.

Und auch von meiner Mutter nochmals Danke Danke Danke

schrauber · 07.08.2013, 10:29

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

gonzales · 07.08.2013, 20:15

Hallo lieber Helfer in der Not,
vielen lieben Dank für Deine Hilfe. Ich bin sehr glücklich über die Lösung die mir diese schreckliche Malware vom Hals geschafft hat. Natürlich passe ich jetzt auch immer auf, damit so etwas nicht nochmal passieren kann. Tausend Dank. ´
Iris

05.08.2013, 11:32	#10
schrauber /// the machine /// TB-Ausbilder	Windows Vista 64 bit: IE, Skript dauert zu lange, delta-search Windows-Taste+R, schreibe netsh winsock reset und drücke Enter. Poste dann bitte wieder ein frisches FRST log. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows Vista 64 bit: IE, Skript dauert zu lange, delta-search

Log-Analyse und Auswertung: Windows Vista 64 bit: IE, Skript dauert zu lange, delta-search