Ich habe von der Telekom einen Brief bekommen, dass von meinem Rechner aus mehrere Zugriffe auf andere Rechner ausgehen, aufgrund eines Hackerangriffs, was wahrscheinlich auf einen Trojaner zurückzuführen ist.

Was mache ich jetzt am Besten?

Reicht es wenn ich AntiVir drüber laufen lasse?

Hi,

wenn du deinen Rechner nach Malware untersuchen lassen willst, dann arbeite bitte diese Anleitung ab und poste die resultierenden Logfiles hier.

Hier die Logdateien:



FRST Logfile:



FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-08-2013 01
Ran by EF2004 (administrator) on 23-08-2013 23:08:06
Running from C:\Users\EF2004\Desktop
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(brother Industries Ltd) C:\Windows\system32\brss01a.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Thomas Hauck, Privat) C:\Program Files\Jana2\Janad.exe
(ATK) C:\Program Files\ASUS\Splendid\ACMON.exe
(ASUSTeK) C:\Windows\System32\ACEngSvr.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ASUS) C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(UASSOFT.COM) C:\Program Files\Multimedia Mouse Driver\V5\StartAutorun.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(UASSOFT.COM) C:\Program Files\Multimedia Mouse Driver\V5\KMConfig.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(UASSOFT.COM) C:\Program Files\Multimedia Mouse Driver\V5\KMProcess.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dropbox, Inc.) C:\Users\EF2004\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AVM Berlin) C:\Users\EF2004\AppData\Local\Apps\2.0\B2ZQRM6P.M95\ZLPKQXZQ.884\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Nero AG) C:\Program Files\Nero\Update\NASvc.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1549608 2009-08-17] (Synaptics Incorporated)
HKLM\...\Run: [ATKOSD2] - C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe [6859392 2009-08-17] (ASUS)
HKLM\...\Run: [HControlUser] - C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [13605408 2009-01-30] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] - C:\Windows\system32\NvMcTray.dll [92704 2009-01-30] (NVIDIA Corporation)
HKLM\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [527312 2012-01-13] (Cisco Systems, Inc.)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1425208 2012-09-20] (Logitech, Inc.)
HKLM\...\Run: [KMConfig] - C:\Program Files\Multimedia Mouse Driver\V5\StartAutorun.exe [212992 2007-03-06] (UASSOFT.COM)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1601488 2013-08-23] (APN)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-23] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [719672 2012-01-20] (Microsoft Corporation)
HKCU\...\Run: [Facebook Update] - C:\Users\EF2004\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [17418928 2012-07-13] (Skype Technologies S.A.)
HKCU\...\Run: [AVMUSBFernanschluss] - C:\Users\EF2004\AppData\Local\Apps\2.0\B2ZQRM6P.M95\ZLPKQXZQ.884\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\AVMAutoStart.exe [139264 2013-01-03] (AVM Berlin)
MountPoints2: {40d7c9a8-cc7c-11e1-b4cd-002243c160bc} - H:\AutoRun.exe
MountPoints2: {40d7c9b3-cc7c-11e1-b4cd-002243c160bc} - H:\AutoRun.exe
MountPoints2: {47c34a24-ad92-11e1-b156-002243c160bc} - I:\SETUP.EXE
MountPoints2: {497342be-c671-11e1-b3e2-002243c160bc} - F:\sources\sperr32.exe x64
MountPoints2: {ccff065a-afcc-11e1-9b1b-002243c160bc} - F:\AutoRun.exe
MountPoints2: {ccff0668-afcc-11e1-9b1b-002243c160bc} - F:\AutoRun.exe
Startup: C:\Users\EF2004\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\EF2004\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKCU - {5F8079B2-1267-4BB6-ABFB-5C9C0F39EA5E} URL = hxxp://asksearch.ask.com/redirect?client=ie&src=kw&tb=MYC3&itbv=11.7.1.1197&o=APN10457&locale=de_DE&apn_uid=80EC3F9C-416F-42BB-86F6-D182F92DD268&apn_ptnrs=^AKH&apn_dtid=^YYYYYY^YY^DE&apn_dbr=ff_19.0&doi=2013-03-15&q={searchTerms}&
BHO: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: Ask Toolbar - {4D594333-0076-A76A-76A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\MYC3\Passport.dll (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Ask Toolbar - {4D594333-0076-A76A-76A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\MYC3\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU -No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU -Ask Toolbar - {4D594333-0076-A76A-76A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\MYC3\Passport.dll (APN LLC.)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 48 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{AE1388E0-27A9-4509-84B4-334DD504E6B5}: [NameServer]212.23.115.148 212.23.97.2

FireFox:
========
FF ProfilePath: C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default
FF user.js: detected! => C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default\user.js
FF SelectedSearchEngine: Wikipedia (de)
FF NetworkProxy: "http", "91.228.53.28"
FF NetworkProxy: "http_port", 7808
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\EF2004\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default\searchplugins\delta.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF Extension: toolbar_AVIRA-V7 - C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: toolbar_MYC3 - C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default\Extensions\toolbar_MYC3@apn.ask.com.xpi
FF Extension: YoutubeDownloader - C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default\Extensions\YoutubeDownloader@PeterOlayev.com.xpi
FF Extension: No Name - C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
FF Extension: No Name - C:\Users\EF2004\AppData\Roaming\Mozilla\Firefox\Profiles\rlrjzyoe.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-23] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-08-23] (APN LLC.)
R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [84536 2009-06-15] (ASUS)
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] ()
S2 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2002-04-12] (brother Industries Ltd)
S3 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [130976 2011-03-01] (Futuremark Corporation)
R2 Janad; C:\Program Files\Jana2\Janad.exe [1313280 2011-08-24] (Thomas Hauck, Privat)
R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [687400 2011-11-25] (Nero AG)
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [476112 2012-01-13] (Cisco Systems, Inc.)

==================== Drivers (Whitelisted) ====================

S3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [87976 2012-01-13] (Cisco Systems, Inc.)
R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [26032 2013-06-02] (Wondershare)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-08-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-08-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-23] (Avira Operations GmbH & Co. KG)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [101248 2012-08-09] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [105728 2013-01-03] (AVM Berlin)
S3 BTHprint; C:\Windows\System32\DRIVERS\bthprint.sys [50688 2009-07-14] (Microsoft Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-07-05] (DT Soft Ltd)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [34432 2012-10-11] (ManyCam LLC)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv.sys [22656 2013-01-31] (ManyCam LLC)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [14392 2009-05-13] (ASUS)
R2 SGDrv; C:\Windows\System32\DRIVERS\SGdrv.sys [6144 2011-04-12] (Phoenix Technologies Ltd.)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-23] (Avira GmbH)
S3 athr; system32\DRIVERS\athr.sys [x]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x32.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-23 23:06 - 2013-08-23 23:06 - 01070467 _____ (Farbar) C:\Users\EF2004\Desktop\FRST.exe
2013-08-23 23:05 - 2013-08-23 23:05 - 00000544 _____ C:\Users\EF2004\Desktop\defogger_disable.log
2013-08-23 23:05 - 2013-08-23 23:05 - 00000156 _____ C:\Users\EF2004\defogger_reenable
2013-08-23 23:04 - 2013-08-23 23:04 - 00050477 _____ C:\Users\EF2004\Desktop\Defogger.exe
2013-08-23 21:00 - 2013-08-23 21:00 - 00072210 _____ C:\Users\EF2004\Desktop\Extras.Txt
2013-08-23 20:59 - 2013-08-23 20:59 - 00093420 _____ C:\Users\EF2004\Desktop\OTL.Txt
2013-08-23 20:47 - 2013-08-23 20:47 - 00602112 _____ (OldTimer Tools) C:\Users\EF2004\Desktop\OTL.exe
2013-08-23 18:04 - 2013-08-23 18:04 - 00001998 _____ C:\Users\EF2004\Desktop\Avira Free Antivirus Profil Lokale Festplatten.LNK
2013-08-23 18:02 - 2013-08-23 18:02 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-23 18:02 - 2013-08-23 18:02 - 00000000 ____D C:\Users\EF2004\AppData\Roaming\Avira
2013-08-23 18:01 - 2013-08-23 18:01 - 00001900 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-23 18:01 - 2013-06-06 22:41 - 00489392 _____ (Ask Partner Network) C:\Users\EF2004\Documents\APNSetup.exe
2013-08-23 18:00 - 2013-08-23 17:54 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-23 18:00 - 2013-08-23 17:54 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-23 18:00 - 2013-08-23 17:54 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-23 18:00 - 2013-08-23 17:54 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-08-23 17:59 - 2013-08-23 17:59 - 00000000 ____D C:\Program Files\Avira
2013-08-17 10:55 - 2013-08-17 10:55 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-16 07:41 - 2013-08-16 07:41 - 00148344 _____ C:\Windows\Minidump\081613-19422-01.dmp
2013-08-15 21:02 - 2013-08-16 21:28 - 00000000 ____D C:\Users\EF2004\Desktop\Beach Bar
2013-08-15 10:52 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 10:52 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 10:52 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 10:52 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 10:52 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 10:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 10:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 10:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 10:52 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 10:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 10:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 10:52 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 10:52 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 10:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 10:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 10:52 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 10:43 - 2013-08-15 10:43 - 00144216 _____ C:\Windows\Minidump\081513-19734-01.dmp
2013-08-14 15:44 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 15:44 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 15:44 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 15:44 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 15:44 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 15:44 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 15:44 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 15:44 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 15:44 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 15:44 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 15:44 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 15:44 - 2013-06-15 05:40 - 00918528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-08-14 15:44 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 20:22 - 2013-08-15 10:51 - 00000000 ____D C:\Users\EF2004\Desktop\Urlaub 2013
2013-08-13 11:56 - 2013-08-13 12:46 - 00000000 ____D C:\Users\EF2004\Desktop\juist
2013-08-13 11:55 - 2013-08-13 11:55 - 11680680 _____ C:\Users\EF2004\Downloads\IMAG0447.zip
2013-08-11 22:44 - 2013-08-11 22:44 - 00148344 _____ C:\Windows\Minidump\081113-23478-01.dmp
2013-08-09 22:02 - 2013-08-09 22:16 - 00000213 _____ C:\Users\EF2004\.swfinfo
2013-08-09 22:02 - 2013-08-09 22:02 - 00000000 ____D C:\Users\EF2004\Documents\Video Download Capture
2013-08-08 20:41 - 2013-08-08 20:41 - 00001238 _____ C:\Users\Public\Desktop\Video Download Capture.lnk
2013-08-08 20:40 - 2013-08-08 20:40 - 00000000 ____D C:\Users\EF2004\AppData\Roaming\Apowersoft
2013-08-08 20:40 - 2013-08-08 20:40 - 00000000 ____D C:\Program Files\Apowersoft
2013-08-08 20:40 - 2013-06-02 04:56 - 00026032 _____ (Wondershare) C:\Windows\system32\Drivers\Apowersoft_AudioDevice.sys
2013-08-08 20:40 - 2013-06-01 20:07 - 00443568 ____H (Bytescout) C:\Windows\system32\ApowersoftScreenCapturing.dll
2013-08-08 20:40 - 2013-06-01 20:07 - 00271536 ____H (Bytescout) C:\Windows\system32\ApowersoftScreenCapturingFilter.dll
2013-08-08 20:40 - 2013-06-01 20:07 - 00181424 ____H (Bytescout) C:\Windows\system32\ApowersoftVideoMixerFilter.dll
2013-08-08 20:39 - 2013-08-08 20:40 - 23425512 _____ (Apowersoft                                                  ) C:\Users\EF2004\Desktop\video-download-capture.exe
2013-08-06 14:39 - 2013-08-08 17:32 - 00000000 ____D C:\Users\EF2004\Desktop\Gardasee 2013
2013-08-04 10:03 - 2013-08-04 10:03 - 00144216 _____ C:\Windows\Minidump\080413-26239-01.dmp
2013-07-28 17:08 - 2013-08-01 13:47 - 00010652 _____ C:\Users\EF2004\Desktop\Segelflug-Kosten.xlsx
2013-07-28 17:08 - 2013-07-28 17:08 - 00000165 ____H C:\Users\EF2004\Desktop\~$Segelflug-Kosten.xlsx

==================== One Month Modified Files and Folders =======

2013-08-23 23:06 - 2013-08-23 23:06 - 01070467 _____ (Farbar) C:\Users\EF2004\Desktop\FRST.exe
2013-08-23 23:05 - 2013-08-23 23:05 - 00000544 _____ C:\Users\EF2004\Desktop\defogger_disable.log
2013-08-23 23:05 - 2013-08-23 23:05 - 00000156 _____ C:\Users\EF2004\defogger_reenable
2013-08-23 23:05 - 2012-07-21 19:48 - 00000000 ____D C:\Users\EF2004\AppData\Roaming\Skype
2013-08-23 23:05 - 2012-06-03 16:33 - 00000000 ____D C:\Users\EF2004
2013-08-23 23:04 - 2013-08-23 23:04 - 00050477 _____ C:\Users\EF2004\Desktop\Defogger.exe
2013-08-23 22:59 - 2012-06-25 22:49 - 00001142 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3358260750-2625543426-292112019-1000UA.job
2013-08-23 22:59 - 2012-06-25 22:49 - 00001120 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3358260750-2625543426-292112019-1000Core.job
2013-08-23 22:59 - 2012-06-23 14:27 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-23 22:31 - 2012-12-23 18:47 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-23 21:14 - 2012-06-03 16:33 - 01228483 _____ C:\Windows\WindowsUpdate.log
2013-08-23 21:00 - 2013-08-23 21:00 - 00072210 _____ C:\Users\EF2004\Desktop\Extras.Txt
2013-08-23 20:59 - 2013-08-23 20:59 - 00093420 _____ C:\Users\EF2004\Desktop\OTL.Txt
2013-08-23 20:47 - 2013-08-23 20:47 - 00602112 _____ (OldTimer Tools) C:\Users\EF2004\Desktop\OTL.exe
2013-08-23 19:31 - 2012-12-05 19:36 - 00000000 ____D C:\Users\EF2004\AppData\Roaming\Dropbox
2013-08-23 18:06 - 2009-07-14 06:34 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-23 18:06 - 2009-07-14 06:34 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-23 18:04 - 2013-08-23 18:04 - 00001998 _____ C:\Users\EF2004\Desktop\Avira Free Antivirus Profil Lokale Festplatten.LNK
2013-08-23 18:02 - 2013-08-23 18:02 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-23 18:02 - 2013-08-23 18:02 - 00000000 ____D C:\Users\EF2004\AppData\Roaming\Avira
2013-08-23 18:01 - 2013-08-23 18:01 - 00001900 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-23 17:59 - 2013-08-23 17:59 - 00000000 ____D C:\Program Files\Avira
2013-08-23 17:59 - 2012-12-05 19:39 - 00000000 ___RD C:\Users\EF2004\Desktop\Dropbox
2013-08-23 17:59 - 2012-06-03 20:18 - 00000000 ____D C:\ProgramData\Avira
2013-08-23 17:58 - 2012-06-23 14:27 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-23 17:58 - 2012-06-03 16:55 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-23 17:58 - 2012-06-03 16:51 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-08-23 17:58 - 2012-05-09 15:09 - 00039643 _____ C:\Windows\setupact.log
2013-08-23 17:58 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-23 17:57 - 2012-11-04 12:23 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-23 17:57 - 2010-11-20 23:48 - 00163156 _____ C:\Windows\PFRO.log
2013-08-23 17:54 - 2013-08-23 18:00 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-23 17:54 - 2013-08-23 18:00 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-23 17:54 - 2013-08-23 18:00 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-23 17:54 - 2013-08-23 18:00 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-08-20 20:31 - 2012-06-03 18:43 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-20 20:31 - 2012-06-03 18:43 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-08-19 17:28 - 2012-06-17 22:12 - 00005194 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-17 10:55 - 2013-08-17 10:55 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 09:59 - 2012-06-07 19:50 - 766870572 _____ C:\Windows\MEMORY.DMP
2013-08-16 21:28 - 2013-08-15 21:02 - 00000000 ____D C:\Users\EF2004\Desktop\Beach Bar
2013-08-16 08:09 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-16 07:41 - 2013-08-16 07:41 - 00148344 _____ C:\Windows\Minidump\081613-19422-01.dmp
2013-08-16 07:41 - 2012-06-07 19:51 - 00000000 ____D C:\Windows\Minidump
2013-08-15 12:04 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-08-15 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-15 10:51 - 2013-08-13 20:22 - 00000000 ____D C:\Users\EF2004\Desktop\Urlaub 2013
2013-08-15 10:43 - 2013-08-15 10:43 - 00144216 _____ C:\Windows\Minidump\081513-19734-01.dmp
2013-08-13 12:46 - 2013-08-13 11:56 - 00000000 ____D C:\Users\EF2004\Desktop\juist
2013-08-13 11:55 - 2013-08-13 11:55 - 11680680 _____ C:\Users\EF2004\Downloads\IMAG0447.zip
2013-08-11 22:44 - 2013-08-11 22:44 - 00148344 _____ C:\Windows\Minidump\081113-23478-01.dmp
2013-08-09 23:17 - 2012-08-16 21:50 - 00000000 ____D C:\Users\EF2004\AppData\Roaming\vlc
2013-08-09 22:16 - 2013-08-09 22:02 - 00000213 _____ C:\Users\EF2004\.swfinfo
2013-08-09 22:02 - 2013-08-09 22:02 - 00000000 ____D C:\Users\EF2004\Documents\Video Download Capture
2013-08-08 20:41 - 2013-08-08 20:41 - 00001238 _____ C:\Users\Public\Desktop\Video Download Capture.lnk
2013-08-08 20:40 - 2013-08-08 20:40 - 00000000 ____D C:\Users\EF2004\AppData\Roaming\Apowersoft
2013-08-08 20:40 - 2013-08-08 20:40 - 00000000 ____D C:\Program Files\Apowersoft
2013-08-08 20:40 - 2013-08-08 20:39 - 23425512 _____ (Apowersoft                                                  ) C:\Users\EF2004\Desktop\video-download-capture.exe
2013-08-08 20:36 - 2012-06-03 23:14 - 00000000 ____D C:\Program Files\JDownloader
2013-08-08 17:32 - 2013-08-06 14:39 - 00000000 ____D C:\Users\EF2004\Desktop\Gardasee 2013
2013-08-06 18:56 - 2012-07-21 19:47 - 00000000 ____D C:\ProgramData\Skype
2013-08-04 16:24 - 2012-06-03 20:00 - 00000000 ____D C:\Users\EF2004\Documents\Comdirect
2013-08-04 10:03 - 2013-08-04 10:03 - 00144216 _____ C:\Windows\Minidump\080413-26239-01.dmp
2013-08-03 10:12 - 2012-06-23 14:27 - 00000000 ____D C:\Program Files\Google
2013-08-01 13:47 - 2013-07-28 17:08 - 00010652 _____ C:\Users\EF2004\Desktop\Segelflug-Kosten.xlsx
2013-07-28 17:08 - 2013-07-28 17:08 - 00000165 ____H C:\Users\EF2004\Desktop\~$Segelflug-Kosten.xlsx
2013-07-26 05:13 - 2013-08-15 10:52 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 05:13 - 2013-08-15 10:52 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 05:13 - 2013-08-15 10:52 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 05:12 - 2013-08-15 10:52 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 05:12 - 2013-08-15 10:52 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 05:12 - 2013-08-15 10:52 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 05:12 - 2013-08-15 10:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 05:12 - 2013-08-15 10:52 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 05:12 - 2013-08-15 10:52 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 05:12 - 2013-08-15 10:52 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 05:12 - 2013-08-15 10:52 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 05:12 - 2013-08-15 10:52 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 05:11 - 2013-08-15 10:52 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 05:11 - 2013-08-15 10:52 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 04:49 - 2013-08-15 10:52 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 03:59 - 2013-08-15 10:52 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-25 10:57 - 2013-08-14 15:44 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-22 18:06

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Additional

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-08-2013 01
Ran by EF2004 at 2013-08-23 23:08:29
Running from C:\Users\EF2004\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

3DMark06 (Version: 1.2.0)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)
A-PDF Number freeware 1.3
Apple Application Support (Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (Version: 2.1.3.127)
Ask Toolbar (Version: 12.3.0.959)
ASUS LifeFrame3 (Version: 3.0.20)
ASUS Splendid Video Enhancement Technology (Version: 1.02.0028)
ATK Generic Function Service (Version: 1.00.0008)
ATK Hotkey (Version: 1.0.0053)
ATKOSD2 (Version: 7.0.0006)
AuthenTec TrueSuite (Version: 2.0.0.57)
Avira Free Antivirus (Version: 13.0.0.3885)
Avira SearchFree Toolbar plus Web Protection (Version: 12.2.2.663)
Bonjour (Version: 3.0.0.10)
Brother Driver Deployment Wizard (Version: 1.09.000)
Canon MX320 series MP Drivers
Cisco AnyConnect Secure Mobility Client  (Version: 3.0.5080)
Cisco AnyConnect Secure Mobility Client (Version: 3.0.5080)
CodeBlocks (HKCU Version: 10.05)
DAEMON Tools Lite (Version: 4.45.4.0315)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dropbox (HKCU Version: 2.0.22)
EVEREST Corporate Edition v5.30 (Version: 5.30)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
FastStone Capture 7.3 (Version: 7.3)
Free Video Flip and Rotate version 2.1.7.430 (Version: 2.1.7.430)
FRITZ!Box USB-Fernanschluss (HKCU Version: 2.3.0.2)
Futuremark SystemInfo (Version: 4.0.0.0)
GeoGebra (Version: 4.0.41.0)
Google Earth Plug-in (Version: 7.1.1.1888)
Google Update Helper (Version: 1.3.21.153)
HP Officejet 6700 - Grundlegende Software für das Gerät (Version: 25.0.619.0)
iCloud (Version: 2.1.1.3)
identPDF Seitennummerierung Version 1.5 (Version: 1.5)
ipswDownloader 1.6 (Version: 1.6)
iTunes (Version: 11.0.1.12)
Jana Server 2.5.1.189 (Version: 2.5.1.189)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
JavaFX 2.1.0 (Version: 2.1.0)
JDownloader 0.9 (Version: 0.9)
KENWOOD Music Editor Light (Version: 1.0.1)
Langenscheidt Vokabeltrainer 6.0 Englisch (Version: 6.0.0)
LTspice IV
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Mathematics (Version: 4.0)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mobile Partner (Version: 16.001.06.03.52)
Mozilla Firefox 23.0.1 (x86 de) (Version: 23.0.1)
Mozilla Maintenance Service (Version: 23.0.1)
Multimedia Mouse Driver (Version: 2.0)
Nero Burning ROM 11 (Version: 11.2.00400)
Nero Burning ROM 11 (Version: 11.2.10300.0.0)
Nero Burning ROM 11 Help (CHM) (Version: 11.0.10300)
Nero ControlCenter 11 (Version: 11.0.12700.0.27)
Nero ControlCenter 11 Help (CHM) (Version: 11.0.10300)
Nero Core Components 11 (Version: 11.0.16300.1.23)
Nero RescueAgent 11 (Version: 4.0.10600.10.100)
Nero RescueAgent 11 Help (CHM) (Version: 11.0.10400)
Nero Update (Version: 11.0.11500.28.0)
nero.prerequisites.msi (Version: 11.0.20010)
NVIDIA 3D Vision Treiber 295.73 (Version: 295.73)
NVIDIA Drivers (Version: 1.3)
NVIDIA Grafiktreiber 270.61 (Version: 270.61)
NVIDIA HD-Audiotreiber 1.3.12.0 (Version: 1.3.12.0)
NVIDIA Install Application (Version: 2.1002.75.420)
NVIDIA PhysX (Version: 9.12.0213)
NVIDIA PhysX-Systemsoftware 9.12.0213 (Version: 9.12.0213)
NVIDIA Stereoscopic 3D Driver (Version: 7.17.12.9573)
NVIDIA Systemsteuerung 270.61 (Version: 270.61)
OpenAL
PCMark 7 (Version: 1.0.4)
PDFCreator (Version: 1.4.3)
plist Editor for Windows 1.0.2 (Version: 1.0.2)
Secure Download Manager (Version: 3.1.0)
Skype™ 5.10 (Version: 5.10.116)
SUPER © v2012.build.51 (April 7, 2012) Version v2012.build.51 (Version: v2012.build.51)
Synaptics Pointing Device Driver (Version: 14.0.1.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
Video Download Capture V4.5.5 (Version: 4.5.5)
VLC media player 2.0.3 (Version: 2.0.3)
WinAVR 20100110 (remove only) (Version: 20100110)
Windows 7 USB/DVD Download Tool (Version: 1.0.30)
WinRAR 4.11 (32-Bit) (Version: 4.11.0)
WinSCP 5.1.3 (Version: 5.1.3)
Wireless Console 2 (Version: 2.0.10)
 

==================== Restore Points  =========================

16-08-2013 05:46:17 Windows Update
20-08-2013 15:33:18 Windows Update
23-08-2013 16:04:33 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2013-02-03 19:17 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {09F5D54E-AAB2-44C2-952A-6FE5BB8AC9F1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-23] (Google Inc.)
Task: {0D56C78C-3C48-43C2-BB13-033FB421D813} - System32\Tasks\{55113D35-B6F8-4CC5-9C38-D91741D17E10} => c:\program files\mozilla firefox\firefox.exe [2013-08-17] (Mozilla Corporation)
Task: {21ECBB7D-A6A4-460F-BD2D-ABB97CDA39B9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {22B72D39-A5E6-402A-A432-B5EA8C5E9A32} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {39E8B40A-7092-4DC2-B0EA-0555FF7A29A6} - System32\Tasks\{7DD894A5-3420-46CC-A8E1-E35D006886A9} => c:\program files\mozilla firefox\firefox.exe [2013-08-17] (Mozilla Corporation)
Task: {68129B12-F228-4D04-9D2A-9E7C71356EF6} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3358260750-2625543426-292112019-1000Core => C:\Users\EF2004\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.)
Task: {6CADF7F7-C952-42D7-B8A9-AFAD688AD6FA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-06-23] (Google Inc.)
Task: {9E18E2E2-A581-4052-881D-F593D3034B27} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-20] (Adobe Systems Incorporated)
Task: {9F200654-5A54-4551-9012-59F78519D30E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3358260750-2625543426-292112019-1000UA => C:\Users\EF2004\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.)
Task: {A0B43F23-1FE7-4F6D-97F4-1234EB6CA357} - System32\Tasks\ACMON => C:\Program Files\ASUS\Splendid\ACMON.exe [2009-07-23] (ATK)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3358260750-2625543426-292112019-1000Core.job => C:\Users\EF2004\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3358260750-2625543426-292112019-1000UA.job => C:\Users\EF2004\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/23/2013 08:50:30 PM) (Source: Application Hang) (User: )
Description: Programm OTL.exe, Version 3.2.69.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1504

Startzeit: 01cea0313a1abb9e

Endzeit: 0

Anwendungspfad: C:\Users\EF2004\Desktop\OTL.exe

Berichts-ID:

Error: (08/23/2013 06:00:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/22/2013 08:49:38 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2449

Error: (08/22/2013 08:49:38 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2449

Error: (08/22/2013 08:49:38 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/22/2013 08:49:37 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1404

Error: (08/22/2013 08:49:37 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1404

Error: (08/22/2013 08:49:37 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/22/2013 06:27:29 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3323

Error: (08/22/2013 06:27:29 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3323


System errors:
=============
Error: (08/23/2013 08:44:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrSplService" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (08/23/2013 05:56:52 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (08/21/2013 05:17:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%109

Error: (08/21/2013 05:17:52 PM) (Source: DCOM) (User: )
Description: 109gupdate/comsvc{4EB61BAC-A3B6-4760-9581-655041EF4D69}

Error: (08/18/2013 09:51:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrSplService" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (08/17/2013 11:54:54 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎17.‎08.‎2013 um 21:22:30 unerwartet heruntergefahren.

Error: (08/17/2013 10:06:51 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (08/17/2013 10:00:51 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎16.‎08.‎2013 um 23:27:15 unerwartet heruntergefahren.

Error: (08/16/2013 08:25:28 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrSplService" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (08/16/2013 07:41:38 AM) (Source: BugCheck) (User: )
Description: 0x0000007e (0xc0000005, 0x9413615f, 0xd2cb095c, 0xd2cb0540)C:\Windows\MEMORY.DMP081613-19422-01


Microsoft Office Sessions:
=========================
Error: (08/23/2013 08:50:30 PM) (Source: Application Hang)(User: )
Description: OTL.exe3.2.69.0150401cea0313a1abb9e0C:\Users\EF2004\Desktop\OTL.exe

Error: (08/23/2013 06:00:26 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/22/2013 08:49:38 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2449

Error: (08/22/2013 08:49:38 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2449

Error: (08/22/2013 08:49:38 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/22/2013 08:49:37 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1404

Error: (08/22/2013 08:49:37 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1404

Error: (08/22/2013 08:49:37 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/22/2013 06:27:29 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3323

Error: (08/22/2013 06:27:29 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3323


==================== Memory info =========================== 

Percentage of memory in use: 54%
Total physical RAM: 3071.11 MB
Available physical RAM: 1396.6 MB
Total Pagefile: 6140.52 MB
Available Pagefile: 4141.87 MB
Total Virtual: 2047.88 MB
Available Virtual: 1880.6 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:146.39 GB) (Free:36.05 GB) NTFS
Drive d: () (Fixed) (Total:449.69 GB) (Free:46.95 GB) NTFS
Drive f: (GSP1RMCPRXFRER_DE_DVD) (CDROM) (Total:3.04 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 86B92E1E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=146 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Hallo,

reiche bitte auch noch die Addition.txt nach, die FRST erstellt hat.
Und mach noch den Gmer-Scan wie in der Anleitung beschrieben.
Hänge die Logfiles bitte nicht an (das erschwert mir das Auswerten massiv), sondern füge deren Inhalt direkt innerhalb von Codetags ein: [code]Inhalt Logfile[/code]. (Anleitung))

So oben hab ich jetzt die Addition nachgereicht und hier noch die gmer.txt

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-23 23:45:18
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HM641JI rev.2AJ10001 596,17GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\EF2004\AppData\Local\Temp\ufpcqpog.sys


---- System - GMER 2.1 ----

SSDT            8CF67F2E                                                                           ZwCreateSection
SSDT            8CF67F38                                                                           ZwRequestWaitReplyPort
SSDT            8CF67F33                                                                           ZwSetContextThread
SSDT            8CF67F3D                                                                           ZwSetSecurityObject
SSDT            8CF67F42                                                                           ZwSystemDebugControl
SSDT            8CF67ECF                                                                           ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                           82E4FA15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                             82E89212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                82E9058C 4 Bytes  [2E, 7F, F6, 8C]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                82E908E8 4 Bytes  [38, 7F, F6, 8C]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                82E9092C 4 Bytes  [33, 7F, F6, 8C]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                82E909A8 4 Bytes  [3D, 7F, F6, 8C]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                82E909FC 4 Bytes  [42, 7F, F6, 8C]
.text           ...                                                                                
.text           C:\Windows\system32\DRIVERS\nvlddmkm.sys                                           section is writeable [0x9340D340, 0x3EE1D7, 0xE8000020]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                            Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                            Wdf01000.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations  ???ha???? ???????g???????????g?1??????????????????????????????????????b????????g???????????g????? ???????g?????g???????1????????????????????*pnp0c09???????????????????????g????? ???????g?????g???????1????????????????????? ???????g???????????g?1????????????????????? ???????g?????g???????1?????????????????????????g???8???????g?grn???????g???????????g?g?g???g?g?????????g??????????NO_DRV?????????g????MBRES????g?g???????g?????g?g????machine.inf??????????f???????????????g??????????????? ???????f???????????????????????????????2??? ???????g???????????g?1????????x???????????? ???????g???????????g?1?????????????????????????????9???????g?grn???g?gS???? ???????g?????g???????1????????????????????? ???????g???????????g?1?????????????????????????g???????????????h??*pnp0c0e????? ?????????????g????????????????x??????????3? ???????j???0??????????????? ???????g?????g???????1????????????????????{4d36e97d-e325-11ce-bfc1-08002be10318}??????@oem3.inf,%synmfg%;Synaptics?t???????????7??machine.inf:GENDEV_SYS.NTx86:NO_DRV:6.1.7601.17

---- EOF - GMER 2.1 ----
         

Hast du den Proxyserver im Firefox gesetzt?

FF NetworkProxy: "http", "91.228.53.28"
         

Ansonsten sieht das unauffällig aus. Wir machen noch eine Kontrolle.
Gibt es noch weitere Rechner, die den von der Telekom erwähnten Internetanschluss nutzen?


Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Vielen Dank für die super Hilfe.

Denn Scan führe ich gerade aus, eine Frage hätte ich noch, ich bekomme desöfteren mails, wo ich eigentlich weiß, dass der Anhang infiziert ist. Den Anhang öffne ich natürlich nicht, und die Mail verschiebe ich erstmal in den Papierkorb ohne sie komplett zu löschen. Kann ein Trojaner vom Papierkorb in dieser Mail aktiv werden?

Ich hatte mal für den Firefox so ein Proxy Add-on um bestimme youtube Videos schauen zu können, der hat diese IP verwendet. Kann es sein, dass der Brief der Telekom aufgrund der Verwendung des Proxyservers kommt?

So jetzt ist der Scan durch

hier die Log Datei

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.24.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16660
EF2004 :: EF2004-NOTEBOOK [Administrator]

24.08.2013 09:09:27
MBAM-log-2013-08-24 (09-19-09).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 216305
Laufzeit: 9 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr) -> Keine Aktion durchgeführt.
HKCU\Software\DataMngr (PUP.Optional.DataMngr) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\EF2004\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.

Infizierte Dateien: 5
C:\Users\EF2004\AppData\Local\Temp\is1070216317\MyBabylonTB.exe (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.
C:\Users\EF2004\AppData\Local\Temp\4EA0BC3A-BAB0-7891-92A5-44BFC1965EAB\MyBabylonTB.exe (PUP.Optional.Delta) -> Keine Aktion durchgeführt.
C:\Users\EF2004\AppData\Local\Temp\4EA0BC3A-BAB0-7891-92A5-44BFC1965EAB\Setup.exe (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.
C:\Users\EF2004\Downloads\DTLite4454-0315.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.
C:\Users\EF2004\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.

(Ende)
         

Hallo,

Kann ein Trojaner vom Papierkorb in dieser Mail aktiv werden?

Nein.

Kann es sein, dass der Brief der Telekom aufgrund der Verwendung des Proxyservers kommt?

Das kann ich mir eigentlich nicht vorstellen..

Gibt es noch weitere Rechner, die den von der Telekom erwähnten Internetanschluss nutzen?

Ja gibt es noch, aber von dem aus wird eigentlich nichts gemacht.

Würde es sich nach den unauffälligen Logfiles überhaupt sinn machen den pc neu aufzusetzen?

Die Telekom irrt sich auch manchmal.
Ich seh bis hierhin keinen Grund zur Annahme, dass dieser Rechner infiziert ist (aber auch ich kann mich irren).