Windows 7: Sicherheitscenter kann nicht aktiviert werden, Update funktioniert nicht mehr!

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:31 on 27/09/2013 (Stefan.Krämer)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013
Ran by Stefan.Krämer (administrator) on PC111 on 27-09-2013 15:32:20
Running from C:\Users\Stefan.Krämer\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
() C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(AMD) C:\Windows\system32\atieclxx.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
() C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_1_102_ActiveX.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12632168 2011-07-21] (Realtek Semiconductor)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-26] (CANON INC.)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1436736 2011-06-15] ()
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [Adobe Acrobat Synchronizer] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe [1272704 2013-09-03] (Adobe Systems Incorporated)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [eDial.exe] - C:\Program Files (x86)\Aastra\Office eDial\\eDial.exe [249392 2013-06-20] (Aastra Telecom Schweiz AG)
HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
MountPoints2: {fc692b9b-5230-11e1-8160-50e549e1b997} - E:\LaunchU3.exe -a
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-17] (InstallShield Software Corporation)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [4386336 2008-11-27] (Acronis)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [688128 2011-07-06] ()
HKLM-x32\...\Run: [CLX3180_Scan2Pc] - C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe [1990144 2011-04-29] ()
HKLM-x32\...\Run: [3180 Scan2PC] - C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe [1990144 2011-04-29] ()
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [155648 2012-02-06] (Apple Computer, Inc.)
HKU\Administrator\...\Run: [AdobeBridge] - [x]
HKU\Administrator\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe [247968 2012-02-10] (Adobe Systems, Inc.)
HKU\User\...\Run: [ISUSPM Startup] - C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [221184 2005-02-17] (InstallShield Software Corporation)
HKU\User\...\Run: [AdobeBridge] - [x]

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBD77D9DA5ED1CD01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU -  No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x64/MuCatalogWebControl.cab?1328263064448
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
ShellExecuteHooks-x32: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office12\GR469A~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
Winsock: Catalog5 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9 01 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 02 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 03 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 04 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 05 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 06 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 07 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 08 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 09 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9 10 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog5-x64 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9-x64 01 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 02 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 03 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 04 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 05 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 06 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 07 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 08 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 09 mswsock.dll File Not found (Microsoft Corporation)
Winsock: Catalog9-x64 10 mswsock.dll File Not found (Microsoft Corporation)
Hosts: 127.0.0.1	activate.adobe.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Stefan.Krämer\AppData\Roaming\Mozilla\Firefox\Profiles\e9t67xiw.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Stefan.Krämer\AppData\Roaming\Mozilla\Firefox\Profiles\e9t67xiw.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF StartMenuInternet: FIREFOX.EXE - C:\Users\User\firefox.exe

==================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 DES2 Service; C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [57344 2011-08-22] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 MsMpSvc; "C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe" [x]
S3 NisSrv; "C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe" [x]
U2 *etadpug; "C:\Program Files (x86)\Google\Desktop\Install\{23ff0886-cfc9-3a1c-3e9e-ef525c7945e8}\   \...\???\{23ff0886-cfc9-3a1c-3e9e-ef525c7945e8}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess)

==================== Drivers (Whitelisted) ====================

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21104 2011-01-10] ()
R2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-03-02] (Samsung Electronics Co., Ltd.)
R2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-03-02] (Samsung Electronics Co., Ltd.)
R3 gdrv; C:\Windows\gdrv.sys [25640 2013-09-27] (Windows (R) Server 2003 DDK provider)
R3 gdrv; C:\Windows\gdrv.sys [25640 2013-09-27] (Windows (R) Server 2003 DDK provider)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [189440 2011-04-18] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [84864 2011-04-27] (Microsoft Corporation)
R0 snapman380; C:\Windows\System32\DRIVERS\snman380.sys [237600 2012-01-31] (Acronis)
R0 tdrpman174; C:\Windows\System32\DRIVERS\tdrpm174.sys [1581088 2012-01-31] (Acronis)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-27 15:32 - 2013-09-27 15:32 - 00000000 ____D C:\FRST
2013-09-27 15:31 - 2013-09-27 15:31 - 00000488 _____ C:\Users\Stefan.Krämer\Desktop\defogger_disable.log
2013-09-27 15:31 - 2013-09-27 15:31 - 00000000 _____ C:\Users\Stefan.Krämer\defogger_reenable
2013-09-27 15:30 - 2013-09-27 15:29 - 01953854 _____ (Farbar) C:\Users\Stefan.Krämer\Desktop\FRST64.exe
2013-09-27 15:30 - 2013-09-27 15:29 - 00377856 _____ C:\Users\Stefan.Krämer\Desktop\gmer_2.1.19163.exe
2013-09-27 15:30 - 2013-09-27 15:28 - 00050477 _____ C:\Users\Stefan.Krämer\Desktop\Defogger.exe
2013-09-27 15:23 - 2013-09-27 15:23 - 00000000 ____D C:\Windows\TempB6D63AD4-421E-7030-CE95-F66433CED8BD-Signatures
2013-09-27 15:18 - 2013-09-27 15:18 - 00194638 _____ C:\Users\Administrator\AppData\Local\census.cache
2013-09-27 15:18 - 2013-09-27 15:18 - 00102938 _____ C:\Users\Administrator\AppData\Local\ars.cache
2013-09-27 15:05 - 2013-09-27 15:05 - 00000036 _____ C:\Users\Administrator\AppData\Local\housecall.guid.cache
2013-09-27 14:54 - 2013-09-27 14:54 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes
2013-09-27 12:16 - 2011-01-26 11:11 - 00005256 _____ C:\Users\Stefan.Krämer\Desktop\wscsvc.reg
2013-09-27 11:54 - 2013-09-27 11:54 - 00001161 _____ C:\Users\Stefan.Krämer\Desktop\wscsvc.zip
2013-09-27 11:54 - 2013-09-27 11:54 - 00000000 ____D C:\Users\Stefan.Krämer\Desktop\wscsvc
2013-09-27 11:50 - 2013-09-27 11:50 - 00000047 _____ C:\Users\Stefan.Krämer\AppData\Roaming\mbam.context.scan
2013-09-27 11:50 - 2013-09-27 11:38 - 00001150 _____ C:\Users\Stefan.Krämer\Desktop\wscsvc(64).zip
2013-09-27 09:55 - 2013-09-27 09:55 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Roaming\Malwarebytes
2013-09-27 09:55 - 2013-09-27 09:55 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-27 09:55 - 2013-09-27 09:55 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-27 09:55 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-26 20:14 - 2013-09-26 20:18 - 00000000 ____D C:\Users\Stefan.Krämer\Desktop\Spielplan Vicenti 2013
2013-09-26 18:43 - 2013-09-26 18:43 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2013-09-26 18:38 - 2013-09-26 18:38 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Local\Google
2013-09-26 18:38 - 2013-09-26 18:38 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-26 15:59 - 2013-09-26 13:21 - 00050688 _____ C:\Users\Stefan.Krämer\Desktop\Vicenti.wdb
2013-09-26 15:13 - 2013-09-26 15:19 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Roaming\U3
2013-09-25 19:38 - 2013-09-26 21:45 - 08639488 _____ C:\Users\Stefan.Krämer\Desktop\SPANIEN_Mappe VICENC 2013.qxp
2013-09-25 19:38 - 2012-10-15 12:03 - 04187136 _____ C:\Users\Stefan.Krämer\Desktop\SPANIEN_Mappe FRIENDSHIP 2013.qxp
2013-09-25 19:38 - 2012-10-04 00:05 - 04350976 _____ C:\Users\Stefan.Krämer\Desktop\SPANIEN_Mappe MALGRATENSE 2013.qxp
2013-09-24 17:30 - 2013-09-25 18:02 - 21311488 _____ C:\Users\Stefan.Krämer\Desktop\MAPPE_Bildungsreise 2013.indd
2013-09-24 17:05 - 2012-10-09 11:15 - 24485888 _____ C:\Users\Stefan.Krämer\Desktop\MAPPE_Bildungsreise 2012.indd
2013-09-20 17:12 - 2013-09-20 17:12 - 00000000 ____D C:\Program Files (x86)\Advanced IP Scanner v2
2013-09-19 10:56 - 2013-09-19 10:56 - 00000000 ____D C:\Users\User\updated
2013-09-06 12:03 - 2013-09-06 12:03 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Roaming\Apago
2013-09-06 12:03 - 2013-09-06 12:03 - 00000000 ____D C:\Program Files (x86)\Apago
2013-09-02 16:55 - 2013-09-02 16:55 - 4269171075 ____N C:\Users\Stefan.Krämer\Downloads\B-Jugend_Spiel gegen Leverkusen.zip
2013-08-31 13:01 - 2013-08-31 13:45 - 00011338 _____ C:\Users\Stefan.Krämer\gsview64.ini
2013-08-31 13:01 - 2013-08-31 13:01 - 00000000 ____D C:\Program Files\Ghostgum

==================== One Month Modified Files and Folders =======

2013-09-27 15:32 - 2013-09-27 15:32 - 00000000 ____D C:\FRST
2013-09-27 15:31 - 2013-09-27 15:31 - 00000488 _____ C:\Users\Stefan.Krämer\Desktop\defogger_disable.log
2013-09-27 15:31 - 2013-09-27 15:31 - 00000000 _____ C:\Users\Stefan.Krämer\defogger_reenable
2013-09-27 15:31 - 2012-02-03 15:29 - 00000000 ____D C:\Users\Stefan.Krämer
2013-09-27 15:29 - 2013-09-27 15:30 - 01953854 _____ (Farbar) C:\Users\Stefan.Krämer\Desktop\FRST64.exe
2013-09-27 15:29 - 2013-09-27 15:30 - 00377856 _____ C:\Users\Stefan.Krämer\Desktop\gmer_2.1.19163.exe
2013-09-27 15:28 - 2013-09-27 15:30 - 00050477 _____ C:\Users\Stefan.Krämer\Desktop\Defogger.exe
2013-09-27 15:28 - 2009-07-14 06:45 - 00020912 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-27 15:28 - 2009-07-14 06:45 - 00020912 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-27 15:23 - 2013-09-27 15:23 - 00000000 ____D C:\Windows\TempB6D63AD4-421E-7030-CE95-F66433CED8BD-Signatures
2013-09-27 15:23 - 2012-02-09 19:49 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-09-27 15:23 - 2012-02-09 14:11 - 00002113 _____ C:\Windows\epplauncher.mif
2013-09-27 15:21 - 2012-02-09 19:06 - 00052871 _____ C:\Windows\setupact.log
2013-09-27 15:21 - 2012-02-03 15:22 - 00000128 _____ C:\Windows\system32\config\netlogon.ftl
2013-09-27 15:21 - 2012-01-31 20:50 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2013-09-27 15:21 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-27 15:18 - 2013-09-27 15:18 - 00194638 _____ C:\Users\Administrator\AppData\Local\census.cache
2013-09-27 15:18 - 2013-09-27 15:18 - 00102938 _____ C:\Users\Administrator\AppData\Local\ars.cache
2013-09-27 15:05 - 2013-09-27 15:05 - 00000036 _____ C:\Users\Administrator\AppData\Local\housecall.guid.cache
2013-09-27 14:56 - 2012-01-31 20:18 - 01805300 _____ C:\Windows\WindowsUpdate.log
2013-09-27 14:56 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-27 14:54 - 2013-09-27 14:54 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes
2013-09-27 14:53 - 2012-02-03 15:26 - 00226456 _____ C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-27 11:54 - 2013-09-27 11:54 - 00001161 _____ C:\Users\Stefan.Krämer\Desktop\wscsvc.zip
2013-09-27 11:54 - 2013-09-27 11:54 - 00000000 ____D C:\Users\Stefan.Krämer\Desktop\wscsvc
2013-09-27 11:54 - 2009-07-14 19:58 - 00656028 _____ C:\Windows\system32\perfh007.dat
2013-09-27 11:54 - 2009-07-14 19:58 - 00130800 _____ C:\Windows\system32\perfc007.dat
2013-09-27 11:54 - 2009-07-14 07:13 - 01504670 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-27 11:50 - 2013-09-27 11:50 - 00000047 _____ C:\Users\Stefan.Krämer\AppData\Roaming\mbam.context.scan
2013-09-27 11:38 - 2013-09-27 11:50 - 00001150 _____ C:\Users\Stefan.Krämer\Desktop\wscsvc(64).zip
2013-09-27 11:16 - 2012-02-09 19:06 - 00071644 _____ C:\Windows\PFRO.log
2013-09-27 09:55 - 2013-09-27 09:55 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Roaming\Malwarebytes
2013-09-27 09:55 - 2013-09-27 09:55 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-27 09:55 - 2013-09-27 09:55 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 21:45 - 2013-09-25 19:38 - 08639488 _____ C:\Users\Stefan.Krämer\Desktop\SPANIEN_Mappe VICENC 2013.qxp
2013-09-26 20:18 - 2013-09-26 20:14 - 00000000 ____D C:\Users\Stefan.Krämer\Desktop\Spielplan Vicenti 2013
2013-09-26 20:17 - 2012-02-03 17:46 - 00000000 ____D C:\Eigene Dateien
2013-09-26 18:43 - 2013-09-26 18:43 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2013-09-26 18:43 - 2012-02-24 11:01 - 00000000 ____D C:\FreePDF_XP
2013-09-26 18:38 - 2013-09-26 18:38 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Local\Google
2013-09-26 18:38 - 2013-09-26 18:38 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-26 15:19 - 2013-09-26 15:13 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Roaming\U3
2013-09-26 14:18 - 2012-02-06 15:32 - 00007896 _____ C:\Users\Stefan.Krämer\AppData\Roaming\wklnhst.dat
2013-09-26 13:21 - 2013-09-26 15:59 - 00050688 _____ C:\Users\Stefan.Krämer\Desktop\Vicenti.wdb
2013-09-26 10:47 - 2013-07-31 14:55 - 00000000 ____D C:\Users\Stefan.Krämer\Desktop\Anmeldeformulare 2014
2013-09-25 18:02 - 2013-09-24 17:30 - 21311488 _____ C:\Users\Stefan.Krämer\Desktop\MAPPE_Bildungsreise 2013.indd
2013-09-20 17:31 - 2013-08-02 09:11 - 00000000 ____D C:\Users\Stefan.Krämer\Desktop\Preislisten 2014
2013-09-20 17:31 - 2013-01-11 12:43 - 00004922 _____ C:\Users\Stefan.Krämer\advanced_ip_scanner_MAC.bin
2013-09-20 17:12 - 2013-09-20 17:12 - 00000000 ____D C:\Program Files (x86)\Advanced IP Scanner v2
2013-09-19 11:13 - 2013-06-10 15:44 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Roaming\vlc
2013-09-19 10:58 - 2012-01-31 21:00 - 00000000 ____D C:\Users\User\uninstall
2013-09-19 10:57 - 2013-05-27 14:09 - 00000000 ____D C:\Users\User\browser
2013-09-19 10:57 - 2013-04-12 12:31 - 00027544 _____ (Mozilla Corporation) C:\Users\User\plugin-hang-ui.exe
2013-09-19 10:57 - 2012-12-06 11:07 - 00193824 _____ (Mozilla Corporation) C:\Users\User\maintenanceservice_installer.exe
2013-09-19 10:57 - 2012-12-06 11:07 - 00170232 _____ (Mozilla Corporation) C:\Users\User\webapp-uninstaller.exe
2013-09-19 10:57 - 2012-12-06 11:07 - 00118680 _____ (Mozilla Foundation) C:\Users\User\maintenanceservice.exe
2013-09-19 10:57 - 2012-12-06 11:07 - 00107416 _____ (Mozilla Foundation) C:\Users\User\webapprt-stub.exe
2013-09-19 10:57 - 2012-12-06 11:07 - 00074648 _____ (Mozilla Foundation) C:\Users\User\breakpadinjector.dll
2013-09-19 10:57 - 2012-12-06 11:07 - 00000000 ____D C:\Users\User\webapprt
2013-09-19 10:57 - 2012-03-25 19:07 - 03215256 _____ (Mozilla Foundation) C:\Users\User\gkmedias.dll
2013-09-19 10:57 - 2012-03-25 19:07 - 00128920 _____ (Mozilla Foundation) C:\Users\User\mozglue.dll
2013-09-19 10:57 - 2012-02-03 15:48 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Local\Mozilla
2013-09-19 10:57 - 2012-01-31 21:00 - 21527448 _____ (Mozilla Foundation) C:\Users\User\xul.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 07565921 _____ C:\Users\User\omni.ja
2013-09-19 10:57 - 2012-01-31 21:00 - 03279768 _____ C:\Users\User\mozjs.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 01775000 _____ (Mozilla Foundation) C:\Users\User\nss3.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00548760 _____ (Mozilla Foundation) C:\Users\User\libGLESv2.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00392600 _____ (Mozilla Foundation) C:\Users\User\nssckbi.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00301464 _____ (Mozilla Foundation) C:\Users\User\freebl3.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00273304 _____ (Mozilla Foundation) C:\Users\User\updater.exe
2013-09-19 10:57 - 2012-01-31 21:00 - 00152984 _____ (Mozilla Foundation) C:\Users\User\softokn3.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00116632 _____ (Mozilla Foundation) C:\Users\User\crashreporter.exe
2013-09-19 10:57 - 2012-01-31 21:00 - 00091544 _____ (Mozilla Foundation) C:\Users\User\nssdbm3.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00063384 _____ (Mozilla Foundation) C:\Users\User\libEGL.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00019352 _____ (Mozilla Foundation) C:\Users\User\AccessibleMarshal.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00017816 _____ (Mozilla Corporation) C:\Users\User\plugin-container.exe
2013-09-19 10:57 - 2012-01-31 21:00 - 00016280 _____ (Mozilla Foundation) C:\Users\User\mozalloc.dll
2013-09-19 10:57 - 2012-01-31 21:00 - 00001928 _____ C:\Users\User\precomplete
2013-09-19 10:57 - 2012-01-31 21:00 - 00000899 _____ C:\Users\User\softokn3.chk
2013-09-19 10:57 - 2012-01-31 21:00 - 00000899 _____ C:\Users\User\nssdbm3.chk
2013-09-19 10:57 - 2012-01-31 21:00 - 00000899 _____ C:\Users\User\freebl3.chk
2013-09-19 10:57 - 2012-01-31 21:00 - 00000633 _____ C:\Users\User\application.ini
2013-09-19 10:57 - 2012-01-31 21:00 - 00000140 _____ C:\Users\User\platform.ini
2013-09-19 10:56 - 2013-09-19 10:56 - 00000000 ____D C:\Users\User\updated
2013-09-16 17:55 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-13 17:53 - 2012-03-24 02:45 - 00000132 _____ C:\Users\Stefan.Krämer\AppData\Roaming\Adobe BMP Format CS5 Prefs
2013-09-12 10:58 - 2012-02-06 18:26 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\A.F.5 Rename your files 1.1
2013-09-12 10:58 - 2012-02-06 18:26 - 00000000 ____D C:\Program Files (x86)\A.F.5 Rename your files 1.1
2013-09-12 09:30 - 2012-04-17 09:18 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-12 09:30 - 2012-01-31 21:40 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-06 12:03 - 2013-09-06 12:03 - 00000000 ____D C:\Users\Stefan.Krämer\AppData\Roaming\Apago
2013-09-06 12:03 - 2013-09-06 12:03 - 00000000 ____D C:\Program Files (x86)\Apago
2013-09-05 02:00 - 2012-02-06 19:28 - 00000374 _____ C:\Windows\Tasks\Quark Updater.job
2013-09-02 16:55 - 2013-09-02 16:55 - 4269171075 ____N C:\Users\Stefan.Krämer\Downloads\B-Jugend_Spiel gegen Leverkusen.zip
2013-08-31 18:19 - 2013-07-05 08:44 - 00000000 ____D C:\Users\Stefan.Krämer\Desktop\Sommer 2013
2013-08-31 13:45 - 2013-08-31 13:01 - 00011338 _____ C:\Users\Stefan.Krämer\gsview64.ini
2013-08-31 13:01 - 2013-08-31 13:01 - 00000000 ____D C:\Program Files\Ghostgum

Files to move or delete:
====================
ZeroAccess:
C:\Users\Stefan.Krämer\AppData\Local\Google\Desktop\Install
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install
C:\Users\User\AccessibleMarshal.dll
C:\Users\User\breakpadinjector.dll
C:\Users\User\crashreporter.exe
C:\Users\User\D3DCompiler_43.dll
C:\Users\User\freebl3.dll
C:\Users\User\gkmedias.dll
C:\Users\User\libEGL.dll
C:\Users\User\libGLESv2.dll
C:\Users\User\maintenanceservice.exe
C:\Users\User\maintenanceservice_installer.exe
C:\Users\User\mozalloc.dll
C:\Users\User\mozglue.dll
C:\Users\User\mozjs.dll
C:\Users\User\msvcp100.dll
C:\Users\User\msvcr100.dll
C:\Users\User\nss3.dll
C:\Users\User\nssckbi.dll
C:\Users\User\nssdbm3.dll
C:\Users\User\plugin-container.exe
C:\Users\User\plugin-hang-ui.exe
C:\Users\User\softokn3.dll
C:\Users\User\updater.exe
C:\Users\User\webapp-uninstaller.exe
C:\Users\User\webapprt-stub.exe
C:\Users\User\xul.dll


Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\mpam-f3edf41c.exe
C:\Users\Stefan.Krämer\AppData\Local\Temp\AskSLib.dll
C:\Users\Stefan.Krämer\AppData\Local\Temp\conduitinstaller.exe
C:\Users\Stefan.Krämer\AppData\Local\Temp\ESDPK-PLX6-PagePlusStarterEdition_Setup.exe
C:\Users\Stefan.Krämer\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Stefan.Krämer\AppData\Local\Temp\IPx64_1031.exe
C:\Users\Stefan.Krämer\AppData\Local\Temp\ose00000.exe
C:\Users\Stefan.Krämer\AppData\Local\Temp\PriceGong.exe
C:\Users\Stefan.Krämer\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\Stefan.Krämer\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
C:\Program Files\Microsoft Security Client\Antimalware => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Microsoft Security Client


LastRegBack: 2013-09-23 13:41

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-09-2013
Ran by Stefan.Krämer at 2013-09-27 15:32:58
Running from C:\Users\Stefan.Krämer\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

@BIOS (x32 Version: 2.12)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
A.F.5 Rename your files 1.1 (x32 Version: 1.1.0.0)
Aastra 400 First-party TAPI Service Provider (x32 Version: 1.3.1)
ACDSee 8 (x32 Version: 8.0.41)
Acronis*True*Image*Home (x32 Version: 12.0.9646.4)
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.8)
Adobe AIR (x32 Version: 1.5.3.9120)
Adobe Community Help (x32 Version: 3.0.0)
Adobe Community Help (x32 Version: 3.0.0.400)
Adobe Creative Suite 5 Master Collection (x32 Version: 5.0)
Adobe Flash Player 11 ActiveX 64-bit (Version: 11.1.102.55)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Media Player (x32 Version: 1.8)
Advanced IP Scanner 2.3 (x32 Version: 2.3.2161)
AMD Accelerated Video Transcoding (Version: 2.00.0001)
AMD APP SDK Runtime (Version: 10.0.898.1)
AMD Catalyst Install Manager (Version: 3.0.868.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.70214.2220)
ATI AVIVO64 Codecs (Version: 11.6.0.10524)
Audacity 2.0.3 (x32 Version: 2.0.3)
Canon iP4900 series Printer Driver
Canon iP5200
Canon My Printer (x32)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2012.0214.2218.39913)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0214.2218.39913)
Catalyst Control Center InstallProxy (x32 Version: 2012.0214.2218.39913)
Catalyst Control Center Localization All (x32 Version: 2012.0214.2218.39913)
CCC Help Chinese Standard (x32 Version: 2012.0214.2217.39913)
CCC Help Chinese Traditional (x32 Version: 2012.0214.2217.39913)
CCC Help Czech (x32 Version: 2012.0214.2217.39913)
CCC Help Danish (x32 Version: 2012.0214.2217.39913)
CCC Help Dutch (x32 Version: 2012.0214.2217.39913)
CCC Help English (x32 Version: 2012.0214.2217.39913)
CCC Help Finnish (x32 Version: 2012.0214.2217.39913)
CCC Help French (x32 Version: 2012.0214.2217.39913)
CCC Help German (x32 Version: 2012.0214.2217.39913)
CCC Help Greek (x32 Version: 2012.0214.2217.39913)
CCC Help Hungarian (x32 Version: 2012.0214.2217.39913)
CCC Help Italian (x32 Version: 2012.0214.2217.39913)
CCC Help Japanese (x32 Version: 2012.0214.2217.39913)
CCC Help Korean (x32 Version: 2012.0214.2217.39913)
CCC Help Norwegian (x32 Version: 2012.0214.2217.39913)
CCC Help Polish (x32 Version: 2012.0214.2217.39913)
CCC Help Portuguese (x32 Version: 2012.0214.2217.39913)
CCC Help Russian (x32 Version: 2012.0214.2217.39913)
CCC Help Spanish (x32 Version: 2012.0214.2217.39913)
CCC Help Swedish (x32 Version: 2012.0214.2217.39913)
CCC Help Thai (x32 Version: 2012.0214.2217.39913)
CCC Help Turkish (x32 Version: 2012.0214.2217.39913)
ccc-utility64 (Version: 2012.0214.2218.39913)
CCleaner (Version: 3.15)
CDBurnerXP (x32 Version: 4.5.0.3685)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Defraggler (Version: 2.09)
DES 2.0 (x32 Version: 1.00.0000)
Dropbox (HKCU Version: 2.0.22)
Etron USB3.0 Host Controller (x32 Version: 0.104)
FileViewPro (Version: 4.0)
FileZilla Client 3.5.3 (x32 Version: 3.5.3)
FormatFactory 3.1.1 (x32 Version: 3.1.1)
Free Video Flip and Rotate version 2.1.7.430 (x32 Version: 2.1.7.430)
FreePDF (Remove only) (x32)
GPL Ghostscript (Version: 9.04)
GSview 5.0 (Version: 5.0)
HFSExplorer 0.21 (x32 Version: 0.21)
High-Definition Video Playback (x32 Version: 11.1.11100.4.196)
HydraVision (x32 Version: 4.2.206.0)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118)
Java Auto Updater (x32 Version: 2.0.6.1)
Java(TM) 6 Update 30 (x32 Version: 6.0.300)
LibreOffice 3.5 (x32 Version: 3.5.0.13)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Media Add-Ons für Acronis True Image Home 2009 (x32 Version: 12.0.9646.4)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (x32 Version: 12.0.4518.1014)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Antimalware (Version: 3.0.8402.2)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Security Client (Version: 2.1.1116.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 2.1.1116.0)
Microsoft Silverlight (x32 Version: 4.1.10329.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Works (x32 Version: 08.05.0822)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Mozilla Firefox 10.0 (x86 de) (x32 Version: 10.0)
Mozilla Firefox 24.0 (x86 de) (HKCU Version: 24.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Nero 11 Collection 1 (x32 Version: 11.0.11200.12.0)
Nero 11 Kwik Themes 3 (x32 Version: 11.0.11200.12.0)
Nero 11 Kwik Themes 4 (x32 Version: 11.0.11200.12.0)
Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0)
Nero 11 PiP Effects 1 (x32 Version: 11.0.11200.12.0)
Nero 11 Video Transitions 1 (x32 Version: 11.0.11200.12.0)
Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0)
Nero Core Components 11 (x32 Version: 11.0.16000.1.20)
Nero Kwik Media (x32 Version: 1.10.24800.146.100)
Nero Kwik Media (x32 Version: 11.0.17100)
Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200)
Nero Update (x32 Version: 11.0.11500.28.0)
nero.prerequisites.msi (x32 Version: 11.0.20010)
Notepad++ (x32 Version: 6.4.3)
Office eDial (x32 Version: 2.0.8)
ON_OFF Charge B11.0110.1 (x32 Version: 1.00.0001)
PDF Settings CS5 (x32 Version: 10.0)
PxMergeModule (x32 Version: 1.00.0000)
Quark Update (x32 Version: 1.0.0.0)
QuarkXPress (x32 Version: 9.0.0.0)
QuickTime (x32 Version: 7.0.4)
Realtek Ethernet Controller Driver (x32 Version: 7.46.531.2011)
Realtek HDMI Audio Driver for ATI (x32 Version: 6.0.1.6409)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6423)
RedMon - Redirection Port Monitor
Samsung ML-2010 Series (x32)
Samsung ML-2160 Series (x32)
Samsung Printer Live Update (x32 Version: 1.01.00.04)
Serif PagePlus Starter Edition (x32 Version: 3.0.0.3)
TeamViewer 5 (x32 Version: 5.1.10408 )
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
VLC media player 2.0.8 (x32 Version: 2.0.8)
Wartung Samsung CLX-3180 Series (x32)
Windows Small Business Server 2008 ClientAgent (Version: 6.0.5601.6)
Windows Small Business Server 2008 Desktop Links Gadget (Version: 6.0.5601.6)
Windows Small Business Server 2008 WMI Provider (x32 Version: 6.0.5601.6)
XnView 2.04 (x32 Version: 2.04)

==================== Restore Points  =========================

26-09-2013 15:23:07 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2012-02-03 14:43 - 00000854 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	activate.adobe.com

==================== Scheduled Tasks (whitelisted) =============

Task: {17A64F9D-F19E-4F30-A827-99B7CD609CD1} - System32\Tasks\{66E89349-310F-43CE-8DEE-312ACC27A26F} => C:\Users\Stefan.Krämer\Desktop\BonnUPD\bonn_fu.exe
Task: {2CDE6D1A-4AD9-4608-AD18-7AC14A63FBE3} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2010-03-09] (Microsoft Corporation)
Task: {3EEC3E55-3FC0-4DEE-90F7-2EF71D7AB6FE} - System32\Tasks\Quark Updater => C:\Program Files (x86)\Quark\Quark Update\AutoUpdate.exe [2010-10-22] ()
Task: {446FC94E-C6E8-4FB3-A643-A2BD82F6A9B0} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
Task: {4CF071AD-A091-41F3-A7F3-7F1442E9E091} - System32\Tasks\AdobeAAMUpdater-1.0-PC111-User => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-09-16] (Adobe Systems Incorporated)
Task: {570C33AD-0E50-4C86-B5D7-63CD051609F6} - System32\Tasks\AdobeAAMUpdater-1.0-KOMM-MIT-Administrator => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-09-16] (Adobe Systems Incorporated)
Task: {6A64BCDD-4034-497A-A546-E5ED1182D228} - System32\Tasks\{EA21657B-400D-4C11-AA06-E514B5858BDB} => C:\Users\Stefan.Krämer\Desktop\BonnUPD\bonn_fu.exe
Task: {84FFF2AA-3696-40DA-BC84-F0518E2DDF01} - System32\Tasks\{D53E986B-176F-40AE-9B79-34B1D37E938A} => C:\Users\Stefan.Krämer\Desktop\BonnUPD\bonn_fu.exe
Task: {8B0160E8-2477-4826-B0EB-D2B0A7C0D46E} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-06-24] (Microsoft Corporation)
Task: {91C7391E-3FA7-4A1E-AA89-7E3FCBF752E2} - System32\Tasks\{07D47E55-520A-408A-BF5D-4320D57636CE} => C:\Users\Stefan.Krämer\Desktop\BonnUPD\bonn_fu.exe
Task: {B4D21C72-7AC6-4F28-BE11-C2A9C82B33B3} - System32\Tasks\{03AB33BC-332E-4FC1-AB4A-2517ED80D092} => C:\Users\Stefan.Krämer\Desktop\BonnUPD\bonn_fu.exe
Task: {E3EEFADD-4D67-4898-9B1E-59E423CAEB8F} - System32\Tasks\{336A5D23-BC36-4339-B418-878B9DC365A1} => C:\Users\Stefan.Krämer\Desktop\BonnUPD\bonn_fu.exe
Task: {F579C9C7-6321-4708-9E47-B0AFFFBC31AD} - System32\Tasks\{D45879FF-0966-445F-9B29-FE521BFC6DB1} => C:\Users\Stefan.Krämer\Desktop\BonnUPD\bonn_fu.exe
Task: C:\Windows\Tasks\Quark Updater.job => C:\Program Files (x86)\Quark\Quark Update\AutoUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-06-18 17:24 - 2012-06-18 17:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2012-02-14 23:13 - 2012-02-14 23:13 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-01-31 20:47 - 2009-05-04 18:56 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\EnergySaver2\ycc.dll
2012-02-01 17:52 - 2009-10-31 15:42 - 01384520 _____ () C:\Windows\twain_32\Samsung\CLX3180\ssole.dll
2012-02-01 17:52 - 2010-11-11 11:46 - 00293888 _____ () C:\Windows\twain_32\Samsung\CLX3180\NetModule2.dll
2013-09-03 15:54 - 2013-09-03 15:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/27/2013 03:23:25 PM) (Source: Microsoft Security Client Setup) (User: KOMM-MIT)
Description: HRESULT:0x80070643
Description:Cannot complete the Security Essentials Upgrade. Security Essentials is not currently monitoring and helping to protect your computer. Please restart your computer and try again. Error code:0x80070643. (null)

Error: (09/27/2013 03:23:20 PM) (Source: MsiInstaller) (User: KOMM-MIT)
Description: Product: Microsoft Security Client -- Error 1316. A network error occurred while attempting to read from the file: C:\Windows\Installer\epp.msi

Error: (09/27/2013 03:23:17 PM) (Source: MsiInstaller) (User: KOMM-MIT)
Description: Product: Microsoft Security Client -- Error 1316. A network error occurred while attempting to read from the file: C:\Windows\Installer\epp.msi

Error: (09/27/2013 03:09:34 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (09/27/2013 03:09:34 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (09/27/2013 03:08:46 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (09/27/2013 03:05:36 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (09/27/2013 03:05:30 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (09/27/2013 03:04:29 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (09/27/2013 03:04:29 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.


System errors:
=============
Error: (09/27/2013 03:30:42 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.

Error: (09/27/2013 03:30:40 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "PACO" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.

Error: (09/27/2013 03:30:40 PM) (Source: Ntfs) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "PACO" den Befehl "chkdsk" aus.

Error: (09/27/2013 03:21:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1060

Error: (09/27/2013 03:21:45 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (09/27/2013 03:21:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Microsoft Antimalware Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/27/2013 03:03:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (09/27/2013 03:02:23 PM) (Source: DCOM) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (09/27/2013 03:02:23 PM) (Source: DCOM) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (09/27/2013 03:02:22 PM) (Source: DCOM) (User: )
Description: 1084EventSystem{1BE1F766-5536-11D1-B726-00C04FB926AF}


Microsoft Office Sessions:
=========================
Error: (05/13/2013 10:48:53 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.6612.1000. This session lasted 7 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 21%
Total physical RAM: 8175.12 MB
Available physical RAM: 6412.71 MB
Total Pagefile: 16348.43 MB
Available Pagefile: 14392.74 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:97.66 GB) (Free:12.63 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive n: (Volume) (Fixed) (Total:355.78 GB) (Free:80.8 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 6D09824B)
Partition 1: (Not Active) - (Size=993 KB) - (Type=42)
Partition 2: (Active) - (Size=98 GB) - (Type=42)
Partition 3: (Not Active) - (Size=368 GB) - (Type=42)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-27 15:45:17
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 ST500DM002-1BD142 rev.KC45 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\STEFAN~1.KRM\AppData\Local\Temp\pxldapog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1776] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69   00000000758f1465 2 bytes [8F, 75]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1776] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155  00000000758f14bb 2 bytes [8F, 75]
.text  ...                                                                                                                                   * 2

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\                                                                                               
Reg    HKLM\SYSTEM\CurrentControlSet\services\@Parameters\0\x202e\x2764                                                                      836
Reg    HKLM\SYSTEM\ControlSet002\services\ (not active ControlSet)                                                                           
Reg    HKLM\SYSTEM\ControlSet002\services\@Parameters\0\x202e\x2764                                                                          836

---- EOF - GMER 2.1 ----
         

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.27.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Stefan.Krämer :: PC111 [Administrator]

Schutz: Aktiviert

27.09.2013 09:56:32
MBAM-log-2013-09-27 (10-52-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|I:\|J:\|K:\|N:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 585323
Laufzeit: 54 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SYSTEM\CurrentControlSet\Services\*etadpug (Trojan.Inject.RRE) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Google Update (Trojan.Inject.RRE) -> Daten:  -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 3
C:\Users\Stefan.Krämer\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Roaming\OpenCandy\C816E45F831147A58D9198AC2A93FC38 (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Local\Temp\CT3000917 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

Infizierte Dateien: 16
C:\Users\Stefan.Krämer\AppData\Local\Google\Desktop\Install\{23ff0886-cfc9-3a1c-3e9e-ef525c7945e8}\❤≸⋙\Ⱒ☠⍨\*ﯹ๛\{23ff0886-cfc9-3a1c-3e9e-ef525c7945e8}\GoogleUpdate.exe (Trojan.Inject.RRE) -> Keine Aktion durchgeführt.
c:\program files (x86)\google\desktop\install\{23ff0886-cfc9-3a1c-3e9e-ef525c7945e8}\   \...\*ﯹ๛\{23ff0886-cfc9-3a1c-3e9e-ef525c7945e8}\googleupdate.exe (Trojan.Inject.RRE) -> Keine Aktion durchgeführt.
C:\$Recycle.Bin\S-1-5-21-92456429-21299910-4226566416-1182\$RRG9CZC.zip (Trojan.Inject.RRE) -> Keine Aktion durchgeführt.
C:\$Recycle.Bin\S-1-5-21-92456429-21299910-4226566416-1182\$RWKJLDY.exe (PUP.Optional.Amonetize.A) -> Keine Aktion durchgeführt.
c:\program files (x86)\google\desktop\install\{23ff0886-cfc9-3a1c-3e9e-ef525c7945e8}\   \...\*ﯹ๛\{23ff0886-cfc9-3a1c-3e9e-ef525c7945e8}\u\000000cb.@ (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\355CGBTY\statisticsstub[1].exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X837T84J\Testbundle23w_1254[1].exe (PUP.Adware.Agent) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Local\Temp\AskPIP_FF_.exe (PUP.Optional.BundledToolBar.A) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Local\Temp\awh3815.tmp (PUP.Optional.Elex) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Local\Temp\awh3A48.tmp (PUP.Optional.Adtool) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Local\Temp\CT3000917\statisticsStub.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Roaming\OpenCandy\C816E45F831147A58D9198AC2A93FC38\LatestDLMgr.exe (PUP.Optional.OpenCandy.A) -> Keine Aktion durchgeführt.
C:\Windows\System32\cmdow.exe (PUP.Tool) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Roaming\OpenCandy\C816E45F831147A58D9198AC2A93FC38\3209.ico (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Roaming\OpenCandy\C816E45F831147A58D9198AC2A93FC38\speedupmypcDE.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.
C:\Users\Stefan.Krämer\AppData\Local\Temp\CT3000917\parameters.csf (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

(Ende)