BSI Test positiv-was nun?

bat2111 · 26.01.2014, 08:21

Hi,

eine meiner Adressen ist offenbar positiv. Ich habe folgende Schädlinge bei mir entdeckt:
TR/Spy.ZBot.ale
EXP/Pidief.eel
TR/Agent.cada.25161

PC Cleaner schlägt mir vor, diese Dateien zu entfernen. Reicht das aus? Oder formatiere ich nun mein komplettes System, inklusive Mac OS?
Nach dem Entfernen kommt die Meldung, daß von vier Dateien nur eine entfernt wurde.

Zudem würde ich nachher nochmal meine Passwörter ändern, weil es VOR der Entfernung von Schadsoftware wie ich annehme nicht bringt.
Antivirenprogramm hat nichts gefunden.

Zudem verwende ich eine externe HD für Bilder, die ich keinesfalls formatieren kann.

Wie überprüfe ich mein Mac OS Maverick???

Gruß
bat

schrauber · 26.01.2014, 08:40

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

bat2111 · 26.01.2014, 13:26

Danke, mache ich.

Hier der Report:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-01-2014 01
Ran by Patrick (ATTENTION: The logged in user is not administrator) on PATRICK-PC on 26-01-2014 09:53:35
Running from C:\Users\Patrick\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
() C:\Users\Patrick\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Avira Operations GmbH & Co. KG) C:\Users\Patrick\AppData\Local\Temp\cleaner\avwebloader.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [357800 2009-09-12] (Acronis)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5082488 2009-09-12] (Acronis)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-02-19] (Geek Software GmbH)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000}
HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196}
HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196}
HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59280 2012-08-29] (Apple Inc.)
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59280 2012-09-10] (Apple Inc.)
HKCU\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\Patrick\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKCU\...\Run: [iMesh] - "C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe" --lightmode
MountPoints2: {c8a574ad-1081-11e1-83ec-001cc0950dff} - K:\pushinst.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x67DE48988EFCCE01
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files (x86)\Common Files\ReGet Shared\Catcher.dll (ReGet Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
Toolbar: HKLM-x32 - ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - C:\Program Files (x86)\ReGet Software\ReGet Deluxe\IEBar.dll No File
ShellExecuteHooks-x32:  - {16664848-0E00-11D2-8059-000000000000} -  No File [ ]
Tcpip\..\Interfaces\{C286B04C-FC23-4577-ABFD-4CCC721E1580}: [NameServer]192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default
FF DefaultSearchEngine: Wikipedia (de)
FF SearchEngineOrder.1: Search the web (Babylon)
FF SelectedSearchEngine: Wikipedia (de)
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Patrick\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin HKCU: iMeshPlugin - C:\Program Files (x86)\iMesh Applications\iMesh\npiMeshPlugin.dll No File
FF SearchPlugin: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\searchplugins\imdb.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\nostmp [2011-11-16]
FF Extension: MacOSX Theme - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\{00352F14-3F76-4e4d-ACFF-9972D7E4B3B9} [2011-11-16]
FF Extension: Garmin Communicator - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-23]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-11-16]
FF Extension: DownloadHelper - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-29]
FF Extension: Firebug - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\firebug@software.joehewitt.com.xpi [2013-06-25]
FF Extension: FlashGot - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2011-11-16]
FF Extension: BetterPrivacy - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2011-11-16]
FF Extension: Navigational Sounds - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\qqj0taly.default\Extensions\{d84a846d-f7cb-4187-a408-b171020e8940}.xpi [2013-02-23]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [368640 2009-03-20] (AVM Berlin)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S4 Macromedia Licensing Service; C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [68096 2011-11-17] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [552704 2009-03-20] (AVM GmbH)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [44480 2011-05-13] (hxxp://libusb-win32.sourceforge.net)
S3 rt61x64; C:\Windows\System32\DRIVERS\WMP54Gv41x64.sys [446304 2010-04-07] (Ralink Technology, Corp.)
R0 tdrpman251; C:\Windows\System32\DRIVERS\tdrpm251.sys [1455648 2011-12-01] (Acronis)
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [141920 2011-11-19] (Acronis)
S0 vmci; system32\DRIVERS\vmci.sys [x]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-26 09:53 - 2014-01-26 09:54 - 00013095 _____ C:\Users\Patrick\Desktop\FRST.txt
2014-01-26 09:53 - 2014-01-26 09:53 - 00000000 ____D C:\FRST
2014-01-26 09:52 - 2014-01-26 09:52 - 02078208 _____ (Farbar) C:\Users\Patrick\Desktop\FRST64.exe
2014-01-26 08:16 - 2014-01-26 08:16 - 00602112 _____ (OldTimer Tools) C:\Users\Patrick\Desktop\OTL.exe
2014-01-26 08:08 - 2014-01-26 08:11 - 00000966 _____ C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iMesh.lnk
2014-01-26 08:08 - 2014-01-26 08:08 - 00000000 ____D C:\Users\Patrick\AppData\Local\iMesh
2014-01-25 21:57 - 2014-01-25 21:57 - 00002041 _____ C:\Users\Patrick\Desktop\Entfernen des Avira PC Cleaners.lnk
2014-01-25 21:57 - 2014-01-25 21:57 - 00001985 _____ C:\Users\Patrick\Desktop\Avira PC Cleaner.lnk
2014-01-25 21:45 - 2014-01-25 22:08 - 00000110 _____ C:\Users\Patrick\Desktop\BSI.txt
2014-01-25 15:41 - 2014-01-25 15:57 - 00001056 _____ C:\Users\Patrick\Desktop\Neues Textdokument.txt
2014-01-25 15:10 - 2014-01-25 15:10 - 00000000 ____D C:\Users\Patrick\AppData\Local\Software
2014-01-25 15:10 - 2014-01-25 15:10 - 00000000 ____D C:\Users\Patrick\AppData\Local\NikLicenseFiles
2014-01-23 09:07 - 2014-01-26 09:13 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-23 09:07 - 2014-01-25 20:21 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-23 09:07 - 2014-01-23 09:09 - 00000000 ____D C:\ProgramData\Google
2014-01-23 09:07 - 2014-01-23 09:07 - 00000000 ____D C:\Program Files\Google
2014-01-23 09:06 - 2014-01-23 09:07 - 00000000 ____D C:\ProgramData\Package Cache
2014-01-15 19:13 - 2014-01-15 19:13 - 00011778 _____ C:\Users\Patrick\Desktop\Fotografie.xlsx
2014-01-15 17:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 17:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 17:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 17:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 17:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 17:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 17:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 17:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 17:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-29 18:51 - 2013-12-29 18:54 - 00003813 _____ C:\Users\Patrick\Desktop\Photostock Regeln.txt
2013-12-28 13:51 - 2013-12-28 13:51 - 00000000 ____D C:\Users\Patrick\Documents\Steuer-Sparbuch
2013-12-28 13:45 - 2013-12-28 13:45 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Buhl
2013-12-28 13:44 - 2013-12-28 13:44 - 19932256 _____ C:\Users\Administrator\Downloads\WISOSteuersoftware2014Update218499.exe
2013-12-28 13:41 - 2013-12-28 13:41 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Buhl Data Service
2013-12-28 13:41 - 2013-12-28 13:41 - 00000000 ____D C:\Users\Administrator\AppData\Local\Buhl Data Service
2013-12-28 13:40 - 2013-12-28 13:45 - 00000000 ____D C:\Users\Patrick\AppData\Local\Buhl
2013-12-28 13:40 - 2013-12-28 13:40 - 00000000 ____D C:\Windows\pss
2013-12-28 13:39 - 2013-12-28 13:45 - 00000517 _____ C:\Windows\wiso.ini
2013-12-28 13:39 - 2013-12-28 13:45 - 00000000 ____D C:\Users\Administrator\AppData\Local\Buhl
2013-12-28 13:34 - 2013-12-28 13:39 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH
2013-12-28 13:34 - 2013-12-28 13:34 - 00000000 ____D C:\Program Files (x86)\WISO

==================== One Month Modified Files and Folders =======

2014-01-26 09:54 - 2014-01-26 09:53 - 00013095 _____ C:\Users\Patrick\Desktop\FRST.txt
2014-01-26 09:53 - 2014-01-26 09:53 - 00000000 ____D C:\FRST
2014-01-26 09:52 - 2014-01-26 09:52 - 02078208 _____ (Farbar) C:\Users\Patrick\Desktop\FRST64.exe
2014-01-26 09:52 - 2011-12-01 21:17 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Free Download Manager
2014-01-26 09:13 - 2014-01-23 09:07 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-26 08:18 - 2011-04-12 08:43 - 00701326 _____ C:\Windows\system32\perfh007.dat
2014-01-26 08:18 - 2011-04-12 08:43 - 00150226 _____ C:\Windows\system32\perfc007.dat
2014-01-26 08:18 - 2009-07-14 06:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-26 08:16 - 2014-01-26 08:16 - 00602112 _____ (OldTimer Tools) C:\Users\Patrick\Desktop\OTL.exe
2014-01-26 08:11 - 2014-01-26 08:08 - 00000966 _____ C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iMesh.lnk
2014-01-26 08:08 - 2014-01-26 08:08 - 00000000 ____D C:\Users\Patrick\AppData\Local\iMesh
2014-01-26 06:06 - 2011-11-14 20:05 - 01831893 _____ C:\Windows\WindowsUpdate.log
2014-01-26 02:03 - 2011-11-17 22:22 - 00000000 ____D C:\Users\Patrick\AppData\Local\Adobe
2014-01-25 22:08 - 2014-01-25 21:45 - 00000110 _____ C:\Users\Patrick\Desktop\BSI.txt
2014-01-25 21:57 - 2014-01-25 21:57 - 00002041 _____ C:\Users\Patrick\Desktop\Entfernen des Avira PC Cleaners.lnk
2014-01-25 21:57 - 2014-01-25 21:57 - 00001985 _____ C:\Users\Patrick\Desktop\Avira PC Cleaner.lnk
2014-01-25 20:21 - 2014-01-23 09:07 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-25 15:57 - 2014-01-25 15:41 - 00001056 _____ C:\Users\Patrick\Desktop\Neues Textdokument.txt
2014-01-25 15:10 - 2014-01-25 15:10 - 00000000 ____D C:\Users\Patrick\AppData\Local\Software
2014-01-25 15:10 - 2014-01-25 15:10 - 00000000 ____D C:\Users\Patrick\AppData\Local\NikLicenseFiles
2014-01-25 15:09 - 2012-12-02 11:16 - 00000000 ____D C:\Program Files\World_of_Tanks
2014-01-25 14:44 - 2009-07-14 05:45 - 00021696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-25 14:44 - 2009-07-14 05:45 - 00021696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-25 14:23 - 2011-11-15 20:08 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-25 14:23 - 2011-11-15 18:51 - 00000000 ____D C:\Users\Administrator
2014-01-25 14:23 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-25 14:23 - 2009-07-14 05:51 - 00081231 _____ C:\Windows\setupact.log
2014-01-23 20:09 - 2011-11-15 19:27 - 01597772 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-23 09:09 - 2014-01-23 09:07 - 00000000 ____D C:\ProgramData\Google
2014-01-23 09:09 - 2012-04-15 11:42 - 00000000 ____D C:\Users\Patrick\AppData\Local\Google
2014-01-23 09:07 - 2014-01-23 09:07 - 00000000 ____D C:\Program Files\Google
2014-01-23 09:07 - 2014-01-23 09:06 - 00000000 ____D C:\ProgramData\Package Cache
2014-01-23 09:07 - 2012-04-15 10:59 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2014-01-23 09:07 - 2012-04-15 10:59 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-22 15:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2014-01-20 19:01 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2014-01-17 18:05 - 2009-07-14 05:45 - 04988448 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-15 19:13 - 2014-01-15 19:13 - 00011778 _____ C:\Users\Patrick\Desktop\Fotografie.xlsx
2014-01-15 19:07 - 2013-07-15 21:11 - 00000000 ____D C:\Windows\system32\MRT
2014-01-15 19:06 - 2011-11-15 19:52 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-02 09:17 - 2013-06-22 08:58 - 00000058 _____ C:\Users\Patrick\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2014-01-02 09:16 - 2013-06-22 08:58 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-12-29 18:54 - 2013-12-29 18:51 - 00003813 _____ C:\Users\Patrick\Desktop\Photostock Regeln.txt
2013-12-28 19:46 - 2013-12-14 13:00 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Dropbox
2013-12-28 13:51 - 2013-12-28 13:51 - 00000000 ____D C:\Users\Patrick\Documents\Steuer-Sparbuch
2013-12-28 13:45 - 2013-12-28 13:45 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Buhl
2013-12-28 13:45 - 2013-12-28 13:40 - 00000000 ____D C:\Users\Patrick\AppData\Local\Buhl
2013-12-28 13:45 - 2013-12-28 13:39 - 00000517 _____ C:\Windows\wiso.ini
2013-12-28 13:45 - 2013-12-28 13:39 - 00000000 ____D C:\Users\Administrator\AppData\Local\Buhl
2013-12-28 13:44 - 2013-12-28 13:44 - 19932256 _____ C:\Users\Administrator\Downloads\WISOSteuersoftware2014Update218499.exe
2013-12-28 13:41 - 2013-12-28 13:41 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Buhl Data Service
2013-12-28 13:41 - 2013-12-28 13:41 - 00000000 ____D C:\Users\Administrator\AppData\Local\Buhl Data Service
2013-12-28 13:40 - 2013-12-28 13:40 - 00000000 ____D C:\Windows\pss
2013-12-28 13:39 - 2013-12-28 13:34 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH
2013-12-28 13:34 - 2013-12-28 13:34 - 00000000 ____D C:\Program Files (x86)\WISO
2013-12-28 13:34 - 2011-11-17 21:35 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-28 10:48 - 2011-11-14 20:18 - 00000000 ___RD C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 23:55 - 2013-06-26 11:14 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\FileZilla
2013-12-27 18:05 - 2011-11-14 20:17 - 00000000 ____D C:\Users\Patrick

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\ose00000.exe
C:\Users\Patrick\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-01-2014 01
Ran by Patrick at 2014-01-26 09:54:44
Running from C:\Users\Patrick\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Acronis*True*Image*Home (x32 Version: 13.0.5055 - Acronis)
Adobe AIR (x32 Version: 3.6.0.5970 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.6.0.5970 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.5.23 - Adobe Systems Incorporated.)
Adobe Community Help (x32 Version: 3.5.23 - Adobe Systems Incorporated.) Hidden
Adobe Flash Player 11 ActiveX 64-bit (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224 - Adobe Systems Incorporated)
Adobe Photoshop CS5.1 (x32 Version: 12.1 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 3.6 64-bit (Version: 3.6.1 - Adobe)
Adobe Photoshop Lightroom 5.3 64-bit (Version: 5.3.1 - Adobe Systems Incorporated)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.18 (HKCU Version: 1.0.18 - Amazon Services LLC)
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
AVM FRITZ!WLAN (x32 Version:  - AVM Berlin)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Corel Graphics - Windows Shell Extension (x32 Version: 15.2.0.686 - Corel Corporation)
Corel Graphics - Windows Shell Extension (x32 Version: 15.2.686 - Corel Corporation) Hidden
Corel Graphics - Windows Shell Extension 64 Bit (Version: 15.2.686 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - BR (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Capture (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Common (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Connect (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Custom Data (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - DE (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Draw (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - EN (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - ES (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Extra Content (x32 Version:  - Corel Corporation)
CorelDRAW Graphics Suite X5 - Extra Content (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Filters (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FontNav (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FR (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IPM (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - NL (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - PHOTO-PAINT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Photozoom Plugin (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Redist (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Setup Files (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VBA (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VideoBrowser (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VSTA (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - WT (x32 Version: 15.3 -  Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW(R) Graphics Suite X5 (x32 Version: 15.2.0.686 - Corel Corporation)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version:  - Microsoft)
Dropbox (HKCU Version: 2.4.10 - Dropbox, Inc.)
FileZilla Client 3.7.3 (x32 Version: 3.7.3 - Tim Kosse)
Free Download Manager 3.9.2 (x32 Version:  - FreeDownloadManager.ORG)
Garmin ANT Agent (Version: 2.3.4 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (x32 Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (x32 Version: 1 - Microsoft Corporation)
iCloud (Version: 2.0.2.187 - Apple Inc.)
Internet Explorer (Enable DEP) (Version:  - )
iTunes (Version: 11.1.3.8 - Apple Inc.)
Joe (x32 Version: 4.00.0050 - Wirth IT Design)
Macromedia Dreamweaver MX 2004 (x32 Version: 7.0.1 - Macromedia)
Macromedia Extension Manager (x32 Version: 1.5 - Macromedia)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Camera Codec Pack (Version: 16.4.1734.1104 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU  (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU  (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual Studio Tools for Applications 2.0 - ENU (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0 - Mozilla)
Mp3tag v2.53 (x32 Version: v2.53 - Florian Heidenreich)
Nero 6 Demo (x32 Version:  - )
Nero BurnRights (Ahead Software) (x32 Version:  - )
Nik Collection (x32 Version: 1.1.1.0 - Google)
NVIDIA 3D Vision Controller-Treiber 314.22 (Version: 314.22 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.133.889 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.1031 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3165 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden
NVIDIA Update 1.15.2 (Version: 1.15.2 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.15.2 - NVIDIA Corporation) Hidden
Oracle VM VirtualBox 4.1.6 (Version: 4.1.6 - Oracle Corporation)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 5.3.0 (x32 Version:  - PDF24.org)
Photo DVD Maker Professional 8.35 (x32 Version: 8.35 - Anvsoft Inc.)
QuickTime (x32 Version: 7.73.80.64 - Apple Inc.)
Screenshot Captor 4.8 (x32 Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
SyncToy 2.1 (x64) (Version: 2.1.0 - Microsoft)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version:  - Microsoft)
Visual Basic for Applications (R) Core - English (x32 Version: 6.4.99.69 - Microsoft Corporation) Hidden
Visual Basic for Applications (R) Core - German (x32 Version: 6.4.99.69 - Microsoft Corporation) Hidden
Visual Basic for Applications (R) Core (x32 Version: 6.4.99.69 - Microsoft Corporation) Hidden
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows XP Mode (Version: 1.3.7600.16422 - Microsoft Corporation)
Windows-Treiberpaket - Dynastream Innovations (libusb0) LibUsbDevices  (07/07/2009 1.12.2) (Version: 07/07/2009 1.12.2 - Dynastream Innovations)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WISO Steuer-Sparbuch 2014 (x32 Version: 21.00.8480 - Buhl Data Service GmbH)
World of Tanks (x32 Version:  - Wargaming.net)

==================== Restore Points  =========================

Could not list Restore Points. Check WMI.


==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

==================== Loaded Modules (whitelisted) =============

2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-09-08 02:32 - 2012-09-08 02:32 - 00943504 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Windows\win.ini:s1

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: PCI-Kommunikationscontroller (einfach)
Description: PCI-Kommunikationscontroller (einfach)
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Linksys Wireless-G PCI Adapter
Description: Linksys Wireless-G PCI Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Linksys, A Division of Cisco Systems, Inc.
Service: rt61x64
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: VirtualBox Host-Only Ethernet Adapter
Description: VirtualBox Host-Only Ethernet Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Oracle Corporation
Service: VBoxNetAdp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/25/2014 02:24:57 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 08:26:42 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/22/2014 11:32:15 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/22/2014 11:28:25 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/20/2014 02:54:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15828

Error: (01/20/2014 02:54:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15828

Error: (01/20/2014 02:54:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/20/2014 02:54:01 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13875

Error: (01/20/2014 02:54:01 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13875

Error: (01/20/2014 02:54:01 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (01/25/2014 02:46:05 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597 (Definition 1.165.2532.0)

Error: (01/25/2014 02:33:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (01/25/2014 02:31:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde nicht richtig gestartet.

Error: (01/23/2014 09:11:10 AM) (Source: Microsoft-Windows-HAL) (User: )
Description: Der Speicher wurde beim letzten Leistungsübergang des Systems von der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte Firmware verfügbar ist.

Error: (01/23/2014 08:57:15 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort3 gefunden.

Error: (01/23/2014 08:57:12 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort3 gefunden.

Error: (01/20/2014 02:54:07 PM) (Source: Microsoft-Windows-HAL) (User: )
Description: Der Speicher wurde beim letzten Leistungsübergang des Systems von der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte Firmware verfügbar ist.

Error: (01/20/2014 00:50:32 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort3 gefunden.

Error: (01/20/2014 11:48:46 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort3 gefunden.

Error: (01/20/2014 11:36:04 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort3 gefunden.


Microsoft Office Sessions:
=========================
Error: (01/25/2014 02:24:57 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 08:26:42 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/22/2014 11:32:15 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/22/2014 11:28:25 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/20/2014 02:54:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15828

Error: (01/20/2014 02:54:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15828

Error: (01/20/2014 02:54:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/20/2014 02:54:01 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13875

Error: (01/20/2014 02:54:01 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13875

Error: (01/20/2014 02:54:01 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second


==================== Memory info =========================== 

Percentage of memory in use: 46%
Total physical RAM: 6074.37 MB
Available physical RAM: 3269.28 MB
Total Pagefile: 12146.91 MB
Available Pagefile: 9284.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:250.39 GB) (Free:71.95 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (BACKUPS_HD1) (Fixed) (Total:681.02 GB) (Free:451.01 GB) NTFS
Drive e: (DATEN_HD2) (Fixed) (Total:931.51 GB) (Free:394.3 GB) NTFS
Drive i: (USB 3 64GB) (Removable) (Total:58.87 GB) (Free:22.04 GB) exFAT

==================== MBR & Partition Table ==================

========================================================
Disk: 6 (Size: 59 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=59 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Onlinebanking sperren?
Muß ich nun alles neu formatieren?

Was ist mit meiner externen Bilder-HD, die ich am Mac betreibe, aber zur Datensicherung auch am betroffenen PC angeschlossen hatte?

Und was mache ich nun?

schrauber · 27.01.2014, 09:03

Nee formatieren brauchste nit. Neue Passwörter am Schluss.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

BSI Test positiv-was nun?

Plagegeister aller Art und deren Bekämpfung: BSI Test positiv-was nun?