Hi Schrauber,
ja..es handelte sich um den ersten PC...Ereignisanzeige war nicht so aufschlussreich..jetzt weiss ich zwar wann er genau abgeschmiert ist..aber zu dem besagten Zeitpunkt wurde kein Ereignis gemeldet..Screenshot ist angehängt..
soll ich evtl. mit dem Programm Bluescreenview weitermachen?
hxxp://www.tippscout.de/windows-absturz-ursache_tipp_4568.html

hier logs zum 2. PC

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.08.04

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.16982
Marc :: MARC-PC [Administrator]

08.02.2014 13:49:02
mbam-log-2014-02-08 (13-49-02).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 286700
Laufzeit: 7 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Digital Sites (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0J1L2U1C1H1Q0R2X1L1R1P0B1P -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 8
C:\Users\Marc\Downloads\7ZipSetup.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\Downloads\SoftonicDownloader_fuer_mp3directcut.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Supermama\Downloads\Adobe Flash Player 11.exe (PUP.Optional.Solimba) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\config.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\prod.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marc\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

AdwC-log

# AdwCleaner v3.018 - Bericht erstellt am 08/02/2014 um 14:26:35
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium  (32 bits)
# Benutzername : Marc - MARC-PC
# Gestartet von : C:\Users\Marc\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{5EBDCA98-43B3-45BB-87E0-716029FB42AB}
Datei Gelöscht : C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\user.js
Datei Gelöscht : C:\Users\Lucky Luke\AppData\Roaming\Mozilla\Firefox\Profiles\y0cm0236.default\user.js
Datei Gelöscht : C:\Users\Supermama\AppData\Roaming\Mozilla\Firefox\Profiles\a4ddhw0f.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Codec Package Packages

***** [ Browser ] *****

-\\ Internet Explorer v7.0.6000.16982


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\prefs.js ]


[ Datei : C:\Users\Lucky Luke\AppData\Roaming\Mozilla\Firefox\Profiles\y0cm0236.default\prefs.js ]


[ Datei : C:\Users\Supermama\AppData\Roaming\Mozilla\Firefox\Profiles\a4ddhw0f.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [2104 octets] - [08/02/2014 14:24:01]
AdwCleaner[S0].txt - [2025 octets] - [08/02/2014 14:26:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2085 octets] ##########
         

Rest in nächster Antwort :-)
Lg whis

und hier noch JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Marc on 08.02.2014 at 14:30:29,34
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2495F679-868B-4542-845F-2BADFDAADCA8}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2495F679-868B-4542-845F-2BADFDAADCA8}



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Marc\AppData\Roaming\mozilla\firefox\profiles\tfe7389y.default\prefs.js

user_pref("browser.startup.homepage", "www.ixquick.de");
Emptied folder: C:\Users\Marc\AppData\Roaming\mozilla\firefox\profiles\tfe7389y.default\minidumps [29 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.02.2014 at 14:32:54,22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

und FRST

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-02-2014
Ran by Marc (administrator) on MARC-PC on 08-02-2014 14:36:26
Running from C:\Users\Marc\Downloads
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal



==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanNetService.exe
(Apple Computer, Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(OsdMaestro) C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Skype Technologies) C:\Program Files\Skype\Plugin Manager\skypePM.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Hewlett-Packard Company) C:\hp\KBD\kbd.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2007-04-18] (Hewlett-Packard Company)
HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
HKLM\...\Run: [OsdMaestro] - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [118784 2007-02-15] (OsdMaestro)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178968 2007-06-14] (Intel Corporation)
HKLM\...\Run: [StartCCC] - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [CCUTRAYICON] - FactoryMode
HKLM\...\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [71176 2007-05-24] (Hewlett-Packard)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [UIExec] - C:\Program Files\1&1 Surf-Stick\UIExec.exe [139088 2010-09-30] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM\...\Run: [SunJavaUpdateReg] - C:\Windows\system32\jureg.exe [54936 2007-04-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [DivXMediaServer] - C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-12-23] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2013-11-15] ()
HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44168 2007-04-03] (soft thinks)
HKU\S-1-5-21-3822891451-4067332824-1385818742-1001\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [15026056 2011-01-26] (Skype Technologies S.A.)
Startup: C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Supermama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {B5719E69-3067-4694-B05B-13687A8B9D40} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie7chrome
SearchScopes: HKCU - {42C5AAAE-C0EA-4047-857B-0EAAFAE8B84F} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {B5719E69-3067-4694-B05B-13687A8B9D40} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie7chrome
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [227328] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [94208] (Apple Computer, Inc.)
Tcpip\..\Interfaces\{652F5BCA-6159-4E8A-A1E7-EE95D0B5CD28}: [NameServer]192.168.178.1,217.237.151.115

FireFox:
========
FF ProfilePath: C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npdeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-09-02]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\tfe7389y.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-01-30]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

S3 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel(R) Corporation)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] ()
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [61440 2007-05-24] (Hewlett-Packard)
S2 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel(R) Corporation)
S3 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel(R) Corporation)
S3 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-08-31] ()
S3 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel(R) Corporation)
S3 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel(R) Corporation)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [253264 2010-09-30] ()
S2 mgisvr; %systemroot%\system32\AR5523.dll [X]
S4 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [X]
S2 veteboot; %systemroot%\system32\diskeeper.dll [X]

==================== Drivers (Whitelisted) ====================

R2 ACEDRV07; C:\Windows\system32\drivers\ACEDRV07.sys [101376 2009-01-08] (Protect Software GmbH)
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [277736 2008-07-30] (Protect Software GmbH)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-10-09] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin)
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-10-09] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [22016 2006-11-02] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Marc\AppData\Local\Temp\catchme.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

NETSVC: mgisvr -> C:\Windows\system32\AR5523.dll ==> No File.
NETSVC: veteboot -> C:\Windows\system32\diskeeper.dll ==> No File.

==================== One Month Created Files and Folders ========

2014-02-08 14:32 - 2014-02-08 14:32 - 00001355 _____ () C:\Users\Marc\Desktop\JRT.txt
2014-02-08 14:30 - 2014-02-08 14:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-08 14:29 - 2014-02-08 14:30 - 01037530 _____ (Thisisu) C:\Users\Marc\Downloads\JRT.exe
2014-02-08 14:23 - 2014-02-08 14:26 - 00000000 ____D () C:\AdwCleaner
2014-02-08 14:23 - 2014-02-08 14:23 - 01166132 _____ () C:\Users\Marc\Downloads\adwcleaner.exe
2014-02-08 13:35 - 2014-02-08 13:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-07 17:47 - 2014-02-07 17:47 - 00014674 _____ () C:\ComboFix.txt
2014-02-07 17:30 - 2014-02-07 17:47 - 00000000 ____D () C:\ComboFix
2014-02-07 17:28 - 2014-02-07 17:29 - 05180173 ____R (Swearware) C:\Users\Marc\Downloads\ComboFix.exe
2014-02-06 20:48 - 2014-02-08 14:36 - 00013006 _____ () C:\Users\Marc\Downloads\FRST.txt
2014-02-06 20:48 - 2014-02-08 14:36 - 00000000 ____D () C:\FRST
2014-02-06 20:48 - 2014-02-06 20:49 - 00032060 _____ () C:\Users\Marc\Downloads\Addition.txt
2014-02-06 20:47 - 2014-02-06 20:47 - 01136640 _____ (Farbar) C:\Users\Marc\Downloads\FRST.exe
2014-02-01 01:45 - 2014-02-01 02:03 - 00196608 _____ () C:\Windows\SPInstall.etl
2014-02-01 01:45 - 2014-02-01 01:45 - 00000000 ____D () C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 01:44 - 2014-02-01 02:42 - 00000000 ____D () C:\bcc267867ba709c6bf7f1ea357
2014-02-01 01:20 - 2014-02-01 01:34 - 455611504 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB936330-X86-wave0.exe
2014-01-31 23:22 - 2014-02-01 01:04 - 00000000 ____D () C:\8de10754d4fd5dcb8a1c806fef28
2014-01-30 19:51 - 2014-01-30 19:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-27 17:03 - 2014-01-27 21:49 - 00022832 _____ () C:\Users\Marc\Interview_GESAMT.aup
2014-01-27 17:03 - 2014-01-27 17:03 - 00000000 ____D () C:\Users\Marc\Interview_GESAMT_data
2014-01-23 21:41 - 2014-01-23 21:41 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DivX
2014-01-23 21:40 - 2014-01-23 21:41 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-01-23 21:39 - 2014-01-27 18:38 - 00000005 _____ () C:\Users\Marc\AppData\Roaming\WBPU-TTL.DAT
2014-01-23 21:39 - 2014-01-23 21:39 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 21:38 - 2014-02-08 14:13 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DigitalSites
2014-01-23 21:38 - 2014-01-23 21:42 - 00000000 ____D () C:\ProgramData\DivX
2014-01-23 21:38 - 2014-01-23 21:42 - 00000000 ____D () C:\Program Files\DivX
2014-01-23 21:38 - 2014-01-23 21:38 - 00715038 _____ () C:\Windows\unins000.exe
2014-01-23 21:38 - 2014-01-23 21:38 - 00001782 _____ () C:\Windows\unins000.dat
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\LavFilters
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\CDXReader
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Xvid
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\OpenSource Flash Video Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Lame For Audacity
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Haali
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\ffdshow
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DSP-worx
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DirectVobSub
2014-01-23 21:38 - 2012-02-26 16:47 - 00079360 _____ () C:\Windows\system32\ff_vfw.dll
2014-01-23 21:38 - 2012-01-09 20:45 - 00178688 _____ () C:\Windows\system32\unrar.dll
2014-01-23 21:38 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\system32\lagarith.dll
2014-01-23 21:38 - 2011-05-30 14:42 - 00240640 _____ () C:\Windows\system32\xvidvfw.dll
2014-01-23 21:38 - 2011-05-23 10:52 - 00153088 _____ () C:\Windows\system32\xvid.ax
2014-01-23 21:38 - 2011-05-23 08:46 - 00645632 _____ () C:\Windows\system32\xvidcore.dll
2014-01-23 21:37 - 2014-01-27 18:38 - 00000147 _____ () C:\Users\Marc\AppData\Roaming\WB.CFG
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\FoxTab
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Program Files\Foxtab
2014-01-23 21:36 - 2014-01-23 21:36 - 00686024 _____ () C:\Users\Marc\Downloads\CodecPackage.exe
2014-01-23 21:05 - 2014-01-23 21:28 - 00062758 _____ () C:\Users\Marc\Interview.aup
2014-01-23 21:05 - 2014-01-23 21:05 - 00000000 ____D () C:\Users\Marc\Interview_data
2014-01-11 16:43 - 2014-01-11 16:43 - 01477844 _____ () C:\Users\Marc\test 1.wav
2014-01-11 16:36 - 2014-01-27 22:13 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Audacity
2014-01-11 16:34 - 2014-01-11 16:34 - 00000766 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-01-11 16:34 - 2014-01-11 16:34 - 00000000 ____D () C:\Program Files\Audacity
2014-01-11 16:29 - 2014-01-11 16:34 - 22308174 _____ (Audacity Team ) C:\Users\Marc\Desktop\audacity-win-2-0-4.exe

==================== One Month Modified Files and Folders =======

2014-02-08 14:36 - 2014-02-06 20:48 - 00013006 _____ () C:\Users\Marc\Downloads\FRST.txt
2014-02-08 14:36 - 2014-02-06 20:48 - 00000000 ____D () C:\FRST
2014-02-08 14:35 - 2011-01-26 16:46 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{8FF0CDE9-A183-482B-A8CB-7957D06F595F}.job
2014-02-08 14:32 - 2014-02-08 14:32 - 00001355 _____ () C:\Users\Marc\Desktop\JRT.txt
2014-02-08 14:31 - 2007-09-19 03:08 - 01937815 _____ () C:\Windows\WindowsUpdate.log
2014-02-08 14:30 - 2014-02-08 14:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-08 14:30 - 2014-02-08 14:29 - 01037530 _____ (Thisisu) C:\Users\Marc\Downloads\JRT.exe
2014-02-08 14:28 - 2011-02-07 22:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Skype
2014-02-08 14:27 - 2011-12-18 23:00 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-08 14:27 - 2007-09-10 11:31 - 00000000 ____D () C:\Windows\SMINST
2014-02-08 14:27 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-08 14:27 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-08 14:27 - 2006-11-02 13:47 - 00003456 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-08 14:26 - 2014-02-08 14:23 - 00000000 ____D () C:\AdwCleaner
2014-02-08 14:26 - 2006-11-02 14:01 - 00032634 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-08 14:23 - 2014-02-08 14:23 - 01166132 _____ () C:\Users\Marc\Downloads\adwcleaner.exe
2014-02-08 14:15 - 2007-09-10 11:33 - 00157328 _____ () C:\Windows\PFRO.log
2014-02-08 14:13 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DigitalSites
2014-02-08 14:13 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-02-08 13:47 - 2011-12-18 23:00 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-08 13:42 - 2013-06-11 17:59 - 00000868 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-08 13:42 - 2013-06-11 17:59 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-08 13:39 - 2014-02-08 13:35 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 13:29 - 2011-02-07 22:40 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\skypePM
2014-02-07 17:47 - 2014-02-07 17:47 - 00014674 _____ () C:\ComboFix.txt
2014-02-07 17:47 - 2014-02-07 17:30 - 00000000 ____D () C:\ComboFix
2014-02-07 17:47 - 2013-06-11 13:54 - 00000000 ____D () C:\Qoobox
2014-02-07 17:43 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-02-07 17:29 - 2014-02-07 17:28 - 05180173 ____R (Swearware) C:\Users\Marc\Downloads\ComboFix.exe
2014-02-06 20:49 - 2014-02-06 20:48 - 00032060 _____ () C:\Users\Marc\Downloads\Addition.txt
2014-02-06 20:47 - 2014-02-06 20:47 - 01136640 _____ (Farbar) C:\Users\Marc\Downloads\FRST.exe
2014-02-06 20:45 - 2013-06-12 09:10 - 00000000 ____D () C:\Users\Marc\Desktop\Alles
2014-02-06 20:44 - 2011-07-08 12:23 - 00000000 ____D () C:\Users\Marc\Desktop\Sprachdemo
2014-02-01 02:44 - 2011-01-23 15:57 - 00000000 ____D () C:\Users\Supermama
2014-02-01 02:44 - 2008-01-07 23:01 - 00000000 ____D () C:\Users\Lucky Luke
2014-02-01 02:44 - 2007-12-05 23:24 - 00000000 ____D () C:\Users\Marc
2014-02-01 02:44 - 2007-09-10 11:04 - 00000000 ___HD () C:\Users\IUSR_NMPR
2014-02-01 02:44 - 2006-11-02 11:22 - 42467328 _____ () C:\Windows\system32\config\software_previous
2014-02-01 02:44 - 2006-11-02 11:22 - 21757952 _____ () C:\Windows\system32\config\system_previous
2014-02-01 02:43 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\MSN
2014-02-01 02:42 - 2014-02-01 01:44 - 00000000 ____D () C:\bcc267867ba709c6bf7f1ea357
2014-02-01 02:42 - 2010-12-27 12:15 - 00000000 ____D () C:\Program Files\1&1 Surf-Stick
2014-02-01 02:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool
2014-02-01 02:40 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-02-01 02:40 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Photo Gallery
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\IME
2014-02-01 02:40 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-02-01 02:31 - 2006-11-02 11:22 - 41418752 _____ () C:\Windows\system32\config\components_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-02-01 02:31 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-02-01 02:26 - 2006-11-02 13:52 - 00127811 _____ () C:\Windows\setupact.log
2014-02-01 02:03 - 2014-02-01 01:45 - 00196608 _____ () C:\Windows\SPInstall.etl
2014-02-01 01:45 - 2014-02-01 01:45 - 00000000 ____D () C:\ffefc8bf9a0c4c76d826da815550ff76
2014-02-01 01:34 - 2014-02-01 01:20 - 455611504 _____ (Microsoft Corporation) C:\Users\Marc\Downloads\Windows6.0-KB936330-X86-wave0.exe
2014-02-01 01:04 - 2014-01-31 23:22 - 00000000 ____D () C:\8de10754d4fd5dcb8a1c806fef28
2014-01-31 18:50 - 2012-08-31 18:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-01-31 18:45 - 2006-11-02 11:33 - 01461736 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-30 19:51 - 2014-01-30 19:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-27 22:13 - 2014-01-11 16:36 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Audacity
2014-01-27 22:04 - 2008-01-18 00:53 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\vlc
2014-01-27 21:49 - 2014-01-27 17:03 - 00022832 _____ () C:\Users\Marc\Interview_GESAMT.aup
2014-01-27 18:38 - 2014-01-23 21:39 - 00000005 _____ () C:\Users\Marc\AppData\Roaming\WBPU-TTL.DAT
2014-01-27 18:38 - 2014-01-23 21:37 - 00000147 _____ () C:\Users\Marc\AppData\Roaming\WB.CFG
2014-01-27 17:03 - 2014-01-27 17:03 - 00000000 ____D () C:\Users\Marc\Interview_GESAMT_data
2014-01-27 16:44 - 2013-08-21 17:20 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-27 16:41 - 2006-11-02 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-01-23 21:42 - 2014-01-23 21:38 - 00000000 ____D () C:\ProgramData\DivX
2014-01-23 21:42 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DivX
2014-01-23 21:41 - 2014-01-23 21:41 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\DivX
2014-01-23 21:41 - 2014-01-23 21:40 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-01-23 21:39 - 2014-01-23 21:39 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\0D0S1L2Z1P1B
2014-01-23 21:38 - 2014-01-23 21:38 - 00715038 _____ () C:\Windows\unins000.exe
2014-01-23 21:38 - 2014-01-23 21:38 - 00001782 _____ () C:\Windows\unins000.dat
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\LavFilters
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\CDXReader
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Xvid
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\OpenSource Flash Video Splitter
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Lame For Audacity
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\Haali
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\ffdshow
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DSP-worx
2014-01-23 21:38 - 2014-01-23 21:38 - 00000000 ____D () C:\Program Files\DirectVobSub
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Users\Marc\AppData\Roaming\FoxTab
2014-01-23 21:37 - 2014-01-23 21:37 - 00000000 ____D () C:\Program Files\Foxtab
2014-01-23 21:36 - 2014-01-23 21:36 - 00686024 _____ () C:\Users\Marc\Downloads\CodecPackage.exe
2014-01-23 21:28 - 2014-01-23 21:05 - 00062758 _____ () C:\Users\Marc\Interview.aup
2014-01-23 21:05 - 2014-01-23 21:05 - 00000000 ____D () C:\Users\Marc\Interview_data
2014-01-11 16:43 - 2014-01-11 16:43 - 01477844 _____ () C:\Users\Marc\test 1.wav
2014-01-11 16:34 - 2014-01-11 16:34 - 00000766 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-01-11 16:34 - 2014-01-11 16:34 - 00000000 ____D () C:\Program Files\Audacity
2014-01-11 16:34 - 2014-01-11 16:29 - 22308174 _____ (Audacity Team ) C:\Users\Marc\Desktop\audacity-win-2-0-4.exe
2014-01-11 16:29 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public

ZeroAccess:
C:\Users\Marc\AppData\Local\e4f44f4f
C:\Users\Marc\AppData\Local\e4f44f4f\@
C:\Users\Marc\AppData\Local\e4f44f4f\loader.tlb

Some content of TEMP:
====================
C:\Users\Marc\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys
[2006-11-02 09:52] - [2006-11-02 10:51] - 0208488 ____A (Microsoft Corporation) 11EF6C1CAEF76B685233450A126125D6



LastRegBack: 2014-02-08 14:33

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Liebe Grüße und schönen Samstag
whis