Wenn ich auf Youtube ein Video schauen möchte, werden komische Sounds abgespielt Die quelle finde ich aber nicht.

Nadir · 06.02.2014, 19:25

Schönen guten Abend,
Ich bin Neu hier, und sage mal ich kenne mich nicht so gut mit Viren/ Virenbekämpfung aus.
Seit gestern Abend habe ich sehr merkwürdige Sounds wenn ich hxxp://www.youtube.com/ besuche, sowas hatte ich noch nie, ich kenne die Ursache nicht genau und habe mir erhofft das mir hier jemand helfen kann bei diesem Problem.

Danke für jede Hilfreiche Antwort.

Mfg: Nadir

Edit: Ich habe auch schon Malwarebytes installiert und es ist kein infiziertes Objekt aufgetaucht.

schrauber · 06.02.2014, 20:25

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Nadir · 06.02.2014, 20:39

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-02-2014
Ran by Nadir (administrator) on NADIR-HP on 06-02-2014 20:29:27
Running from C:\Users\Nadir\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Octoshape ApS) C:\Users\Nadir\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
(Spotify Ltd) C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(RemoteMouse.net) C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.199\deploy\LoLLauncher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.69\deploy\LolClient.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2012-02-21] (EasyBits Software AS)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-04-04] (PDF Complete Inc)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] - C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-29] (Easybits)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-01-28] (Hewlett-Packard)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-11-23] ()
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Spotify] - C:\Users\Nadir\AppData\Roaming\Spotify\Spotify.exe [6118400 2014-01-13] (Spotify Ltd)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1815976 2014-01-27] (Valve Corporation)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Octoshape Streaming Services] - C:\Users\Nadir\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [107800 2011-03-24] (Octoshape ApS)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Spotify Web Helper] - C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-13] (Spotify Ltd)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Facebook Update] - C:\Users\Nadir\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-08-17] (Facebook Inc.)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Remote Mouse] - C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe [1195520 2013-12-14] (RemoteMouse.net)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\MountPoints2: {8d763680-535b-11e2-82cc-80c16ef678ad} - G:\KODAK_Software_Downloader.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM - {6D7D3DA1-5D86-4CF8-B679-21F473A1F0AF} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 - {6D7D3DA1-5D86-4CF8-B679-21F473A1F0AF} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKCU - {6D7D3DA1-5D86-4CF8-B679-21F473A1F0AF} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {B64DF204-09A4-4BBA-B2CF-AF7F869A7ED5} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=78372f29-dba7-4430-b29e-f44f43fc8c04&apn_sauid=3CB92732-DBCF-4960-B003-79499B568A95
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2012-07-06] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR Extension: (YouTube) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-02]
CHR Extension: (AdBlock) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-02-02]
CHR Extension: (Google Wallet) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-10-02]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)
R2 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-04-04] (PDF Complete Inc)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S3 X6va011; \??\C:\windows\SysWOW64\Drivers\X6va011 [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-06 20:29 - 2014-02-06 20:29 - 00016966 _____ () C:\Users\Nadir\Downloads\FRST.txt
2014-02-06 20:29 - 2014-02-06 20:29 - 00000000 ____D () C:\FRST
2014-02-06 20:27 - 2014-02-06 20:27 - 02079744 _____ (Farbar) C:\Users\Nadir\Downloads\FRST64.exe
2014-02-04 21:49 - 2014-02-04 21:49 - 00000704 _____ () C:\windows\PFRO.log
2014-02-04 21:38 - 2014-02-04 21:38 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-04 21:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-02-04 21:36 - 2014-02-04 21:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Nadir\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-04 21:26 - 2014-02-04 21:26 - 00847336 _____ (Google Inc.) C:\Users\Nadir\Downloads\ChromeSetup.exe
2014-02-02 12:17 - 2014-02-06 18:24 - 00001344 _____ () C:\windows\setupact.log
2014-02-02 12:17 - 2014-02-02 12:17 - 00000000 _____ () C:\windows\setuperr.log
2014-02-01 18:35 - 2014-02-01 18:35 - 00000000 __SHD () C:\oqvlquojrr
2014-01-31 19:02 - 2014-01-31 19:26 - 75490253 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part2.rar
2014-01-31 09:09 - 2014-01-31 20:16 - 00000000 ____D () C:\Users\Nadir\Desktop\Pa Sports - H.A.Z.E
2014-01-31 08:35 - 2014-01-31 09:09 - 104857600 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part1.rar
2014-01-26 22:15 - 2014-01-26 22:15 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iTunes
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iPod
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-18 20:57 - 2014-01-18 20:57 - 00001353 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-01-18 20:57 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA Corporation
2014-01-18 20:57 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\windows\system32\D3DX9_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\windows\system32\d3dx10_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx10_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\windows\system32\d3dx11_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx11_43.dll
2014-01-18 20:56 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA
2014-01-18 20:56 - 2014-01-18 20:56 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-01-18 20:56 - 2013-12-10 03:15 - 00982232 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvspcap.dll
2014-01-18 20:56 - 2013-12-10 03:14 - 01100248 _____ (NVIDIA Corporation) C:\windows\system32\nvspcap64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\windows\system32\nvcompiler.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcompiler.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvwgf2um.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2014-01-18 20:53 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvenc.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvenc.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02698272 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvapi.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6433221.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6433221.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01242400 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvumdshim.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00317472 _____ (NVIDIA Corporation) C:\windows\system32\nvoglshim64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00266984 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglshim32.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00168616 _____ (NVIDIA Corporation) C:\windows\system32\nvinitx.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00141336 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvinit.dll
2014-01-18 20:53 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvvad64v.sys
2014-01-18 20:53 - 2013-12-05 09:42 - 00035104 _____ (NVIDIA Corporation) C:\windows\system32\nvaudcap64v.dll
2014-01-18 20:53 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvaudcap32v.dll
2014-01-18 20:53 - 2013-11-28 14:38 - 00197408 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvhda64v.sys
2014-01-18 20:53 - 2013-11-28 14:38 - 00031520 _____ (NVIDIA Corporation) C:\windows\system32\nvhdap64.dll
2014-01-18 20:52 - 2014-01-18 20:52 - 00000000 ____D () C:\NVIDIA
2014-01-18 20:49 - 2014-01-18 20:52 - 262041840 _____ (NVIDIA Corporation) C:\Users\Nadir\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-01-17 20:05 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-17 20:05 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-01-17 20:05 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-01-17 20:05 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-01-17 20:04 - 2014-01-17 20:05 - 00005327 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 08:20 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 08:20 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 08:20 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-10 20:09 - 2014-01-10 20:09 - 00007605 _____ () C:\Users\Nadir\AppData\Local\Resmon.ResmonCfg

==================== One Month Modified Files and Folders =======

2014-02-06 20:29 - 2014-02-06 20:29 - 00016966 _____ () C:\Users\Nadir\Downloads\FRST.txt
2014-02-06 20:29 - 2014-02-06 20:29 - 00000000 ____D () C:\FRST
2014-02-06 20:29 - 2012-11-23 13:29 - 00000000 ____D () C:\Users\Nadir\AppData\Local\PMB Files
2014-02-06 20:28 - 2012-11-22 20:28 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Skype
2014-02-06 20:27 - 2014-02-06 20:27 - 02079744 _____ (Farbar) C:\Users\Nadir\Downloads\FRST64.exe
2014-02-06 20:25 - 2013-02-12 16:21 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-02-06 20:05 - 2013-10-07 17:30 - 01668735 _____ () C:\windows\WindowsUpdate.log
2014-02-06 19:35 - 2012-11-23 13:29 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-06 19:31 - 2012-11-22 16:13 - 00001108 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-06 19:07 - 2013-02-15 02:55 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Spotify
2014-02-06 18:49 - 2013-03-08 14:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-06 18:49 - 2012-11-22 16:13 - 00001104 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-06 18:32 - 2009-07-14 05:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-06 18:32 - 2009-07-14 05:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-06 18:25 - 2012-07-06 01:01 - 00000000 ____D () C:\ProgramData\PDFC
2014-02-06 18:24 - 2014-02-02 12:17 - 00001344 _____ () C:\windows\setupact.log
2014-02-06 18:24 - 2012-07-06 00:41 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-06 18:24 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-02-04 23:11 - 2012-11-21 17:09 - 00003930 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{E24A8F9D-BD7B-48C3-BC29-2EC321B2CB51}
2014-02-04 22:25 - 2013-02-12 16:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:25 - 2013-02-12 16:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:25 - 2013-02-12 16:21 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-02-04 21:49 - 2014-02-04 21:49 - 00000704 _____ () C:\windows\PFRO.log
2014-02-04 21:38 - 2014-02-04 21:38 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-04 21:36 - 2014-02-04 21:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Nadir\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-04 21:26 - 2014-02-04 21:26 - 00847336 _____ (Google Inc.) C:\Users\Nadir\Downloads\ChromeSetup.exe
2014-02-04 21:26 - 2012-11-22 16:13 - 00004104 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-04 21:26 - 2012-11-22 16:13 - 00003852 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-04 20:54 - 2013-08-17 19:49 - 00000928 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000UA.job
2014-02-04 20:54 - 2013-08-17 19:49 - 00000906 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000Core.job
2014-02-04 18:31 - 2012-11-21 17:08 - 00003186 _____ () C:\windows\System32\Tasks\HPCeeScheduleForNadir
2014-02-04 18:31 - 2012-11-21 17:08 - 00000332 _____ () C:\windows\Tasks\HPCeeScheduleForNadir.job
2014-02-02 12:17 - 2014-02-02 12:17 - 00000000 _____ () C:\windows\setuperr.log
2014-02-01 18:35 - 2014-02-01 18:35 - 00000000 __SHD () C:\oqvlquojrr
2014-02-01 08:36 - 2012-12-06 20:32 - 00000000 ____D () C:\Program Files\MyDefrag v4.3.1
2014-01-31 20:16 - 2014-01-31 09:09 - 00000000 ____D () C:\Users\Nadir\Desktop\Pa Sports - H.A.Z.E
2014-01-31 19:26 - 2014-01-31 19:02 - 75490253 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part2.rar
2014-01-31 09:09 - 2014-01-31 08:35 - 104857600 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part1.rar
2014-01-30 18:31 - 2013-01-31 13:50 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-01-30 18:31 - 2012-11-22 16:33 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-01-30 18:30 - 2012-11-22 16:31 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\HpUpdate
2014-01-30 18:30 - 2012-11-22 16:31 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\HP Support Assistant
2014-01-26 22:15 - 2014-01-26 22:15 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iTunes
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iPod
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-26 22:13 - 2013-10-26 15:18 - 00000000 ____D () C:\ProgramData\Apple
2014-01-25 15:41 - 2012-11-22 16:33 - 00003218 _____ () C:\windows\System32\Tasks\HPCeeScheduleForNADIR-HP$
2014-01-25 15:41 - 2012-11-22 16:33 - 00000342 _____ () C:\windows\Tasks\HPCeeScheduleForNADIR-HP$.job
2014-01-20 13:23 - 2013-02-15 02:55 - 00000000 ____D () C:\Users\Nadir\AppData\Local\Spotify
2014-01-18 20:57 - 2014-01-18 20:57 - 00001353 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-01-18 20:57 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA Corporation
2014-01-18 20:57 - 2014-01-18 20:56 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA
2014-01-18 20:57 - 2012-07-06 00:40 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-01-18 20:56 - 2014-01-18 20:56 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-01-18 20:56 - 2012-07-06 00:40 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-01-18 20:56 - 2012-07-06 00:40 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-01-18 20:52 - 2014-01-18 20:52 - 00000000 ____D () C:\NVIDIA
2014-01-18 20:52 - 2014-01-18 20:49 - 262041840 _____ (NVIDIA Corporation) C:\Users\Nadir\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-01-18 20:45 - 2012-11-22 19:52 - 00000000 ____D () C:\Users\Nadir\AppData\Local\CrashDumps
2014-01-18 20:45 - 2011-02-11 18:00 - 00000000 ____D () C:\windows\Panther
2014-01-18 15:49 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2014-01-17 20:11 - 2013-10-22 13:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-17 20:05 - 2014-01-17 20:04 - 00005327 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-17 20:05 - 2013-10-22 13:23 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-15 17:19 - 2009-07-14 05:45 - 00275856 _____ () C:\windows\system32\FNTCACHE.DAT
2014-01-15 10:08 - 2013-08-15 02:01 - 00000000 ____D () C:\windows\system32\MRT
2014-01-15 10:07 - 2012-11-22 16:43 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-14 00:52 - 2013-09-19 02:08 - 00000000 ____D () C:\Users\Nadir\Desktop\Elophant
2014-01-10 20:09 - 2014-01-10 20:09 - 00007605 _____ () C:\Users\Nadir\AppData\Local\Resmon.ResmonCfg

Files to move or delete:
====================
C:\Users\Nadir\jagex_cl_oldschool_LIVE.dat
C:\Users\Nadir\jagex_cl_runescape_LIVE.dat
C:\Users\Nadir\random.dat


Some content of TEMP:
====================
C:\Users\Nadir\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-30 23:39

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-02-2014
Ran by Nadir at 2014-02-06 20:30:49
Running from C:\Users\Nadir\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Age of Empires Online (x32 Version:  - Microsoft)
Apple Application Support (x32 Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Cake Mania (x32 Version: 2.2.0.98 - WildTangent) Hidden
CCleaner (Version: 3.25 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Counter-Strike: Source (x32 Version:  - Valve)
Counter-Strike: Source Beta (x32 Version:  - Valve)
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Dream Builder: Amusement Park (x32 Version: 3.0.2.32 - WildTangent) Hidden
Facebook (x32 Version: 1.1.0004 - Hewlett-Packard)
Facebook Video Calling 2.0.0.447 (x32 Version: 2.0.447 - Skype Limited)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.97 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fishdom (TM) 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (x32 Version: 32.0.1700.107 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Grand Theft Auto San Andreas (x32 Version: 1.00.00001 - Rockstar Games)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Calendar (x32 Version: 5.1.4245.23508 - Hewlett-Packard)
HP Clock (x32 Version: 5.1.4281.27332 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Games (x32 Version: 1.0.2.5 - WildTangent)
HP LinkUp (x32 Version: 2.01.029 - Hewlett-Packard)
HP Magic Canvas (x32 Version: 5.1.15.0 - Hewlett-Packard)
HP Magic Canvas Tutorials (x32 Version: 6.0.0.0 - Hewlett-Packard)
HP Notes (x32 Version: 5.1.4274.30382 - Hewlett-Packard)
HP Odometer (x32 Version: 2.10.0000 - Hewlett-Packard)
HP RSS (x32 Version: 5.1.4289.23799 - Hewlett-Packard)
HP Setup (x32 Version: 9.1.15430.4033 - Hewlett-Packard Company)
HP Support Assistant (x32 Version: 7.0.39.15 - Hewlett-Packard Company)
HP Support Information (x32 Version: 11.00.0001 - Hewlett-Packard)
HP TouchSmart Background - Beats (x32 Version: 1.0.1.0 - Hewlett-Packard)
HP TouchSmart RecipeBox (x32 Version: 3.0.3830.27730 - Hewlett-Packard)
HP Update (x32 Version: 5.003.001.001 - Hewlett-Packard)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Management Engine Components (x32 Version: 8.0.0.1351 - Intel Corporation)
iTunes (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest II (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (x32 Version: 2.5.4507 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.4507 - CyberLink Corp.) Hidden
League of Legends (x32 Version: 1.3 - Riot Games)
Magic Desktop (x32 Version: 3.0 - EasyBits Software AS)
Mahjongg Artifacts (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Mathematics (x32 Version: 4.0 - Microsoft Corporation)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
MP4 To MP3 Converter V3.0 (x32 Version:  - hxxp://www.MP4ToMP3Converter.net)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MyDefrag v4.3.1 (Version: 4.0.0.0 - J.C. Kessels)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Norton Online Backup (x32 Version: 2.1.17869 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
Octoshape Streaming Services (HKCU Version:  - Octoshape ApS)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
Pando Media Booster (x32 Version: 2.6.0.8 - Pando Networks Inc.)
PDF Complete Corporate Edition (x32 Version: 4.0.95 - PDF Complete, Inc)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Power2Go (x32 Version: 6.1.6207 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.6207 - CyberLink Corp.) Hidden
Ranch Rush 2 - Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Recovery Manager (x32 Version: 5.5.0.5119 - CyberLink Corp.) Hidden
Remote Graphics Receiver (x32 Version: 5.4.5 - Hewlett-Packard)
Remote Mouse version 2.5 (x32 Version: 2.5 - Remote Mouse)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype Click to Call (x32 Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
Team Fortress 2 (x32 Version:  - Valve)
TI USB 3.0 Host Controller Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.3000.132 - TuneUp Software) Hidden
Unity Web Player (HKCU Version:  - Unity Technologies ApS)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Families (x32 Version: 2.2.0.98 - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden
WildTangent-Spiele (x32 Version: 1.0.4.0 - WildTangent)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
WinZip 16.0 (Version: 16.0.9715 - WinZip Computing, S.L. )
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Restore Points  =========================

28-01-2014 12:56:08 Windows Update
02-02-2014 18:52:37 Windows-Sicherung
04-02-2014 13:58:37 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1C347587-C1F3-461A-938C-1003EFC3D060} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {21AFD6AA-05D6-46BD-8A7E-060E715A42C8} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000Core => C:\Users\Nadir\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-17] (Facebook Inc.)
Task: {2A28A51A-5854-4749-A722-17A17E29415B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-11-22] (Hewlett-Packard)
Task: {4105B811-2863-40B4-AF8E-EB91EF4B7379} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {436378FD-7B7A-44ED-AB9C-5BBD35DB30BE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {668112AB-4A32-484B-AEAA-93503866EFD8} - System32\Tasks\MyDefrag v4.3.1 Daily => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticDaily.MyD [2010-05-21] ()
Task: {6F48D69E-F7CA-4047-8206-29220D733AFA} - System32\Tasks\HPCeeScheduleForNadir => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {77F7620C-D12E-4EFB-AE8A-491A833A670D} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-04] (Adobe Systems Incorporated)
Task: {7C2D6C05-ED08-4033-97FE-4F1C965F23B2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {879FF816-FCD6-44F0-A912-3ABFD74EB1D1} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {A147D1B9-AED8-41D5-AB18-CFFD6A43E8B1} - System32\Tasks\MyDefrag v4.3.1 Monthly => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticMonthly.MyD [2010-05-21] ()
Task: {AD1BE51C-DEF3-4397-AAEF-19EDCF6F3231} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-04] (Google Inc.)
Task: {B975866E-7FC6-4702-BC0D-C04DDE7913F8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-04] (Google Inc.)
Task: {C31B0E41-B805-4AFF-BEBC-30AD2B402AEC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-09-23] (Hewlett-Packard Company)
Task: {C4A5090F-7B1D-427A-8658-EE570C2F1A17} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-11-23] (Piriform Ltd)
Task: {CE4A90FB-947D-4971-820B-5013E2A897B7} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000UA => C:\Users\Nadir\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-17] (Facebook Inc.)
Task: {D0107CAF-3D92-4111-B7EC-C41160C40781} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-11-22] (Hewlett-Packard)
Task: {E1D380A3-5F64-47E1-9D82-7F360C0463E8} - System32\Tasks\HP-Online-Aktualisierungsprogramm => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2011-05-10] (Hewlett-Packard)
Task: {E928F3F9-F0DD-45B7-8C49-78F6658C033E} - System32\Tasks\HPCeeScheduleForNADIR-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {F40D5D05-922E-4C03-9054-1D98BBBB650F} - System32\Tasks\RMCreator => C:\Program Files (x86)\Hewlett-Packard\Recovery\Reminder.exe [2012-03-19] (CyberLink)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000Core.job => C:\Users\Nadir\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000UA.job => C:\Users\Nadir\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForNADIR-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\HPCeeScheduleForNadir.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2013-01-22 14:31 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-01-08 19:52 - 2013-12-12 23:19 - 00142848 _____ () C:\Program Files (x86)\Steam\libavresample-1.dll
2014-01-08 19:52 - 2013-11-05 02:12 - 00890592 _____ () C:\Program Files (x86)\Steam\libavutil-52.dll
2013-03-12 17:10 - 2014-01-11 00:33 - 00717312 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2013-02-25 07:39 - 2014-01-27 20:02 - 01138088 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-02-19 11:48 - 2014-01-11 00:33 - 20625832 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2012-12-11 09:51 - 2013-06-15 00:49 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll
2012-12-11 09:51 - 2013-06-15 00:49 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll
2012-12-11 09:51 - 2013-06-15 00:49 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll
2014-01-06 04:52 - 2013-11-19 22:34 - 00152576 _____ () C:\Program Files (x86)\Remote Mouse\FileS.dll
2014-02-04 21:27 - 2014-02-02 00:41 - 00715592 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\libglesv2.dll
2014-02-04 21:27 - 2014-02-02 00:41 - 00100168 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\libegl.dll
2014-02-04 21:27 - 2014-02-02 00:42 - 04055368 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll
2014-02-04 21:27 - 2014-02-02 00:42 - 00399688 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll
2014-02-04 21:27 - 2014-02-02 00:41 - 01634632 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ffmpegsumo.dll
2013-09-04 21:09 - 2014-02-05 19:07 - 00192864 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.199\deploy\RiotLauncher.dll
2014-01-17 09:08 - 2013-07-10 13:56 - 04774248 _____ () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.69\deploy\Adobe AIR\Versions\1.0\Resources\WebKit.dll
2014-02-04 21:27 - 2014-02-02 00:42 - 13616456 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/06/2014 06:49:31 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (02/06/2014 06:45:10 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31185

Error: (02/06/2014 06:45:10 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 31185

Error: (02/06/2014 06:45:10 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/06/2014 06:44:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15585

Error: (02/06/2014 06:44:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15585

Error: (02/06/2014 06:44:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/05/2014 06:22:41 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/05/2014 06:22:07 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (02/04/2014 09:50:57 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall


System errors:
=============
Error: (02/05/2014 06:21:17 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst MBAMService erreicht.

Error: (01/30/2014 06:21:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/30/2014 06:21:18 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (01/26/2014 01:49:44 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/15/2014 05:18:22 PM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x8007045b

Error: (01/15/2014 09:42:09 AM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/10/2014 01:16:21 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/08/2014 07:53:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/08/2014 07:53:07 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (01/05/2014 02:45:54 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


Microsoft Office Sessions:
=========================
Error: (02/06/2014 06:49:31 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (02/06/2014 06:45:10 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31185

Error: (02/06/2014 06:45:10 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 31185

Error: (02/06/2014 06:45:10 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/06/2014 06:44:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15585

Error: (02/06/2014 06:44:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15585

Error: (02/06/2014 06:44:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/05/2014 06:22:41 PM) (Source: MsiInstaller)(User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/05/2014 06:22:07 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (02/04/2014 09:50:57 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall


==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 6100.01 MB
Available physical RAM: 3460.05 MB
Total Pagefile: 12198.2 MB
Available Pagefile: 8615.64 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:914.41 GB) (Free:803.4 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:16.88 GB) (Free:2.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 45EE9599)

Partition: GPT Partition Type
==================== End Of Log ============================

Danke für die Schnelle Hilfe!

schrauber · 07.02.2014, 17:12

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Nadir · 07.02.2014, 17:28

Code:

ATTFilter

ComboFix 14-02-05.02 - Nadir 07.02.2014  17:20:26.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6100.3618 [GMT 1:00]
ausgeführt von:: c:\users\Nadir\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
C:\END
c:\windows\SysWow64\fldlckun.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-01-07 bis 2014-02-07  ))))))))))))))))))))))))))))))
.
.
2014-02-07 16:25 . 2014-02-07 16:25	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-02-07 16:24 . 2014-02-07 16:24	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{E8A079DC-061A-47B0-AC27-56216867190F}\offreg.dll
2014-02-07 13:15 . 2013-12-04 03:28	10315576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{E8A079DC-061A-47B0-AC27-56216867190F}\mpengine.dll
2014-02-06 19:29 . 2014-02-06 19:31	--------	d-----w-	C:\FRST
2014-02-04 20:38 . 2014-02-04 20:38	--------	d-----w-	c:\users\Nadir\AppData\Roaming\Malwarebytes
2014-02-04 20:38 . 2014-02-04 20:38	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2014-02-04 20:38 . 2014-02-04 20:38	--------	d-----w-	c:\programdata\Malwarebytes
2014-02-04 20:38 . 2013-04-04 13:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-02-01 17:35 . 2014-02-01 17:35	--------	d-----w-	C:\oqvlquojrr
2014-01-26 21:15 . 2014-01-26 21:15	--------	d-----w-	c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-26 21:15 . 2014-01-26 21:15	--------	d-----w-	c:\program files\iTunes
2014-01-26 21:15 . 2014-01-26 21:15	--------	d-----w-	c:\program files (x86)\iTunes
2014-01-26 21:15 . 2014-01-26 21:15	--------	d-----w-	c:\program files\iPod
2014-01-18 19:57 . 2014-01-18 19:57	--------	d-----w-	c:\users\Nadir\AppData\Local\NVIDIA Corporation
2014-01-18 19:57 . 2010-05-26 10:41	511328	----a-w-	c:\windows\system32\d3dx10_43.dll
2014-01-18 19:57 . 2010-05-26 10:41	470880	----a-w-	c:\windows\SysWow64\d3dx10_43.dll
2014-01-18 19:57 . 2010-05-26 10:41	276832	----a-w-	c:\windows\system32\d3dx11_43.dll
2014-01-18 19:57 . 2010-05-26 10:41	248672	----a-w-	c:\windows\SysWow64\d3dx11_43.dll
2014-01-18 19:57 . 2010-05-26 10:41	1998168	----a-w-	c:\windows\SysWow64\D3DX9_43.dll
2014-01-18 19:57 . 2010-05-26 10:41	2401112	----a-w-	c:\windows\system32\D3DX9_43.dll
2014-01-18 19:56 . 2013-12-10 02:15	982232	----a-w-	c:\windows\SysWow64\nvspcap.dll
2014-01-18 19:56 . 2013-12-10 02:14	1100248	----a-w-	c:\windows\system32\nvspcap64.dll
2014-01-18 19:56 . 2014-01-18 19:57	--------	d-----w-	c:\users\Nadir\AppData\Local\NVIDIA
2014-01-18 19:56 . 2014-01-18 19:56	--------	d-----w-	c:\program files (x86)\AGEIA Technologies
2014-01-18 19:52 . 2014-01-18 19:52	--------	d-----w-	C:\NVIDIA
2014-01-17 19:05 . 2013-12-18 20:09	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-15 07:20 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-15 07:20 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-15 07:20 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-15 07:20 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-15 07:20 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-15 07:20 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-15 07:20 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-15 07:20 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-01-15 07:20 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-04 21:25 . 2013-02-12 15:21	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-04 21:25 . 2013-02-12 15:21	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-15 09:07 . 2012-11-22 15:43	86054176	----a-w-	c:\windows\system32\MRT.exe
2013-12-19 20:33 . 2012-03-15 04:59	3071656	----a-w-	c:\windows\system32\nvapi64.dll
2013-12-19 20:33 . 2012-03-15 04:59	18310112	----a-w-	c:\windows\system32\nvwgf2umx.dll
2013-12-19 20:33 . 2012-03-15 04:59	15230352	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2013-12-19 20:33 . 2012-03-15 04:59	1436528	----a-w-	c:\windows\system32\nvumdshimx.dll
2013-12-19 18:53 . 2012-07-05 23:41	6671648	----a-w-	c:\windows\system32\nvcpl.dll
2013-12-19 18:53 . 2012-07-05 23:41	3490080	----a-w-	c:\windows\system32\nvsvc64.dll
2013-12-19 18:53 . 2012-07-05 23:41	922912	----a-w-	c:\windows\system32\nvvsvc.exe
2013-12-19 18:53 . 2012-07-05 23:41	63776	----a-w-	c:\windows\system32\nvshext.dll
2013-12-19 18:53 . 2012-07-05 23:41	386336	----a-w-	c:\windows\system32\nvmctray.dll
2013-12-19 18:53 . 2012-07-05 23:41	2559776	----a-w-	c:\windows\system32\nvsvcr.dll
2013-12-19 11:20 . 2013-12-19 11:20	590112	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2013-12-19 05:01 . 2012-07-05 23:41	3539040	----a-w-	c:\windows\system32\nvcoproc.bin
2013-12-18 05:13 . 2010-11-21 03:27	270496	------w-	c:\windows\system32\MpSigStub.exe
2013-12-17 14:22 . 2013-05-07 14:17	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-12-17 14:22 . 2013-04-01 11:45	131576	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-12-17 14:22 . 2013-04-01 11:45	108440	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-12-03 21:48 . 2013-12-03 21:48	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-03 21:48 . 2013-12-03 21:48	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-12-03 21:48 . 2013-12-03 21:48	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2013-12-03 21:48 . 2013-12-03 21:48	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-03 21:48 . 2013-12-03 21:48	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-03 21:48 . 2013-12-03 21:48	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2013-12-03 21:48 . 2013-12-03 21:48	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-12-03 21:48 . 2013-12-03 21:48	61952	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2013-12-03 21:48 . 2013-12-03 21:48	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2013-12-03 21:48 . 2013-12-03 21:48	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2013-12-03 21:48 . 2013-12-03 21:48	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-12-03 21:48 . 2013-12-03 21:48	454656	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-12-03 21:48 . 2013-12-03 21:48	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-12-03 21:48 . 2013-12-03 21:48	34816	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-03 21:48 . 2013-12-03 21:48	337408	----a-w-	c:\windows\SysWow64\html.iec
2013-12-03 21:48 . 2013-12-03 21:48	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-12-03 21:48 . 2013-12-03 21:48	235008	----a-w-	c:\windows\system32\elshyph.dll
2013-12-03 21:48 . 2013-12-03 21:48	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2013-12-03 21:48 . 2013-12-03 21:48	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-12-03 21:48 . 2013-12-03 21:48	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2013-12-03 21:48 . 2013-12-03 21:48	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2013-12-03 21:48 . 2013-12-03 21:48	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-12-03 21:48 . 2013-12-03 21:48	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-12-03 21:48 . 2013-12-03 21:48	1051136	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-12-03 21:48 . 2013-12-03 21:48	942592	----a-w-	c:\windows\system32\jsIntl.dll
2013-12-03 21:48 . 2013-12-03 21:48	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-12-03 21:48 . 2013-12-03 21:48	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2013-12-03 21:48 . 2013-12-03 21:48	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-12-03 21:48 . 2013-12-03 21:48	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-12-03 21:48 . 2013-12-03 21:48	247808	----a-w-	c:\windows\system32\msls31.dll
2013-12-03 21:48 . 2013-12-03 21:48	195584	----a-w-	c:\windows\system32\msrating.dll
2013-12-03 21:48 . 2013-12-03 21:48	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2013-12-03 21:48 . 2013-12-03 21:48	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-12-03 21:48 . 2013-12-03 21:48	105984	----a-w-	c:\windows\system32\iesysprep.dll
2013-12-03 21:48 . 2013-12-03 21:48	84992	----a-w-	c:\windows\system32\mshtmled.dll
2013-12-03 21:48 . 2013-12-03 21:48	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2013-12-03 21:48 . 2013-12-03 21:48	81408	----a-w-	c:\windows\system32\icardie.dll
2013-12-03 21:48 . 2013-12-03 21:48	774144	----a-w-	c:\windows\system32\jscript.dll
2013-12-03 21:48 . 2013-12-03 21:48	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-12-03 21:48 . 2013-12-03 21:48	626176	----a-w-	c:\windows\system32\msfeeds.dll
2013-12-03 21:48 . 2013-12-03 21:48	62464	----a-w-	c:\windows\system32\pngfilt.dll
2013-12-03 21:48 . 2013-12-03 21:48	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2013-12-03 21:48 . 2013-12-03 21:48	548352	----a-w-	c:\windows\system32\vbscript.dll
2013-12-03 21:48 . 2013-12-03 21:48	453120	----a-w-	c:\windows\system32\dxtmsft.dll
2013-12-03 21:48 . 2013-12-03 21:48	413696	----a-w-	c:\windows\system32\html.iec
2013-12-03 21:48 . 2013-12-03 21:48	40448	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-03 21:48 . 2013-12-03 21:48	30208	----a-w-	c:\windows\system32\licmgr10.dll
2013-12-03 21:48 . 2013-12-03 21:48	296960	----a-w-	c:\windows\system32\dxtrans.dll
2013-12-03 21:48 . 2013-12-03 21:48	263376	----a-w-	c:\windows\system32\iedkcs32.dll
2013-12-03 21:48 . 2013-12-03 21:48	243200	----a-w-	c:\windows\system32\webcheck.dll
2013-12-03 21:48 . 2013-12-03 21:48	235520	----a-w-	c:\windows\system32\url.dll
2013-12-03 21:48 . 2013-12-03 21:48	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-12-03 21:48 . 2013-12-03 21:48	147968	----a-w-	c:\windows\system32\occache.dll
2013-12-03 21:48 . 2013-12-03 21:48	143872	----a-w-	c:\windows\system32\wextract.exe
2013-12-03 21:48 . 2013-12-03 21:48	13824	----a-w-	c:\windows\system32\mshta.exe
2013-12-03 21:48 . 2013-12-03 21:48	1228800	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-12-03 21:48 . 2013-12-03 21:48	101376	----a-w-	c:\windows\system32\inseng.dll
2013-12-03 21:48 . 2013-12-03 21:48	48128	----a-w-	c:\windows\system32\imgutil.dll
2013-12-03 21:48 . 2013-12-03 21:48	135680	----a-w-	c:\windows\system32\iepeers.dll
2013-11-27 11:02 . 2013-04-01 11:45	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-11-26 11:54 . 2013-12-12 01:10	23183360	----a-w-	c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-12 01:10	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-12 01:10	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-12 01:10	66048	----a-w-	c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-12 01:10	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-12 01:10	2764288	----a-w-	c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-12 01:10	53760	----a-w-	c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-12 01:10	33792	----a-w-	c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-12 01:10	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-12 01:10	574976	----a-w-	c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-12 01:10	139264	----a-w-	c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-12 01:10	111616	----a-w-	c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-12 01:10	708608	----a-w-	c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-12 01:10	218624	----a-w-	c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-12 01:10	5769216	----a-w-	c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-12 01:10	553472	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 01:10	4243968	----a-w-	c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-12 01:10	1995264	----a-w-	c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-12 01:10	12996608	----a-w-	c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-12 01:10	1928192	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-12 01:10	2334208	----a-w-	c:\windows\system32\wininet.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2012-11-23 3093624]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-11-14 20584608]
"Spotify"="c:\users\Nadir\AppData\Roaming\Spotify\Spotify.exe" [2014-01-13 6118400]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2014-01-27 1815976]
"Octoshape Streaming Services"="c:\users\Nadir\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2011-03-24 107800]
"Spotify Web Helper"="c:\users\Nadir\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-01-13 1171968]
"Remote Mouse"="c:\program files (x86)\Remote Mouse\RemoteMouse.exe" [2013-12-14 1195520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2012-02-21 61112]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2012-04-04 684024]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-17 684600]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-01-20 43848]
"Magic Desktop for HP notification"="c:\programdata\Easybits Magic Desktop for HP\mdhpSUN.exe" [2013-12-29 1258504]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-01-20 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 tihub3;TI USB3 Hub Service;c:\windows\system32\drivers\tihub3.sys;c:\windows\SYSNATIVE\drivers\tihub3.sys [x]
S3 tixhci;TI XHCI Service;c:\windows\system32\drivers\tixhci.sys;c:\windows\SYSNATIVE\drivers\tixhci.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-04 20:27	1211720	----a-w-	c:\program files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-05 21:25]
.
2014-02-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000Core.job
- c:\users\Nadir\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-17 18:49]
.
2014-02-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000UA.job
- c:\users\Nadir\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-17 18:49]
.
2014-02-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-02-04 20:26]
.
2014-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-02-04 20:26]
.
2014-01-25 c:\windows\Tasks\HPCeeScheduleForNADIR-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 11:43]
.
2014-02-04 c:\windows\Tasks\HPCeeScheduleForNadir.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 11:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-03-30 1425408]
"BeatsOSDApp"="c:\program files\IDT\WDM\beats64.exe" [2012-03-30 37888]
"HPSYSDRV"="c:\program files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE" [2008-11-20 62768]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="c:\program files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-01-28 21720]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{438363A8-F486-4C37-834C-4955773CB3D3} - msiexec
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-02-07  17:26:47
ComboFix-quarantined-files.txt  2014-02-07 16:26
.
Vor Suchlauf: 12 Verzeichnis(se), 869.464.944.640 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 869.568.888.832 Bytes frei
.
- - End Of File - - A4CA1D17A66CB3B561FBE0CE546B40D3
5FB38429D5D77768867C76DCBDB35194

Hier der Log vielen dank für die Mühe wirklich.

schrauber · 08.02.2014, 13:14

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Nadir · 08.02.2014, 19:03

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.08.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Nadir :: NADIR-HP [Administrator]

Schutz: Aktiviert

08.02.2014 18:39:18
mbam-log-2014-02-08 (18-39-18).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 217509
Laufzeit: 7 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:

ATTFilter

# AdwCleaner v3.018 - Bericht erstellt am 08/02/2014 um 18:34:57
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Nadir - NADIR-HP
# Gestartet von : C:\Users\Nadir\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_avira-free-antivirus-2013 (1)_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_avira-free-antivirus-2013 (1)_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKCU\Software\Softonic

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Google Chrome v32.0.1700.107

[ Datei : C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [4733 octets] - [08/02/2014 18:33:38]
AdwCleaner[S0].txt - [4154 octets] - [08/02/2014 18:34:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4214 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Home Premium x64
Ran by Nadir on 08.02.2014 at 18:51:46,21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6D7D3DA1-5D86-4CF8-B679-21F473A1F0AF}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B64DF204-09A4-4BBA-B2CF-AF7F869A7ED5}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6D7D3DA1-5D86-4CF8-B679-21F473A1F0AF}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Nadir\appdata\local\apn"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.02.2014 at 18:56:58,89
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-02-2014
Ran by Nadir (administrator) on NADIR-HP on 08-02-2014 19:00:00
Running from C:\Users\Nadir\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Spotify Ltd) C:\Users\Nadir\AppData\Roaming\Spotify\spotify.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Octoshape ApS) C:\Users\Nadir\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
(Spotify Ltd) C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(RemoteMouse.net) C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwsc.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2012-02-21] (EasyBits Software AS)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-04-04] (PDF Complete Inc)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] - C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-29] (Easybits)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-01-28] (Hewlett-Packard)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-11-23] ()
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Spotify] - C:\Users\Nadir\AppData\Roaming\Spotify\Spotify.exe [6118400 2014-01-13] (Spotify Ltd)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1815976 2014-01-27] (Valve Corporation)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Octoshape Streaming Services] - C:\Users\Nadir\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [107800 2011-03-24] (Octoshape ApS)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Spotify Web Helper] - C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-13] (Spotify Ltd)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Remote Mouse] - C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe [1195520 2013-12-14] (RemoteMouse.net)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Policies\system: [DisableChangePassword] 0

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {6D7D3DA1-5D86-4CF8-B679-21F473A1F0AF} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2012-07-06] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR Extension: (YouTube) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-02]
CHR Extension: (AdBlock) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-02-02]
CHR Extension: (Google Wallet) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-10-02]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)
R2 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-04-04] (PDF Complete Inc)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 X6va011; \??\C:\windows\SysWOW64\Drivers\X6va011 [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-08 18:56 - 2014-02-08 18:56 - 00001132 _____ () C:\Users\Nadir\Desktop\JRT.txt
2014-02-08 18:51 - 2014-02-08 18:51 - 00000000 ____D () C:\windows\ERUNT
2014-02-08 18:50 - 2014-02-08 18:50 - 01037530 _____ (Thisisu) C:\Users\Nadir\Downloads\JRT.exe
2014-02-08 18:38 - 2014-02-08 18:38 - 00004318 _____ () C:\Users\Nadir\Desktop\AdwCleaner[S0].txt
2014-02-08 18:32 - 2014-02-08 18:35 - 00000000 ____D () C:\AdwCleaner
2014-02-08 18:31 - 2014-02-08 18:32 - 01166132 _____ () C:\Users\Nadir\Desktop\adwcleaner.exe
2014-02-07 17:26 - 2014-02-07 17:26 - 00029086 _____ () C:\ComboFix.txt
2014-02-07 17:17 - 2011-06-26 07:45 - 00256000 _____ () C:\windows\PEV.exe
2014-02-07 17:17 - 2010-11-07 18:20 - 00208896 _____ () C:\windows\MBR.exe
2014-02-07 17:17 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00098816 _____ () C:\windows\sed.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00080412 _____ () C:\windows\grep.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00068096 _____ () C:\windows\zip.exe
2014-02-07 17:16 - 2014-02-07 17:26 - 00000000 ____D () C:\Qoobox
2014-02-07 17:16 - 2014-02-07 17:25 - 00000000 ____D () C:\windows\erdnt
2014-02-07 17:14 - 2014-02-07 17:14 - 05180173 ____R (Swearware) C:\Users\Nadir\Desktop\ComboFix.exe
2014-02-06 20:33 - 2014-02-08 19:00 - 00014717 _____ () C:\Users\Nadir\Desktop\FRST.txt
2014-02-06 20:33 - 2014-02-06 20:33 - 00028503 _____ () C:\Users\Nadir\Desktop\Addition.txt
2014-02-06 20:30 - 2014-02-06 20:32 - 00028503 _____ () C:\Users\Nadir\Downloads\Addition.txt
2014-02-06 20:29 - 2014-02-08 19:00 - 00000000 ____D () C:\FRST
2014-02-06 20:29 - 2014-02-06 20:32 - 00034498 _____ () C:\Users\Nadir\Downloads\FRST.txt
2014-02-06 20:27 - 2014-02-06 20:27 - 02079744 _____ (Farbar) C:\Users\Nadir\Desktop\FRST64.exe
2014-02-04 21:49 - 2014-02-07 20:17 - 00001250 _____ () C:\windows\PFRO.log
2014-02-04 21:38 - 2014-02-04 21:38 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-04 21:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-02-04 21:36 - 2014-02-04 21:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Nadir\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-04 21:26 - 2014-02-04 21:26 - 00847336 _____ (Google Inc.) C:\Users\Nadir\Downloads\ChromeSetup.exe
2014-02-02 12:17 - 2014-02-08 18:36 - 00001848 _____ () C:\windows\setupact.log
2014-02-02 12:17 - 2014-02-02 12:17 - 00000000 _____ () C:\windows\setuperr.log
2014-02-01 18:35 - 2014-02-01 18:35 - 00000000 ____D () C:\oqvlquojrr
2014-01-31 19:02 - 2014-01-31 19:26 - 75490253 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part2.rar
2014-01-31 09:09 - 2014-01-31 20:16 - 00000000 ____D () C:\Users\Nadir\Desktop\Pa Sports - H.A.Z.E
2014-01-31 08:35 - 2014-01-31 09:09 - 104857600 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part1.rar
2014-01-26 22:15 - 2014-01-26 22:15 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iTunes
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iPod
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-18 20:57 - 2014-01-18 20:57 - 00001353 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-01-18 20:57 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA Corporation
2014-01-18 20:57 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\windows\system32\D3DX9_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\windows\system32\d3dx10_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx10_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\windows\system32\d3dx11_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx11_43.dll
2014-01-18 20:56 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA
2014-01-18 20:56 - 2014-01-18 20:56 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-01-18 20:56 - 2013-12-10 03:15 - 00982232 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvspcap.dll
2014-01-18 20:56 - 2013-12-10 03:14 - 01100248 _____ (NVIDIA Corporation) C:\windows\system32\nvspcap64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\windows\system32\nvcompiler.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcompiler.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvwgf2um.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2014-01-18 20:53 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvenc.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvenc.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02698272 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvapi.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6433221.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6433221.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01242400 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvumdshim.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00317472 _____ (NVIDIA Corporation) C:\windows\system32\nvoglshim64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00266984 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglshim32.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00168616 _____ (NVIDIA Corporation) C:\windows\system32\nvinitx.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00141336 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvinit.dll
2014-01-18 20:53 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvvad64v.sys
2014-01-18 20:53 - 2013-12-05 09:42 - 00035104 _____ (NVIDIA Corporation) C:\windows\system32\nvaudcap64v.dll
2014-01-18 20:53 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvaudcap32v.dll
2014-01-18 20:53 - 2013-11-28 14:38 - 00197408 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvhda64v.sys
2014-01-18 20:53 - 2013-11-28 14:38 - 00031520 _____ (NVIDIA Corporation) C:\windows\system32\nvhdap64.dll
2014-01-18 20:52 - 2014-01-18 20:52 - 00000000 ____D () C:\NVIDIA
2014-01-18 20:49 - 2014-01-18 20:52 - 262041840 _____ (NVIDIA Corporation) C:\Users\Nadir\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-01-17 20:05 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-17 20:05 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-01-17 20:05 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-01-17 20:05 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-01-17 20:04 - 2014-01-17 20:05 - 00005327 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 08:20 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 08:20 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 08:20 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-10 20:09 - 2014-01-10 20:09 - 00007605 _____ () C:\Users\Nadir\AppData\Local\Resmon.ResmonCfg

==================== One Month Modified Files and Folders =======

2014-02-08 19:00 - 2014-02-06 20:33 - 00014717 _____ () C:\Users\Nadir\Desktop\FRST.txt
2014-02-08 19:00 - 2014-02-06 20:29 - 00000000 ____D () C:\FRST
2014-02-08 19:00 - 2012-11-23 13:29 - 00000000 ____D () C:\Users\Nadir\AppData\Local\PMB Files
2014-02-08 18:56 - 2014-02-08 18:56 - 00001132 _____ () C:\Users\Nadir\Desktop\JRT.txt
2014-02-08 18:51 - 2014-02-08 18:51 - 00000000 ____D () C:\windows\ERUNT
2014-02-08 18:50 - 2014-02-08 18:50 - 01037530 _____ (Thisisu) C:\Users\Nadir\Downloads\JRT.exe
2014-02-08 18:48 - 2013-02-15 02:55 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Spotify
2014-02-08 18:45 - 2009-07-14 05:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-08 18:45 - 2009-07-14 05:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-08 18:42 - 2013-10-07 17:30 - 01766006 _____ () C:\windows\WindowsUpdate.log
2014-02-08 18:38 - 2014-02-08 18:38 - 00004318 _____ () C:\Users\Nadir\Desktop\AdwCleaner[S0].txt
2014-02-08 18:38 - 2013-03-08 14:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-08 18:37 - 2012-11-22 16:13 - 00001104 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-08 18:37 - 2012-07-06 01:01 - 00000000 ____D () C:\ProgramData\PDFC
2014-02-08 18:36 - 2014-02-02 12:17 - 00001848 _____ () C:\windows\setupact.log
2014-02-08 18:36 - 2012-07-06 00:41 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-08 18:36 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-02-08 18:35 - 2014-02-08 18:32 - 00000000 ____D () C:\AdwCleaner
2014-02-08 18:32 - 2014-02-08 18:31 - 01166132 _____ () C:\Users\Nadir\Desktop\adwcleaner.exe
2014-02-08 18:31 - 2012-11-22 16:13 - 00001108 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-08 18:31 - 2012-11-21 17:08 - 00003186 _____ () C:\windows\System32\Tasks\HPCeeScheduleForNadir
2014-02-08 18:31 - 2012-11-21 17:08 - 00000332 _____ () C:\windows\Tasks\HPCeeScheduleForNadir.job
2014-02-08 18:28 - 2012-11-21 17:09 - 00003930 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{E24A8F9D-BD7B-48C3-BC29-2EC321B2CB51}
2014-02-08 18:25 - 2013-02-12 16:21 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-02-07 23:09 - 2012-11-23 13:29 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-07 22:42 - 2012-11-22 20:28 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Skype
2014-02-07 20:54 - 2013-08-17 19:49 - 00000928 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000UA.job
2014-02-07 20:54 - 2013-08-17 19:49 - 00000906 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000Core.job
2014-02-07 20:17 - 2014-02-04 21:49 - 00001250 _____ () C:\windows\PFRO.log
2014-02-07 17:26 - 2014-02-07 17:26 - 00029086 _____ () C:\ComboFix.txt
2014-02-07 17:26 - 2014-02-07 17:16 - 00000000 ____D () C:\Qoobox
2014-02-07 17:26 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-02-07 17:25 - 2014-02-07 17:16 - 00000000 ____D () C:\windows\erdnt
2014-02-07 17:25 - 2009-07-14 03:34 - 00000215 _____ () C:\windows\system.ini
2014-02-07 17:14 - 2014-02-07 17:14 - 05180173 ____R (Swearware) C:\Users\Nadir\Desktop\ComboFix.exe
2014-02-06 22:04 - 2013-02-15 02:55 - 00000000 ____D () C:\Users\Nadir\AppData\Local\Spotify
2014-02-06 20:33 - 2014-02-06 20:33 - 00028503 _____ () C:\Users\Nadir\Desktop\Addition.txt
2014-02-06 20:32 - 2014-02-06 20:30 - 00028503 _____ () C:\Users\Nadir\Downloads\Addition.txt
2014-02-06 20:32 - 2014-02-06 20:29 - 00034498 _____ () C:\Users\Nadir\Downloads\FRST.txt
2014-02-06 20:27 - 2014-02-06 20:27 - 02079744 _____ (Farbar) C:\Users\Nadir\Desktop\FRST64.exe
2014-02-04 22:25 - 2013-02-12 16:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:25 - 2013-02-12 16:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:25 - 2013-02-12 16:21 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-02-04 21:38 - 2014-02-04 21:38 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-04 21:36 - 2014-02-04 21:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Nadir\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-04 21:26 - 2014-02-04 21:26 - 00847336 _____ (Google Inc.) C:\Users\Nadir\Downloads\ChromeSetup.exe
2014-02-04 21:26 - 2012-11-22 16:13 - 00004104 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-04 21:26 - 2012-11-22 16:13 - 00003852 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-02 12:17 - 2014-02-02 12:17 - 00000000 _____ () C:\windows\setuperr.log
2014-02-01 18:35 - 2014-02-01 18:35 - 00000000 ____D () C:\oqvlquojrr
2014-02-01 08:36 - 2012-12-06 20:32 - 00000000 ____D () C:\Program Files\MyDefrag v4.3.1
2014-01-31 20:16 - 2014-01-31 09:09 - 00000000 ____D () C:\Users\Nadir\Desktop\Pa Sports - H.A.Z.E
2014-01-31 19:26 - 2014-01-31 19:02 - 75490253 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part2.rar
2014-01-31 09:09 - 2014-01-31 08:35 - 104857600 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part1.rar
2014-01-30 18:31 - 2013-01-31 13:50 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-01-30 18:31 - 2012-11-22 16:33 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-01-30 18:30 - 2012-11-22 16:31 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\HpUpdate
2014-01-30 18:30 - 2012-11-22 16:31 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\HP Support Assistant
2014-01-26 22:15 - 2014-01-26 22:15 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iTunes
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iPod
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-26 22:13 - 2013-10-26 15:18 - 00000000 ____D () C:\ProgramData\Apple
2014-01-25 15:41 - 2012-11-22 16:33 - 00003218 _____ () C:\windows\System32\Tasks\HPCeeScheduleForNADIR-HP$
2014-01-25 15:41 - 2012-11-22 16:33 - 00000342 _____ () C:\windows\Tasks\HPCeeScheduleForNADIR-HP$.job
2014-01-18 20:57 - 2014-01-18 20:57 - 00001353 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-01-18 20:57 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA Corporation
2014-01-18 20:57 - 2014-01-18 20:56 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA
2014-01-18 20:57 - 2012-07-06 00:40 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-01-18 20:56 - 2014-01-18 20:56 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-01-18 20:56 - 2012-07-06 00:40 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-01-18 20:56 - 2012-07-06 00:40 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-01-18 20:52 - 2014-01-18 20:52 - 00000000 ____D () C:\NVIDIA
2014-01-18 20:52 - 2014-01-18 20:49 - 262041840 _____ (NVIDIA Corporation) C:\Users\Nadir\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-01-18 20:45 - 2012-11-22 19:52 - 00000000 ____D () C:\Users\Nadir\AppData\Local\CrashDumps
2014-01-18 20:45 - 2011-02-11 18:00 - 00000000 ____D () C:\windows\Panther
2014-01-18 15:49 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2014-01-17 20:11 - 2013-10-22 13:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-17 20:05 - 2014-01-17 20:04 - 00005327 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-17 20:05 - 2013-10-22 13:23 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-15 17:19 - 2009-07-14 05:45 - 00275856 _____ () C:\windows\system32\FNTCACHE.DAT
2014-01-15 10:08 - 2013-08-15 02:01 - 00000000 ____D () C:\windows\system32\MRT
2014-01-15 10:07 - 2012-11-22 16:43 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-14 00:52 - 2013-09-19 02:08 - 00000000 ____D () C:\Users\Nadir\Desktop\Elophant
2014-01-10 20:09 - 2014-01-10 20:09 - 00007605 _____ () C:\Users\Nadir\AppData\Local\Resmon.ResmonCfg

Files to move or delete:
====================
C:\Users\Nadir\jagex_cl_oldschool_LIVE.dat
C:\Users\Nadir\jagex_cl_runescape_LIVE.dat
C:\Users\Nadir\random.dat


Some content of TEMP:
====================
C:\Users\Nadir\AppData\Local\Temp\avgnt.exe
C:\Users\Nadir\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-30 23:39

==================== End Of Log ============================

--- --- ---

--- --- ---

Hier das angeforderte.

schrauber · 09.02.2014, 09:53

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Nadir · 09.02.2014, 12:59

Leider ja,

Nachdem ich auf den link vom ESET Online Scanner geklickt habe öffnete sich dieses Bild (siehe Anhang).
Ich habe versucht auf meine Erweiterungen in Google Chrome zuzugreifen aber wenn ich auf Erweiterung klicke dann schließt sich der Tab automatisch.
Zu dem hab ich gemerkt das ich auf Facebook aufeinmal 70 Leute und eine Menge gefällt mir seiten folge und das kam auch automatisch.

mfg: Nadir

schrauber · 10.02.2014, 09:55

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Verbindest Du Chrome mit einem Google Konto?

ESET bitte mit IE oder Firefox machen.

Nadir · 10.02.2014, 15:03

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a2c01b5cd96f3c4ab6f315d5eb4bd14b
# engine=17012
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-10 01:47:26
# local_time=2014-02-10 02:47:26 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 9490 257459736 2271 0
# compatibility_mode=5893 16776573 100 94 9214 143669896 0 0
# scanned=203576
# found=1
# cleaned=1
# scan_time=5500
sh=F6D3E5A7E7A9F911B3AB320561707F592C66C683 ft=0 fh=0000000000000000 vn="JS/ExtenBro.FBook.S trojan (cleaned by deleting - quarantined)" ac=C fn="C:\oqvlquojrr\background.js"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.79  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 TuneUp Utilities Language Pack (de-DE) 
 Java 7 Update 51  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 Symantec Norton Online Backup NOBuAgent.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-02-2014 03
Ran by Nadir (administrator) on NADIR-HP on 10-02-2014 14:57:26
Running from C:\Users\Nadir\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\windows\SysWOW64\ezSharedSvcHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Spotify Ltd) C:\Users\Nadir\AppData\Roaming\Spotify\spotify.exe
(Octoshape ApS) C:\Users\Nadir\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
(Spotify Ltd) C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(RemoteMouse.net) C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(VS Revo Group) C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\revouninstaller.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_12_0_0_44_ActiveX.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.199\deploy\LoLLauncher.exe
(Microsoft Corporation) C:\windows\System32\MsSpellCheckingFacility.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2012-02-21] (EasyBits Software AS)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [684024 2012-04-04] (PDF Complete Inc)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] - C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-29] (Easybits)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-01-28] (Hewlett-Packard)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-11-23] ()
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Spotify] - C:\Users\Nadir\AppData\Roaming\Spotify\Spotify.exe [6118400 2014-01-13] (Spotify Ltd)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1815976 2014-01-27] (Valve Corporation)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Octoshape Streaming Services] - C:\Users\Nadir\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [107800 2011-03-24] (Octoshape ApS)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Spotify Web Helper] - C:\Users\Nadir\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-13] (Spotify Ltd)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Run: [Remote Mouse] - C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe [1195520 2013-12-14] (RemoteMouse.net)
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-4061951432-2778409454-2734856859-1000\...\Policies\system: [DisableChangePassword] 0

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {6D7D3DA1-5D86-4CF8-B679-21F473A1F0AF} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2012-07-06] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR Extension: (YouTube) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-02]
CHR Extension: (AdBlock) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-02-02]
CHR Extension: (Google Wallet) - C:\Users\Nadir\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-10-02]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)
R2 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-04-04] (PDF Complete Inc)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 X6va011; \??\C:\windows\SysWOW64\Drivers\X6va011 [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-10 14:49 - 2014-02-10 14:49 - 00000090 _____ () C:\Users\Nadir\Desktop\Eset online scanner.txt
2014-02-10 14:04 - 2014-02-10 14:50 - 00987425 _____ () C:\Users\Nadir\Desktop\SecurityCheck.exe
2014-02-10 13:14 - 2014-02-10 13:14 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-10 13:12 - 2014-02-10 13:12 - 02347384 _____ (ESET) C:\Users\Nadir\Desktop\esetsmartinstaller_enu.exe
2014-02-10 13:08 - 2014-02-10 13:08 - 00001270 _____ () C:\Users\Nadir\Desktop\Revo Uninstaller.lnk
2014-02-10 13:08 - 2014-02-10 13:08 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-02-08 19:01 - 2014-02-08 19:01 - 00035322 _____ () C:\Users\Nadir\Desktop\FRST 8.2..txt
2014-02-08 18:56 - 2014-02-08 18:56 - 00001132 _____ () C:\Users\Nadir\Desktop\JRT.txt
2014-02-08 18:51 - 2014-02-08 18:51 - 00000000 ____D () C:\windows\ERUNT
2014-02-08 18:50 - 2014-02-08 18:50 - 01037530 _____ (Thisisu) C:\Users\Nadir\Downloads\JRT.exe
2014-02-08 18:38 - 2014-02-08 18:38 - 00004318 _____ () C:\Users\Nadir\Desktop\AdwCleaner[S0].txt
2014-02-08 18:32 - 2014-02-08 18:35 - 00000000 ____D () C:\AdwCleaner
2014-02-08 18:31 - 2014-02-08 18:32 - 01166132 _____ () C:\Users\Nadir\Desktop\adwcleaner.exe
2014-02-07 17:26 - 2014-02-07 17:26 - 00029086 _____ () C:\ComboFix.txt
2014-02-07 17:17 - 2011-06-26 07:45 - 00256000 _____ () C:\windows\PEV.exe
2014-02-07 17:17 - 2010-11-07 18:20 - 00208896 _____ () C:\windows\MBR.exe
2014-02-07 17:17 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00098816 _____ () C:\windows\sed.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00080412 _____ () C:\windows\grep.exe
2014-02-07 17:17 - 2000-08-31 01:00 - 00068096 _____ () C:\windows\zip.exe
2014-02-07 17:16 - 2014-02-07 17:26 - 00000000 ____D () C:\Qoobox
2014-02-07 17:16 - 2014-02-07 17:25 - 00000000 ____D () C:\windows\erdnt
2014-02-07 17:14 - 2014-02-07 17:14 - 05180173 ____R (Swearware) C:\Users\Nadir\Desktop\ComboFix.exe
2014-02-06 20:33 - 2014-02-10 14:57 - 00014430 _____ () C:\Users\Nadir\Desktop\FRST.txt
2014-02-06 20:33 - 2014-02-06 20:33 - 00028503 _____ () C:\Users\Nadir\Desktop\Addition.txt
2014-02-06 20:30 - 2014-02-06 20:32 - 00028503 _____ () C:\Users\Nadir\Downloads\Addition.txt
2014-02-06 20:29 - 2014-02-10 14:57 - 00000000 ____D () C:\FRST
2014-02-06 20:29 - 2014-02-06 20:32 - 00034498 _____ () C:\Users\Nadir\Downloads\FRST.txt
2014-02-06 20:27 - 2014-02-10 14:57 - 02170880 _____ (Farbar) C:\Users\Nadir\Desktop\FRST64.exe
2014-02-04 21:49 - 2014-02-07 20:17 - 00001250 _____ () C:\windows\PFRO.log
2014-02-04 21:38 - 2014-02-04 21:38 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-04 21:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-02-04 21:36 - 2014-02-04 21:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Nadir\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-04 21:26 - 2014-02-04 21:26 - 00847336 _____ (Google Inc.) C:\Users\Nadir\Downloads\ChromeSetup.exe
2014-02-02 12:17 - 2014-02-10 13:03 - 00002352 _____ () C:\windows\setupact.log
2014-02-02 12:17 - 2014-02-02 12:17 - 00000000 _____ () C:\windows\setuperr.log
2014-02-01 18:35 - 2014-02-10 14:47 - 00000000 ____D () C:\oqvlquojrr
2014-01-31 19:02 - 2014-01-31 19:26 - 75490253 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part2.rar
2014-01-31 09:09 - 2014-01-31 20:16 - 00000000 ____D () C:\Users\Nadir\Desktop\Pa Sports - H.A.Z.E
2014-01-31 08:35 - 2014-01-31 09:09 - 104857600 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part1.rar
2014-01-26 22:15 - 2014-01-26 22:15 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iTunes
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iPod
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-18 20:57 - 2014-01-18 20:57 - 00001353 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-01-18 20:57 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA Corporation
2014-01-18 20:57 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\windows\system32\D3DX9_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\windows\system32\d3dx10_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx10_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\windows\system32\d3dx11_43.dll
2014-01-18 20:57 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx11_43.dll
2014-01-18 20:56 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA
2014-01-18 20:56 - 2014-01-18 20:56 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-01-18 20:56 - 2013-12-10 03:15 - 00982232 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvspcap.dll
2014-01-18 20:56 - 2013-12-10 03:14 - 01100248 _____ (NVIDIA Corporation) C:\windows\system32\nvspcap64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\windows\system32\nvcompiler.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcompiler.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvwgf2um.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2014-01-18 20:53 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvenc.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvenc.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 02698272 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvapi.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6433221.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6433221.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 01242400 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvumdshim.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00317472 _____ (NVIDIA Corporation) C:\windows\system32\nvoglshim64.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00266984 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglshim32.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00168616 _____ (NVIDIA Corporation) C:\windows\system32\nvinitx.dll
2014-01-18 20:53 - 2013-12-19 21:33 - 00141336 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvinit.dll
2014-01-18 20:53 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvvad64v.sys
2014-01-18 20:53 - 2013-12-05 09:42 - 00035104 _____ (NVIDIA Corporation) C:\windows\system32\nvaudcap64v.dll
2014-01-18 20:53 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvaudcap32v.dll
2014-01-18 20:53 - 2013-11-28 14:38 - 00197408 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvhda64v.sys
2014-01-18 20:53 - 2013-11-28 14:38 - 00031520 _____ (NVIDIA Corporation) C:\windows\system32\nvhdap64.dll
2014-01-18 20:52 - 2014-01-18 20:52 - 00000000 ____D () C:\NVIDIA
2014-01-18 20:49 - 2014-01-18 20:52 - 262041840 _____ (NVIDIA Corporation) C:\Users\Nadir\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-01-17 20:05 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-17 20:05 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-01-17 20:05 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-01-17 20:05 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-01-17 20:04 - 2014-01-17 20:05 - 00005327 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 08:20 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 08:20 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 08:20 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 08:20 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

2014-02-10 14:58 - 2014-02-06 20:33 - 00014430 _____ () C:\Users\Nadir\Desktop\FRST.txt
2014-02-10 14:57 - 2014-02-06 20:29 - 00000000 ____D () C:\FRST
2014-02-10 14:57 - 2014-02-06 20:27 - 02170880 _____ (Farbar) C:\Users\Nadir\Desktop\FRST64.exe
2014-02-10 14:57 - 2013-01-22 14:43 - 00000000 ___RD () C:\Users\Nadir\Desktop\Dies & Das
2014-02-10 14:57 - 2012-11-23 13:29 - 00000000 ____D () C:\Users\Nadir\AppData\Local\PMB Files
2014-02-10 14:54 - 2013-08-17 19:49 - 00000928 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000UA.job
2014-02-10 14:51 - 2013-10-07 17:30 - 01809649 _____ () C:\windows\WindowsUpdate.log
2014-02-10 14:50 - 2014-02-10 14:04 - 00987425 _____ () C:\Users\Nadir\Desktop\SecurityCheck.exe
2014-02-10 14:49 - 2014-02-10 14:49 - 00000090 _____ () C:\Users\Nadir\Desktop\Eset online scanner.txt
2014-02-10 14:47 - 2014-02-01 18:35 - 00000000 ____D () C:\oqvlquojrr
2014-02-10 14:25 - 2013-02-12 16:21 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-02-10 14:04 - 2013-02-15 02:55 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Spotify
2014-02-10 14:04 - 2012-11-22 20:28 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Skype
2014-02-10 13:45 - 2012-11-23 13:29 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-10 13:15 - 2012-11-22 16:13 - 00000000 ____D () C:\Program Files (x86)\Google
2014-02-10 13:14 - 2014-02-10 13:14 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-10 13:12 - 2014-02-10 13:12 - 02347384 _____ (ESET) C:\Users\Nadir\Desktop\esetsmartinstaller_enu.exe
2014-02-10 13:11 - 2009-07-14 05:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-10 13:11 - 2009-07-14 05:45 - 00024400 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-10 13:08 - 2014-02-10 13:08 - 00001270 _____ () C:\Users\Nadir\Desktop\Revo Uninstaller.lnk
2014-02-10 13:08 - 2014-02-10 13:08 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-02-10 13:05 - 2013-03-08 14:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-10 13:04 - 2012-07-06 01:01 - 00000000 ____D () C:\ProgramData\PDFC
2014-02-10 13:03 - 2014-02-02 12:17 - 00002352 _____ () C:\windows\setupact.log
2014-02-10 13:03 - 2012-07-06 00:41 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-10 13:03 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-02-09 20:54 - 2013-08-17 19:49 - 00000906 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4061951432-2778409454-2734856859-1000Core.job
2014-02-09 19:43 - 2012-11-21 17:09 - 00003930 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{E24A8F9D-BD7B-48C3-BC29-2EC321B2CB51}
2014-02-08 19:01 - 2014-02-08 19:01 - 00035322 _____ () C:\Users\Nadir\Desktop\FRST 8.2..txt
2014-02-08 18:56 - 2014-02-08 18:56 - 00001132 _____ () C:\Users\Nadir\Desktop\JRT.txt
2014-02-08 18:51 - 2014-02-08 18:51 - 00000000 ____D () C:\windows\ERUNT
2014-02-08 18:50 - 2014-02-08 18:50 - 01037530 _____ (Thisisu) C:\Users\Nadir\Downloads\JRT.exe
2014-02-08 18:38 - 2014-02-08 18:38 - 00004318 _____ () C:\Users\Nadir\Desktop\AdwCleaner[S0].txt
2014-02-08 18:35 - 2014-02-08 18:32 - 00000000 ____D () C:\AdwCleaner
2014-02-08 18:32 - 2014-02-08 18:31 - 01166132 _____ () C:\Users\Nadir\Desktop\adwcleaner.exe
2014-02-08 18:31 - 2012-11-21 17:08 - 00003186 _____ () C:\windows\System32\Tasks\HPCeeScheduleForNadir
2014-02-08 18:31 - 2012-11-21 17:08 - 00000332 _____ () C:\windows\Tasks\HPCeeScheduleForNadir.job
2014-02-07 20:17 - 2014-02-04 21:49 - 00001250 _____ () C:\windows\PFRO.log
2014-02-07 17:26 - 2014-02-07 17:26 - 00029086 _____ () C:\ComboFix.txt
2014-02-07 17:26 - 2014-02-07 17:16 - 00000000 ____D () C:\Qoobox
2014-02-07 17:26 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-02-07 17:25 - 2014-02-07 17:16 - 00000000 ____D () C:\windows\erdnt
2014-02-07 17:25 - 2009-07-14 03:34 - 00000215 _____ () C:\windows\system.ini
2014-02-07 17:14 - 2014-02-07 17:14 - 05180173 ____R (Swearware) C:\Users\Nadir\Desktop\ComboFix.exe
2014-02-06 22:04 - 2013-02-15 02:55 - 00000000 ____D () C:\Users\Nadir\AppData\Local\Spotify
2014-02-06 20:33 - 2014-02-06 20:33 - 00028503 _____ () C:\Users\Nadir\Desktop\Addition.txt
2014-02-06 20:32 - 2014-02-06 20:30 - 00028503 _____ () C:\Users\Nadir\Downloads\Addition.txt
2014-02-06 20:32 - 2014-02-06 20:29 - 00034498 _____ () C:\Users\Nadir\Downloads\FRST.txt
2014-02-04 22:25 - 2013-02-12 16:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:25 - 2013-02-12 16:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:25 - 2013-02-12 16:21 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-02-04 21:38 - 2014-02-04 21:38 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-04 21:38 - 2014-02-04 21:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-04 21:36 - 2014-02-04 21:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Nadir\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-04 21:26 - 2014-02-04 21:26 - 00847336 _____ (Google Inc.) C:\Users\Nadir\Downloads\ChromeSetup.exe
2014-02-02 12:17 - 2014-02-02 12:17 - 00000000 _____ () C:\windows\setuperr.log
2014-02-01 08:36 - 2012-12-06 20:32 - 00000000 ____D () C:\Program Files\MyDefrag v4.3.1
2014-01-31 20:16 - 2014-01-31 09:09 - 00000000 ____D () C:\Users\Nadir\Desktop\Pa Sports - H.A.Z.E
2014-01-31 19:26 - 2014-01-31 19:02 - 75490253 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part2.rar
2014-01-31 09:09 - 2014-01-31 08:35 - 104857600 _____ () C:\Users\Nadir\Downloads\HoffnungAnfangZerstörungEndepremium.part1.rar
2014-01-30 18:31 - 2013-01-31 13:50 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-01-30 18:31 - 2012-11-22 16:33 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-01-30 18:30 - 2012-11-22 16:31 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\HpUpdate
2014-01-30 18:30 - 2012-11-22 16:31 - 00000000 ____D () C:\Users\Nadir\AppData\Roaming\HP Support Assistant
2014-01-26 22:15 - 2014-01-26 22:15 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iTunes
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files\iPod
2014-01-26 22:15 - 2014-01-26 22:15 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-26 22:13 - 2013-10-26 15:18 - 00000000 ____D () C:\ProgramData\Apple
2014-01-25 15:41 - 2012-11-22 16:33 - 00003218 _____ () C:\windows\System32\Tasks\HPCeeScheduleForNADIR-HP$
2014-01-25 15:41 - 2012-11-22 16:33 - 00000342 _____ () C:\windows\Tasks\HPCeeScheduleForNADIR-HP$.job
2014-01-18 20:57 - 2014-01-18 20:57 - 00001353 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-01-18 20:57 - 2014-01-18 20:57 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA Corporation
2014-01-18 20:57 - 2014-01-18 20:56 - 00000000 ____D () C:\Users\Nadir\AppData\Local\NVIDIA
2014-01-18 20:57 - 2012-07-06 00:40 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-01-18 20:56 - 2014-01-18 20:56 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-01-18 20:56 - 2012-07-06 00:40 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-01-18 20:56 - 2012-07-06 00:40 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-01-18 20:52 - 2014-01-18 20:52 - 00000000 ____D () C:\NVIDIA
2014-01-18 20:52 - 2014-01-18 20:49 - 262041840 _____ (NVIDIA Corporation) C:\Users\Nadir\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe
2014-01-18 20:45 - 2012-11-22 19:52 - 00000000 ____D () C:\Users\Nadir\AppData\Local\CrashDumps
2014-01-18 20:45 - 2011-02-11 18:00 - 00000000 ____D () C:\windows\Panther
2014-01-18 15:49 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2014-01-17 20:11 - 2013-10-22 13:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-17 20:05 - 2014-01-17 20:04 - 00005327 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-17 20:05 - 2013-10-22 13:23 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-15 17:19 - 2009-07-14 05:45 - 00275856 _____ () C:\windows\system32\FNTCACHE.DAT
2014-01-15 10:08 - 2013-08-15 02:01 - 00000000 ____D () C:\windows\system32\MRT
2014-01-15 10:07 - 2012-11-22 16:43 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-14 00:52 - 2013-09-19 02:08 - 00000000 ____D () C:\Users\Nadir\Desktop\Elophant

Files to move or delete:
====================
C:\Users\Nadir\jagex_cl_oldschool_LIVE.dat
C:\Users\Nadir\jagex_cl_runescape_LIVE.dat
C:\Users\Nadir\random.dat


Some content of TEMP:
====================
C:\Users\Nadir\AppData\Local\Temp\avgnt.exe
C:\Users\Nadir\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-09 20:50

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Und ja, seit neustem verwende ich ein Google Konto aber auch erst nachdem das passiert ist weil ich mein altes YouTube Konto verloren hab.

schrauber · 11.02.2014, 09:12

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\oqvlquojrr

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Noch Probleme?

Nadir · 16.02.2014, 15:29

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-02-2014 01
Ran by Nadir at 2014-02-16 15:24:08 Run:2
Running from C:\Users\Nadir\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\oqvlquojrr
*****************

"C:\oqvlquojrr" => File/Directory not found.

==== End of Fixlog ====

Danke sehr es geht wieder alles herzlichen dank für deine mühe.

Hast du vielleicht noch irgendwelche tipps und tricks mein PC in Ordnung halte?

Ich habe noch ein Problem mit meinem Laptop, da hab ich Nämlich den Bundespolizei Virus sollte ich das auch hier ansprechen oder sollte ich da ein neuen Thread öffnen?

Danke nochmal

Mfg: Nadir

schrauber · 17.02.2014, 13:23

Ist der REchner komplett gesperrt oder nur der Browser? Welches Betriebssystem? Den können wir hier im Anschluss machen.

Für diesen Rechner:

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Nadir · 17.02.2014, 13:51

Vielen dank nochmal für die Tipps!

Eine frage hätte ich noch Ist CCleaner kein gutes programm zum bereinigen des Rechners?

Und jetzt zu meinem Laptop, der ist nämlich ganz gesperrt beim starten öffnet sich direkt das Bildschirm mit dem Bundespolizei Virus schätze mal des ist dir bekannt also der Laptop ist Windows Xp ist auch schon ein paar Jahre alt aber da sind halt sehr viele Dateien die ich gerne wieder haben möchte.
Kennst du da eine Lösung?

Wenn ich auf Youtube ein Video schauen möchte, werden komische Sounds abgespielt Die quelle finde ich aber nicht.

Plagegeister aller Art und deren Bekämpfung: Wenn ich auf Youtube ein Video schauen möchte, werden komische Sounds abgespielt Die quelle finde ich aber nicht.