Hallo Zusammen,

ich habe heute ausversehen einen Fake-Link aus einer falschen Telekom Mail angeklickt.

Seitdem läuft mein PC (Windows 7 64bit) nicht mehr rund, ..heißt:
• Programme schließen sich plötzlich und lassen sich nicht mehr ordentlich ausführen.

Ich werde das Gefühl nicht los, dass sich ein Trojaner eingenistet hat. Irgendwie läuft der PC nicht mehr richtig.
Selbst der Drucker verweigert seinen Dienst.
Viele Programme werden plötzlich mit einer unergründlichen Fehlermeldung beendet.

FRST habe ich bereits geladen und gestartet - allerdings wird das Programm ebenfalls sofort beendet.
Es wird somit auch kein Log-File erstellt.

Was kann ich jetzt tun?

Bitte um Hilfe!

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:

• Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
• Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
• Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
  Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
• Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
• Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!






Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

• Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit
• Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
• Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

• Starte den Rechner neu.
• Während dem Hochfahren drücke mehrmals die F8 Taste
• Wähle nun Computer reparieren.
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

• Lege die Windows CD in dein Laufwerk.
• Starte den Rechner neu und starte von der CD.
• Wähle die Spracheinstellungen und klicke "Weiter".
• Klicke auf Computerreparaturoptionen !
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

• Gib nun bitte notepad ein und drücke Enter.
• Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
  Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
• Schließe Notepad wieder
• Gib nun bitte folgenden Befehl ein.
  e:\frst.exe bzw. e:\frst64.exe
  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
• Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Hallo Matthias,

danke für die Antwort. Hier die Texte:

FRST.txt

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by Marko (administrator) on MARKO-PC on 03-06-2014 09:37:59
Running from C:\Users\Marko\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(1206 Lab) C:\Program Files (x86)\Lenovo\Rapidboot\FBService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Windows\jmesoft\Service.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Akamai Technologies, Inc.) C:\Users\Marko\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Callicia) C:\Program Files (x86)\BirdieSync\BirdieSync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Rapidboot\FBConsole.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
() C:\Windows\jmesoft\JME_LOAD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Akamai Technologies, Inc.) C:\Users\Marko\AppData\Local\Akamai\netsession_win.exe
(Dropbox, Inc.) C:\Users\Marko\AppData\Roaming\Dropbox\bin\Dropbox.exe
(4G Systems GmbH & Co. KG) C:\Windows\starter4g.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
() C:\Program Files (x86)\BirdieSync\Android\Adb\1.0.31\adb.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
() C:\Program Files (x86)\BirdieSync\Android\Adb\1.0.31\adb.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(STRATO) C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\XSManager\WTGService.exe
(4G Systems GmbH & Co. KG) C:\Windows\service4g.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Desktop.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12850792 2011-09-05] (Realtek Semiconductor)
HKLM\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe [222504 2009-05-14] (CyberLink Corp.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-02-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [jmekey] => C:\windows\jmesoft\hotkey.exe [118784 2011-06-08] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-03-16] ()
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\Rapidboot\FBConsole.exe [1260128 2011-12-16] (Lenovo)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-05] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe [222504 2009-05-14] (CyberLink Corp.)
HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2011-07-14] (Lenovo, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort12reminder] => C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [starter4g] => C:\windows\starter4g.exe [160528 2010-02-25] (4G Systems GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\...\Run: [TrojanScanner] => C:\Program Files (x86)\Trojan Remover\Trjscan.exe [1666432 2014-06-03] (Simply Super Software)
HKU\S-1-5-21-4265750321-1342549469-3814470172-1001\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-4265750321-1342549469-3814470172-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4265750321-1342549469-3814470172-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4265750321-1342549469-3814470172-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Marko\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-4265750321-1342549469-3814470172-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-4265750321-1342549469-3814470172-1001\...\Run: [BirdieSync] => C:\Program Files (x86)\BirdieSync\BirdieSync.exe [1123840 2014-05-15] (Callicia)
Startup: C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Marko\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=LEND&bmod=LEND
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: No Name - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -  No File
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\w6b92byj.default
FF Homepage: hxxp://www.wortfilter.de/
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF HKLM-x32\...\Sunbird\Extensions: [{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}] - C:\Program Files (x86)\BirdieSync\Sunbird Service
FF Extension: BirdieSync - C:\Program Files (x86)\BirdieSync\Sunbird Service [2014-05-16]
FF HKLM-x32\...\Thunderbird\Extensions: [{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}] - C:\Program Files (x86)\BirdieSync\Thunderbird Service
FF Extension: BirdieSync - C:\Program Files (x86)\BirdieSync\Thunderbird Service [2014-05-16]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 cjpcsc; C:\windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT)
R2 FastbootService; C:\Program Files (x86)\Lenovo\Rapidboot\FBService.exe [199264 2011-12-16] (1206 Lab)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
R2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-03-16] ()
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 STRATO HiDrive Service; C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-11-15] (STRATO)
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [304592 2009-06-22] ()
R2 XS Stick Service; C:\windows\service4g.exe [125200 2010-02-25] (4G Systems GmbH & Co. KG)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2013-04-21] (Mobile Connector)
S3 cmnsusbser; C:\Windows\SysWOW64\DRIVERS\cmnsusbser.sys [117888 2008-10-31] (Mobile Connector)
R0 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [69216 2011-12-16] (Windows (R) Win 7 DDK provider)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [101376 2011-11-21] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [217088 2011-11-21] (Renesas Electronics Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-03 09:37 - 2014-06-03 09:38 - 00017746 _____ () C:\Users\Marko\Downloads\FRST.txt
2014-06-03 09:37 - 2014-06-03 09:38 - 00000000 ____D () C:\FRST
2014-06-03 09:28 - 2014-06-03 09:28 - 04748896 _____ (Piriform Ltd) C:\Users\Marko\Downloads\ccsetup414.exe
2014-06-03 09:19 - 2014-06-03 09:19 - 00000000 ____D () C:\ProgramData\TEMP
2014-06-03 09:19 - 2014-06-03 09:19 - 00000000 ____D () C:\ProgramData\Licenses
2014-06-03 09:18 - 2014-06-03 09:18 - 21407864 _____ (Simply Super Software ) C:\Users\Marko\Downloads\trjsetup690.exe
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\Users\Marko\Documents\Simply Super Software
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Simply Super Software
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-06-02 16:43 - 2014-06-02 16:43 - 02347384 _____ (ESET) C:\Users\Marko\Downloads\esetsmartinstaller_deu.exe
2014-06-02 16:43 - 2014-06-02 16:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-02 16:31 - 2014-06-02 16:31 - 00119000 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-02 16:31 - 2014-06-02 16:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-02 16:30 - 2014-06-02 16:42 - 00000000 ____D () C:\Users\Marko\Desktop\mbar
2014-06-02 16:30 - 2014-06-02 16:30 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Marko\Downloads\mbar-1.07.0.1009.exe
2014-06-02 16:30 - 2014-06-02 16:30 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-02 16:15 - 2014-06-02 16:15 - 00031956 _____ () C:\Users\Marko\Desktop\AVSCAN-20140602-150948-2BC7E592.LOG
2014-06-02 15:10 - 2014-06-02 15:10 - 00005540 _____ () C:\Users\Marko\Desktop\06022014_143805.log
2014-06-02 14:38 - 2014-06-02 14:38 - 00000000 ____D () C:\_OTL
2014-06-02 14:35 - 2014-06-02 14:35 - 00602112 _____ (OldTimer Tools) C:\Users\Marko\Downloads\OTL.exe
2014-06-02 14:15 - 2014-06-02 14:15 - 00027444 _____ () C:\ComboFix.txt
2014-06-02 14:15 - 2014-06-02 14:15 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-02 14:15 - 2014-06-02 14:15 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-02 14:15 - 2014-06-02 14:15 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-02 14:06 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-02 14:06 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-02 14:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-02 14:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-02 14:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-02 14:06 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-02 14:06 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-02 14:06 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-02 13:39 - 2014-06-02 14:15 - 00000000 ____D () C:\Qoobox
2014-06-02 13:39 - 2014-06-02 14:14 - 00000000 ____D () C:\windows\erdnt
2014-06-02 13:39 - 2014-06-02 13:39 - 05203398 ____R (Swearware) C:\Users\Marko\Downloads\ComboFix.exe
2014-06-02 13:36 - 2014-06-02 13:36 - 02067456 _____ (Farbar) C:\Users\Marko\Downloads\FRST64__.exe
2014-06-02 13:34 - 2014-06-03 09:27 - 00000000 ____D () C:\AdwCleaner
2014-06-02 13:34 - 2014-06-03 09:22 - 01327971 _____ () C:\Users\Marko\Downloads\adwcleaner_3.211.exe
2014-06-02 13:31 - 2014-06-02 13:31 - 00039072 _____ () C:\Users\Marko\Desktop\JRT.txt
2014-06-02 13:26 - 2014-06-02 13:26 - 01016261 _____ (Thisisu) C:\Users\Marko\Downloads\JRT_6.1.4.exe
2014-06-02 13:26 - 2014-06-02 13:26 - 00000000 ____D () C:\windows\ERUNT
2014-06-02 13:25 - 2014-06-02 13:25 - 00000948 _____ () C:\Users\Marko\Desktop\Rkill.txt
2014-06-02 13:24 - 2014-06-02 13:25 - 01940216 _____ (Bleeping Computer, LLC) C:\Users\Marko\Downloads\rkill.exe
2014-06-02 13:20 - 2014-06-02 13:20 - 01058304 _____ (Farbar) C:\Users\Marko\Downloads\FRST.exe
2014-06-02 12:59 - 2014-06-03 09:37 - 02068992 _____ (Farbar) C:\Users\Marko\Downloads\FRST64.exe
2014-06-01 15:31 - 2014-06-01 15:31 - 00000000 _____ () C:\Users\Marko\Sti_Trace.log
2014-06-01 11:55 - 2014-06-01 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-01 11:54 - 2014-06-01 22:08 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-06-01 11:54 - 2014-06-01 11:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-06-01 11:49 - 2014-06-01 11:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-06-01 11:49 - 2014-06-01 11:49 - 00000000 ___RD () C:\MSOCache
2014-05-30 21:24 - 2014-05-30 21:24 - 00001802 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\Program Files\iTunes
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\Program Files\iPod
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-05-25 18:36 - 2014-05-25 18:36 - 00000000 __SHD () C:\Users\Marko\AppData\Local\EmieUserList
2014-05-25 18:36 - 2014-05-25 18:36 - 00000000 __SHD () C:\Users\Marko\AppData\Local\EmieSiteList
2014-05-24 10:20 - 2014-05-24 10:20 - 02659296 _____ () C:\Users\Marko\Downloads\avira_speedup.exe
2014-05-23 10:33 - 2014-05-23 10:33 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\ControlCenter4
2014-05-23 10:31 - 2014-05-23 10:31 - 00002163 _____ () C:\Users\Public\Desktop\Brother Creative Center.lnk
2014-05-23 10:31 - 2014-05-23 10:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother
2014-05-23 10:30 - 2014-05-23 10:30 - 00000066 _____ () C:\windows\Brfaxrx.ini
2014-05-23 10:30 - 2014-05-23 10:30 - 00000000 ____D () C:\Program Files (x86)\Browny02
2014-05-23 10:30 - 2014-05-23 10:30 - 00000000 ____D () C:\Brother
2014-05-23 10:30 - 2012-07-09 17:19 - 00005120 ____N (Brother Industries Ltd.) C:\windows\SysWOW64\BrDctF2S.dll
2014-05-23 10:30 - 2010-03-15 19:45 - 00073728 ____N (Brother Industries Ltd.) C:\windows\SysWOW64\BrDctF2.dll
2014-05-23 10:30 - 2010-02-05 04:42 - 00180224 _____ (Brother Industries, Ltd.) C:\windows\SysWOW64\BROSNMP.DLL
2014-05-23 10:30 - 2007-12-13 22:16 - 00005632 ____N (Brother Industries Ltd.) C:\windows\SysWOW64\BrDctF2L.dll
2014-05-23 10:26 - 2014-05-23 10:26 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\InstallShield
2014-05-23 10:17 - 2014-05-23 10:17 - 64052804 _____ (A.I.SOFT,INC.) C:\Users\Marko\Desktop\CC4updater_424091.EXE
2014-05-23 10:17 - 2014-02-18 03:44 - 65158728 _____ (Macrovision Corporation) C:\Users\Marko\Desktop\ControlCenter4 Updater.exe
2014-05-19 14:26 - 2014-05-19 14:26 - 00009222 _____ () C:\Users\Marko\Desktop\Geburtstage.ics
2014-05-16 15:57 - 2014-05-17 19:36 - 00022458 _____ () C:\Users\Marko\Desktop\Kopie von Kundenliste_15.05.2014.xlsx
2014-05-16 12:48 - 2014-05-16 12:48 - 00000000 ____D () C:\Users\Marko\AppData\Local\Trolltech
2014-05-16 12:31 - 2014-05-19 14:46 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\BirdieSync
2014-05-16 12:31 - 2014-05-16 12:31 - 00000000 ____D () C:\Users\Marko\.android
2014-05-16 12:31 - 2014-05-16 12:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BirdieSync
2014-05-16 12:31 - 2014-05-16 12:31 - 00000000 ____D () C:\Program Files (x86)\BirdieSync
2014-05-15 12:11 - 2014-05-15 12:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-15 11:43 - 2014-05-15 11:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
2014-05-15 11:43 - 2014-05-15 11:43 - 00000000 ____D () C:\Program Files (x86)\WinPcap
2014-05-15 11:42 - 2014-05-15 11:42 - 23516496 _____ (PortableApps.com) C:\Users\Marko\Downloads\wiresharkportable-1.10.7.paf.exe
2014-05-15 11:42 - 2014-05-15 11:42 - 00000000 ____D () C:\Users\Marko\Desktop\WiresharkPortable
2014-05-14 20:22 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-14 20:22 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-14 20:22 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-14 20:22 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-14 20:22 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-14 20:22 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-14 10:28 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-14 10:28 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-14 10:28 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-05-14 10:28 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-05-14 10:28 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-05-14 10:28 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2014-05-14 10:28 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-05-14 10:28 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2014-05-14 10:28 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2014-05-14 10:28 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2014-05-14 10:27 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2014-05-14 10:27 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2014-05-14 10:27 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2014-05-14 10:27 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2014-05-14 10:27 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2014-05-14 10:27 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2014-05-14 10:27 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2014-05-14 10:27 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2014-05-14 10:27 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-05-14 10:27 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\windows\system32\objsel.dll
2014-05-14 10:27 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2014-05-14 10:27 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-05-14 10:27 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2014-05-14 10:27 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2014-05-14 10:27 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-05-14 10:27 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\wincredprovider.dll
2014-05-14 10:27 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\windows\system32\cngprovider.dll
2014-05-14 10:27 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\adprovider.dll
2014-05-14 10:27 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\capiprovider.dll
2014-05-14 10:27 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\dpapiprovider.dll
2014-05-14 10:27 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\dimsroam.dll
2014-05-14 10:27 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\windows\SysWOW64\objsel.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\cngprovider.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\windows\SysWOW64\adprovider.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\windows\SysWOW64\capiprovider.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dpapiprovider.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\dimsroam.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wincredprovider.dll
2014-05-14 10:27 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-05-14 10:27 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2014-05-12 22:13 - 2014-05-12 22:13 - 00002121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-05-12 22:13 - 2014-05-12 22:13 - 00002109 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2014-05-12 22:13 - 2014-05-12 22:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-05-12 22:12 - 2014-05-12 22:12 - 21987152 _____ (Mozilla) C:\Users\Marko\Downloads\Thunderbird Setup 24.5.0.exe
2014-05-07 22:57 - 2014-05-15 10:58 - 00000000 ___SD () C:\windows\system32\CompatTel

==================== One Month Modified Files and Folders =======

2014-06-03 09:38 - 2014-06-03 09:37 - 00017746 _____ () C:\Users\Marko\Downloads\FRST.txt
2014-06-03 09:38 - 2014-06-03 09:37 - 00000000 ____D () C:\FRST
2014-06-03 09:38 - 2013-03-11 00:05 - 00000000 ____D () C:\Users\Marko\AppData\Local\Temp
2014-06-03 09:37 - 2014-06-02 12:59 - 02068992 _____ (Farbar) C:\Users\Marko\Downloads\FRST64.exe
2014-06-03 09:32 - 2009-07-14 06:45 - 00020480 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-03 09:32 - 2009-07-14 06:45 - 00020480 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-03 09:30 - 2012-06-12 02:36 - 00703092 _____ () C:\windows\system32\perfh007.dat
2014-06-03 09:30 - 2012-06-12 02:36 - 00150676 _____ () C:\windows\system32\perfc007.dat
2014-06-03 09:30 - 2009-07-14 07:13 - 01629572 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-03 09:29 - 2014-03-08 18:31 - 00000841 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-06-03 09:29 - 2014-03-08 18:31 - 00000000 ____D () C:\Program Files\CCleaner
2014-06-03 09:29 - 2012-06-12 01:54 - 01513168 ____N () C:\windows\WindowsUpdate.log
2014-06-03 09:28 - 2014-06-03 09:28 - 04748896 _____ (Piriform Ltd) C:\Users\Marko\Downloads\ccsetup414.exe
2014-06-03 09:27 - 2014-06-02 13:34 - 00000000 ____D () C:\AdwCleaner
2014-06-03 09:25 - 2014-01-23 20:01 - 00000000 ___RD () C:\Users\Marko\Dropbox
2014-06-03 09:25 - 2014-01-23 20:00 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\DropboxMaster
2014-06-03 09:25 - 2014-01-23 20:00 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Dropbox
2014-06-03 09:25 - 2013-08-01 09:30 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Skype
2014-06-03 09:24 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-03 09:22 - 2014-06-02 13:34 - 01327971 _____ () C:\Users\Marko\Downloads\adwcleaner_3.211.exe
2014-06-03 09:19 - 2014-06-03 09:19 - 00000000 ____D () C:\ProgramData\TEMP
2014-06-03 09:19 - 2014-06-03 09:19 - 00000000 ____D () C:\ProgramData\Licenses
2014-06-03 09:18 - 2014-06-03 09:18 - 21407864 _____ (Simply Super Software ) C:\Users\Marko\Downloads\trjsetup690.exe
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\Users\Marko\Documents\Simply Super Software
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Simply Super Software
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
2014-06-03 09:18 - 2014-06-03 09:18 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-06-03 09:14 - 2013-03-11 20:03 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-02 18:51 - 2013-04-14 18:05 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-02 18:49 - 2009-07-14 04:34 - 00000526 _____ () C:\windows\win.ini
2014-06-02 16:43 - 2014-06-02 16:43 - 02347384 _____ (ESET) C:\Users\Marko\Downloads\esetsmartinstaller_deu.exe
2014-06-02 16:43 - 2014-06-02 16:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-02 16:42 - 2014-06-02 16:30 - 00000000 ____D () C:\Users\Marko\Desktop\mbar
2014-06-02 16:31 - 2014-06-02 16:31 - 00119000 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-02 16:31 - 2014-06-02 16:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-02 16:30 - 2014-06-02 16:30 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Marko\Downloads\mbar-1.07.0.1009.exe
2014-06-02 16:30 - 2014-06-02 16:30 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-02 16:15 - 2014-06-02 16:15 - 00031956 _____ () C:\Users\Marko\Desktop\AVSCAN-20140602-150948-2BC7E592.LOG
2014-06-02 15:10 - 2014-06-02 15:10 - 00005540 _____ () C:\Users\Marko\Desktop\06022014_143805.log
2014-06-02 14:38 - 2014-06-02 14:38 - 00000000 ____D () C:\_OTL
2014-06-02 14:35 - 2014-06-02 14:35 - 00602112 _____ (OldTimer Tools) C:\Users\Marko\Downloads\OTL.exe
2014-06-02 14:15 - 2014-06-02 14:15 - 00027444 _____ () C:\ComboFix.txt
2014-06-02 14:15 - 2014-06-02 14:15 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-02 14:15 - 2014-06-02 14:15 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-02 14:15 - 2014-06-02 14:15 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-02 14:15 - 2014-06-02 13:39 - 00000000 ____D () C:\Qoobox
2014-06-02 14:15 - 2009-07-14 05:20 - 00000000 ___HD () C:\Users\Default
2014-06-02 14:14 - 2014-06-02 13:39 - 00000000 ____D () C:\windows\erdnt
2014-06-02 14:13 - 2009-07-14 04:34 - 00000215 _____ () C:\windows\system.ini
2014-06-02 13:39 - 2014-06-02 13:39 - 05203398 ____R (Swearware) C:\Users\Marko\Downloads\ComboFix.exe
2014-06-02 13:36 - 2014-06-02 13:36 - 02067456 _____ (Farbar) C:\Users\Marko\Downloads\FRST64__.exe
2014-06-02 13:31 - 2014-06-02 13:31 - 00039072 _____ () C:\Users\Marko\Desktop\JRT.txt
2014-06-02 13:26 - 2014-06-02 13:26 - 01016261 _____ (Thisisu) C:\Users\Marko\Downloads\JRT_6.1.4.exe
2014-06-02 13:26 - 2014-06-02 13:26 - 00000000 ____D () C:\windows\ERUNT
2014-06-02 13:25 - 2014-06-02 13:25 - 00000948 _____ () C:\Users\Marko\Desktop\Rkill.txt
2014-06-02 13:25 - 2014-06-02 13:24 - 01940216 _____ (Bleeping Computer, LLC) C:\Users\Marko\Downloads\rkill.exe
2014-06-02 13:20 - 2014-06-02 13:20 - 01058304 _____ (Farbar) C:\Users\Marko\Downloads\FRST.exe
2014-06-02 10:04 - 2013-05-18 11:46 - 00000000 ____D () C:\Users\Marko\Documents\Scans
2014-06-02 09:29 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\NDF
2014-06-02 08:58 - 2009-07-14 07:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2014-06-02 08:25 - 2013-03-11 00:08 - 00121304 _____ () C:\Users\Marko\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-02 08:24 - 2009-07-14 06:45 - 00484984 _____ () C:\windows\system32\FNTCACHE.DAT
2014-06-01 22:08 - 2014-06-01 11:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-06-01 15:31 - 2014-06-01 15:31 - 00000000 _____ () C:\Users\Marko\Sti_Trace.log
2014-06-01 15:31 - 2013-03-11 00:05 - 00000000 ____D () C:\Users\Marko
2014-06-01 11:55 - 2014-06-01 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-01 11:54 - 2014-06-01 11:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-06-01 11:54 - 2014-06-01 11:49 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-06-01 11:54 - 2011-02-15 12:41 - 00000000 ____D () C:\windows\ShellNew
2014-06-01 11:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-06-01 11:50 - 2014-02-07 15:09 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-06-01 11:49 - 2014-06-01 11:49 - 00000000 ___RD () C:\MSOCache
2014-05-30 21:24 - 2014-05-30 21:24 - 00001802 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\Program Files\iTunes
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\Program Files\iPod
2014-05-30 21:24 - 2014-05-30 21:24 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-05-30 21:23 - 2014-02-01 21:26 - 112616784 _____ (Apple Inc.) C:\Users\Marko\Downloads\iTunes64Setup.exe
2014-05-30 12:02 - 2013-10-20 16:59 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-05-30 11:21 - 2014-02-28 15:05 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-05-30 11:21 - 2013-08-01 09:30 - 00000000 ____D () C:\ProgramData\Skype
2014-05-30 08:17 - 2014-01-23 20:01 - 00000998 _____ () C:\Users\Marko\Desktop\Dropbox.lnk
2014-05-30 08:17 - 2014-01-23 20:00 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-30 08:17 - 2013-03-11 00:08 - 00000000 ___RD () C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-25 18:36 - 2014-05-25 18:36 - 00000000 __SHD () C:\Users\Marko\AppData\Local\EmieUserList
2014-05-25 18:36 - 2014-05-25 18:36 - 00000000 __SHD () C:\Users\Marko\AppData\Local\EmieSiteList
2014-05-24 10:20 - 2014-05-24 10:20 - 02659296 _____ () C:\Users\Marko\Downloads\avira_speedup.exe
2014-05-23 10:33 - 2014-05-23 10:33 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\ControlCenter4
2014-05-23 10:31 - 2014-05-23 10:31 - 00002163 _____ () C:\Users\Public\Desktop\Brother Creative Center.lnk
2014-05-23 10:31 - 2014-05-23 10:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother
2014-05-23 10:30 - 2014-05-23 10:30 - 00000066 _____ () C:\windows\Brfaxrx.ini
2014-05-23 10:30 - 2014-05-23 10:30 - 00000000 ____D () C:\Program Files (x86)\Browny02
2014-05-23 10:30 - 2014-05-23 10:30 - 00000000 ____D () C:\Brother
2014-05-23 10:30 - 2013-10-19 10:25 - 00000000 ____D () C:\Program Files (x86)\ControlCenter4
2014-05-23 10:30 - 2013-03-18 17:54 - 00000840 _____ () C:\windows\Brpfx04a.ini
2014-05-23 10:30 - 2013-03-18 17:54 - 00000130 _____ () C:\windows\brpcfx.ini
2014-05-23 10:30 - 2013-03-18 17:50 - 00000000 ____D () C:\Program Files (x86)\Brother
2014-05-23 10:30 - 2012-06-12 01:53 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-23 10:26 - 2014-05-23 10:26 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\InstallShield
2014-05-23 10:20 - 2014-03-04 15:07 - 126514424 _____ (A.I.SOFT,INC.) C:\Users\Marko\Desktop\MFC-7360N-inst-C1-EU.EXE
2014-05-23 10:18 - 2013-11-15 14:38 - 00000000 ____D () C:\ProgramData\ControlCenter4
2014-05-23 10:17 - 2014-05-23 10:17 - 64052804 _____ (A.I.SOFT,INC.) C:\Users\Marko\Desktop\CC4updater_424091.EXE
2014-05-23 09:57 - 2014-04-14 12:58 - 00000000 ____D () C:\Users\Marko\Documents\MailStore Home
2014-05-23 09:57 - 2014-04-14 12:58 - 00000000 ____D () C:\ProgramData\firebird
2014-05-20 08:27 - 2014-02-08 12:54 - 00005118 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Marko-PC-Marko Marko-PC
2014-05-19 18:45 - 2013-07-01 17:42 - 00000000 ____D () C:\Users\Marko\AppData\Local\Apple Computer
2014-05-19 14:46 - 2014-05-16 12:31 - 00000000 ____D () C:\Users\Marko\AppData\Roaming\BirdieSync
2014-05-19 14:26 - 2014-05-19 14:26 - 00009222 _____ () C:\Users\Marko\Desktop\Geburtstage.ics
2014-05-19 10:11 - 2014-02-07 15:37 - 00000000 ____D () C:\Users\Marko\AppData\Local\Open-Xchange
2014-05-17 19:36 - 2014-05-16 15:57 - 00022458 _____ () C:\Users\Marko\Desktop\Kopie von Kundenliste_15.05.2014.xlsx
2014-05-16 12:48 - 2014-05-16 12:48 - 00000000 ____D () C:\Users\Marko\AppData\Local\Trolltech
2014-05-16 12:31 - 2014-05-16 12:31 - 00000000 ____D () C:\Users\Marko\.android
2014-05-16 12:31 - 2014-05-16 12:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BirdieSync
2014-05-16 12:31 - 2014-05-16 12:31 - 00000000 ____D () C:\Program Files (x86)\BirdieSync
2014-05-16 10:12 - 2013-04-01 18:33 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-16 10:01 - 2013-03-10 18:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-15 13:26 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-05-15 12:11 - 2014-05-15 12:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-15 11:43 - 2014-05-15 11:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
2014-05-15 11:43 - 2014-05-15 11:43 - 00000000 ____D () C:\Program Files (x86)\WinPcap
2014-05-15 11:42 - 2014-05-15 11:42 - 23516496 _____ (PortableApps.com) C:\Users\Marko\Downloads\wiresharkportable-1.10.7.paf.exe
2014-05-15 11:42 - 2014-05-15 11:42 - 00000000 ____D () C:\Users\Marko\Desktop\WiresharkPortable
2014-05-15 11:00 - 2013-03-11 00:08 - 00000000 ___RD () C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 10:58 - 2014-05-07 22:57 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-14 20:16 - 2013-08-01 03:00 - 00000000 ____D () C:\windows\system32\MRT
2014-05-14 20:15 - 2013-06-30 11:35 - 93223848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-14 10:14 - 2013-03-11 20:03 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 10:14 - 2013-03-11 20:03 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 10:14 - 2013-03-11 20:03 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-05-12 22:13 - 2014-05-12 22:13 - 00002121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-05-12 22:13 - 2014-05-12 22:13 - 00002109 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2014-05-12 22:13 - 2014-05-12 22:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-05-12 22:12 - 2014-05-12 22:12 - 21987152 _____ (Mozilla) C:\Users\Marko\Downloads\Thunderbird Setup 24.5.0.exe
2014-05-09 08:14 - 2014-05-14 10:28 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-14 10:28 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-14 20:22 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-14 20:22 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-14 20:22 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-14 20:22 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-14 20:22 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-14 20:22 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-05 11:03 - 2014-04-21 19:35 - 00029709 _____ () C:\Users\Marko\Desktop\Messe_Will_ATV Liste Dinli Linhai Herkules TGB Triton Yamaha01 04 2014.xlsx

Some content of TEMP:
====================
C:\Users\Marko\AppData\Local\Temp\avgnt.exe
C:\Users\Marko\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp5qfnxv.dll
C:\Users\Marko\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-30 13:48

==================== End Of Log ============================
         

--- --- ---

--- --- ---



--- --- ---



Und die Addition.txt

FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2014
Ran by Marko at 2014-06-03 09:38:35
Running from C:\Users\Marko\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.9.0.1210 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.9.0.1210 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.22.87 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AMD APP SDK Runtime (Version: 2.5.793.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{2239633A-969C-39BF-B5C2-C172F44EC096}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
BirdieSync 2.4.9.0 (HKLM-x32\...\BirdieSync) (Version: 2.4.9.0 - Callicia)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-7360N (HKLM-x32\...\{3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}) (Version: 1.1.3.0 - Brother Industries, Ltd.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.0214.2237.40551 - Ihr Firmenname) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0214.2237.40551 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0214.2237.40551 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Profiles Desktop (x32 Version: 2012.0214.2237.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0214.2236.40551 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0214.2237.40551 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.0 - REINER SCT)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DELISprint (HKLM-x32\...\{9480CCD5-BB18-4DF3-AB18-04198B30DD62}) (Version: 5.6.6.0 - DPD)
doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version:  - Softland)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
FileZilla Client 3.7.4.1 (HKLM-x32\...\FileZilla Client) (Version: 3.7.4.1 - Tim Kosse)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.6.0.1002 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan)
iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lenovo Blacksilk USB Keyboard Driver (HKLM-x32\...\{B266E062-D6C5-485B-B426-51B152B041A6}) (Version: V1.4.11.0608 - Lenovo)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.5317a - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.5317a - CyberLink Corp.) Hidden
Lenovo Registration (HKLM-x32\...\{6707C034-ED6B-4B6A-B21F-969B3606FBDE}) (Version: 1.0.4 - Lenovo Inc.)
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 3.0.2431 - CyberLink Corp.)
Lenovo Rescue System (Version: 3.0.2431 - CyberLink Corp.) Hidden
Lenovo Treiber- und Anwendungsinstallation (HKLM-x32\...\{45970CD1-D599-47D4-938F-3E9800D54ED1}) (Version: 5.10.3426 - Lenovo)
Lenovo Welcome (HKLM-x32\...\{2DC26D10-CC6A-494F-BEA3-B5BC21126D5E}) (Version: 3.1.0008.00 - Lenovo Group Limited)
LVT (HKLM-x32\...\{9E3469A6-443A-452C-BF44-8D7CE3A9A7E2}) (Version: 1.00.1202 - Lenovo)
MailStore Home 8.2.0.9316 (HKLM-x32\...\MailStore Home_universal1) (Version: 8.2.0.9316 - MailStore Software GmbH)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Small Business 2007 (HKLM-x32\...\SMALLBUSINESSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nuance PaperPort 12 (HKLM-x32\...\{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}) (Version: 12.1.0000 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Rapidboot Advanced (HKLM-x32\...\Rapidboot Advanced) (Version: 1.00.0502 - Lenovo)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6454 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30123 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.12.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.12.0 - Renesas Electronics Corporation) Hidden
Scan2PDF 1.6 (HKLM-x32\...\Scan2PDF_is1) (Version:  - Koma-Code)
Scansoft PDF Professional (x32 Version:  - ) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
StarMoney (x32 Version: 3.0.6.28 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 9.0  (HKLM-x32\...\{FC8826F4-899A-428A-AFD5-03C9555C327D}) (Version: 9.0 - Star Finanz GmbH)
STRATO HiDrive (remove only) (HKLM-x32\...\STRATO HiDrive) (Version:  - STRATO AG)
SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.49.86082 - SugarSync, Inc.)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)
Trojan Remover 6.9.1.2931 (HKLM-x32\...\Trojan Remover_is1) (Version: 6.9.1.2931 - Simply Super Software)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XSManager (HKLM-x32\...\XSManager) (Version: 3.0 - XSManager)

==================== Restore Points  =========================

30-05-2014 06:21:28 Windows Update
30-05-2014 19:17:55 Removed iTunes
30-05-2014 19:23:33 Installed iTunes
01-06-2014 09:48:47 Installed Microsoft Office Small Business 2007
01-06-2014 20:06:23 Windows Update
02-06-2014 14:42:29 Malwarebytes Anti-Rootkit Restore Point
02-06-2014 16:48:20 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {26B97819-F395-40FB-93CF-52F6F7AF6E5B} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {28D1021D-C47B-4433-A0D0-44C6D4D33019} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Marko-PC-Marko Marko-PC => C:\Program Files\Microsoft Office\Office15\MsoSync.exe
Task: {6A8618E0-8F68-47B4-A490-857C6BA681F5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {7EC8C1BA-DB22-4600-B37D-6FA27FD4B2B4} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A8E022F1-9B7D-4AE4-9977-F7F546764AAD} - System32\Tasks\SuperEasy Registry Cleaner => C:\Program Files (x86)\SuperEasy Software\Registry Cleaner\SuperEasyRC.exe
Task: {ADE81D19-0D00-43A5-ACDE-22744D7CF9EA} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {F892ACE2-56ED-4B30-A35E-A1373255FCA8} - System32\Tasks\OFFICE2010ACT => C:\Windows\system32\OFFICEICON.vbs
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-06-12 01:58 - 2011-03-16 05:47 - 00032768 _____ () C:\Windows\jmesoft\Service.exe
2012-06-12 01:58 - 2011-05-17 22:54 - 00024576 _____ () C:\Windows\jmesoft\JME_LOAD.exe
2013-09-17 10:29 - 2013-09-17 10:29 - 00819200 _____ () C:\Program Files (x86)\BirdieSync\Android\Adb\1.0.31\adb.exe
2013-11-07 16:44 - 2005-04-22 06:36 - 00143360 _____ () C:\windows\system32\BrSNMP64.dll
2013-04-21 09:23 - 2009-06-22 16:13 - 00304592 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2011-11-09 18:55 - 2011-11-09 18:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2012-02-15 07:35 - 2012-02-15 07:35 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-03-10 18:37 - 2013-03-10 18:32 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-04-01 19:28 - 2007-05-31 07:38 - 00167936 ____N () C:\windows\SysWOW64\SerialXP.dll
2012-06-12 02:59 - 2011-12-16 09:47 - 00031328 ____N () C:\Program Files (x86)\Lenovo\Rapidboot\FBServiceps.dll
2014-01-31 10:03 - 2011-01-13 10:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2009-09-12 15:47 - 2009-09-12 15:47 - 00544768 _____ () C:\Program Files (x86)\BirdieSync\BirdieSync.Lib\sqlite3.dll
2011-01-28 21:44 - 2011-01-28 21:44 - 00030208 _____ () C:\Program Files (x86)\BirdieSync\BirdieSync.Lib\QtSolutions_SingleApplication-2.6.dll
2009-12-05 01:59 - 2009-12-05 01:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
2009-12-05 02:04 - 2009-12-05 02:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
2012-06-12 01:58 - 2011-05-17 22:27 - 00028672 _____ () C:\Windows\jmesoft\hidhook.dll
2014-06-03 09:24 - 2014-06-03 09:24 - 00043008 _____ () c:\users\marko\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp5qfnxv.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Marko\AppData\Roaming\Dropbox\bin\libcef.dll
2014-05-23 10:30 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-02-16 22:09 - 2014-02-16 22:09 - 00172544 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\367540c92c2004ff2c6695778fed5dd6\IsdiInterop.ni.dll
2012-06-12 01:56 - 2011-05-20 19:05 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-06-12 01:55 - 2011-12-16 04:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 

Name: Microsoft-6zu4-Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: TAP-Win32 Adapter V9
Description: TAP-Win32 Adapter V9
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Win32 Provider V9
Service: tap0901
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/03/2014 09:25:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/03/2014 09:12:42 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (06/03/2014 08:51:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/02/2014 06:47:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SnippingTool.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bcb47
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000fed317c0
ID des fehlerhaften Prozesses: 0x784
Startzeit der fehlerhaften Anwendung: 0xSnippingTool.exe0
Pfad der fehlerhaften Anwendung: SnippingTool.exe1
Pfad des fehlerhaften Moduls: SnippingTool.exe2
Berichtskennung: SnippingTool.exe3

Error: (06/02/2014 04:43:47 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (06/02/2014 04:42:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FRST64.exe, Version: 1.6.2014.1, Zeitstempel: 0x538b3254
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000fed317c0
ID des fehlerhaften Prozesses: 0x17e0
Startzeit der fehlerhaften Anwendung: 0xFRST64.exe0
Pfad der fehlerhaften Anwendung: FRST64.exe1
Pfad des fehlerhaften Moduls: FRST64.exe2
Berichtskennung: FRST64.exe3

Error: (06/02/2014 04:42:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FRST64.exe, Version: 1.6.2014.1, Zeitstempel: 0x538b3254
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000fed317c0
ID des fehlerhaften Prozesses: 0x1948
Startzeit der fehlerhaften Anwendung: 0xFRST64.exe0
Pfad der fehlerhaften Anwendung: FRST64.exe1
Pfad des fehlerhaften Moduls: FRST64.exe2
Berichtskennung: FRST64.exe3

Error: (06/02/2014 04:40:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FRST64.exe, Version: 1.6.2014.1, Zeitstempel: 0x538b3254
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000fed317c0
ID des fehlerhaften Prozesses: 0x840
Startzeit der fehlerhaften Anwendung: 0xFRST64.exe0
Pfad der fehlerhaften Anwendung: FRST64.exe1
Pfad des fehlerhaften Moduls: FRST64.exe2
Berichtskennung: FRST64.exe3

Error: (06/02/2014 04:21:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCleaner64.exe, Version: 4.11.0.4619, Zeitstempel: 0x5304c515
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000fed317c0
ID des fehlerhaften Prozesses: 0x18c8
Startzeit der fehlerhaften Anwendung: 0xCCleaner64.exe0
Pfad der fehlerhaften Anwendung: CCleaner64.exe1
Pfad des fehlerhaften Moduls: CCleaner64.exe2
Berichtskennung: CCleaner64.exe3

Error: (06/02/2014 03:10:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: notepad.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc9b3
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000fed317c0
ID des fehlerhaften Prozesses: 0xafc
Startzeit der fehlerhaften Anwendung: 0xnotepad.exe0
Pfad der fehlerhaften Anwendung: notepad.exe1
Pfad des fehlerhaften Moduls: notepad.exe2
Berichtskennung: notepad.exe3


System errors:
=============
Error: (06/02/2014 02:13:46 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/02/2014 02:13:15 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (06/02/2014 02:11:06 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/02/2014 02:07:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "JME Keyboard Driver" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-06-02 14:13:15.705
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-06-02 14:13:15.642
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 42%
Total physical RAM: 4060.87 MB
Available physical RAM: 2334.32 MB
Total Pagefile: 8119.92 MB
Available Pagefile: 5937.88 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Lokaler Datenträger) (Fixed) (Total:906.34 GB) (Free:824.34 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: A7C2F787)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=906 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25 GB) - (Type=12)

==================== End Of Log ============================
         

--- --- ---



Zur Info:
Mein AntiVir hat mittlerweile einen Trojaner gefunden und in Quarantäne gesetzt:
Win32/Kryptik.CDJE Trojaner

Bitte um weitere Vorgehensweise.

Vielen Dank im Voraus!

Zitat von imrd

Zur Info:
Mein AntiVir hat mittlerweile einen Trojaner gefunden und in Quarantäne gesetzt:
Win32/Kryptik.CDJE Trojaner

Bitte Logdatei von Avira posten... wo hat Avira den Trojaner gefunden... Pfad zur Datei und Dateiname brauche ich.

Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen!