Telekom-Trojaner geöffnet

Dunt · 17.06.2014, 06:46

Hallo,

ich habe leider die zip-Datei von der Telekom-Spam-E-Mail geöffnet. Antivir hat den Trojaner erkannt und ihn in die Quarantäne verschoben. Er steckt aber noch in AppData\Roaming\Microsoft\qwacap32.exe laut Antivir, und der Zugriff wird wechselnd erlaubt und verweigert. Soll ich diese Datei einfach manuell löschen?

Jetzt kommen beim Löschen von Dateien und Öffnen vom Internetexplorer immer Fehlermeldungen.

FRST-Editor:

Code:

ATTFilter

dditional scan result of Farbar Recovery Scan Tool (x64) Version: 16-06-2014
Ran by Fabian at 2014-06-17 07:41:15
Running from C:\Users\Fabian\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

3DMark06 (HKLM-x32\...\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}) (Version: 1.1.0 - Futuremark)
7-Zip 4.57 (HKLM-x32\...\7-Zip) (Version:  - )
AAC Decoder (HKLM-x32\...\{AEF9DC35ADDF4825B049ACBFD1C6EB37}) (Version: 7.1.0 - DivX, Inc.)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.202 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
Apple Software Update (HKLM-x32\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
ATI AVIVO64 Codecs (Version: 9.15.0.20713 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{F8F082F5-C6B0-58F8-8EEA-7A52974D183A}) (Version: 3.0.678.0 - ATI Technologies, Inc.)
AutoUpdate (HKLM-x32\...\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4487 - APN, LLC)
Bonjour (HKLM-x32\...\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}) (Version: 1.0.105 - Apple Inc.)
Catalyst Control Center Core Implementation (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center HydraVision Full (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Localization German (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
CCC Help English (x32 Version: 2008.0602.2242.38732 - ATI) Hidden
CCC Help German (x32 Version: 2008.0602.2242.38732 - ATI) Hidden
ccc-core-static (x32 Version: 2008.0602.2243.38732 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2008.0602.2243.38732 - ATI) Hidden
ChessBase Reader (HKLM-x32\...\{D6330700-4083-48DD-A03C-E209674E7836}) (Version: 2 - )
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6021.5000 - Microsoft Corporation)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6021.5000 - Microsoft Corporation)
DAEMON Tools Toolbar (HKLM-x32\...\DAEMON Tools Toolbar) (Version: 1.0.8.0552 - DT Soft Ltd) <==== ATTENTION
DivX Codec (HKLM-x32\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.9.1 - DivX, Inc.)
DivX Converter (HKLM-x32\...\{13F3917B56CD4C25848BDC69916971BB}) (Version: 7.1.0 - DivX, Inc.)
DivX Converter (HKLM-x32\...\{B13A7C41581B411290FBC0395694E2A9}) (Version: 7.1.0 - DivX, Inc.)
DivX Player (HKLM-x32\...\{8ADFC4160D694100B5B8A22DE9DCABD9}) (Version: 7.2.0 - DivX, Inc.)
DivX Plus DirectShow Filters (HKLM-x32\...\DivX Plus DirectShow Filters) (Version:  - DivX, Inc.)
DivX Plus Web Player (HKLM-x32\...\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 2.0.0 - DivX,Inc.)
DivX Version Checker (HKLM-x32\...\{3FC7CBBC4C1E11DCA1A752EA55D89593}) (Version: 7.1.0.9 - DivX, Inc.)
Fritz 12 (HKLM-x32\...\{4F4182DA-3D58-41E3-913D-480F8DA5C863}) (Version: 12.0.0 - ChessBase)
Fritz 12 (x32 Version: 12.0.0 - ChessBase) Hidden
GIMP 2.6.6 (HKLM-x32\...\WinGimp-2.0_is1) (Version:  - )
H.264 Decoder (HKLM-x32\...\{A96E97134CA649888820BCDE5E300BBD}) (Version: 1.1.0 - DivX, Inc.)
HydraVision (x32 Version: 4.2.84.0 - ATI Technologies Inc.) Hidden
In Nomine 1.0 (HKLM\...\In Nomine_is1) (Version:  - Paradox Interactive)
iTunes (HKLM-x32\...\{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}) (Version: 8.0.2.20 - Apple Inc.)
Japanese Fonts Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5760-0000-900000000003}) (Version: 9.0.0 - Adobe Systems Incorporated)
Java 7 Update 10 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217010FF}) (Version: 7.0.100 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 20 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216020F0}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Java(TM) 6 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216010FF}) (Version: 6.0.210 - Sun Microsystems, Inc.)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MKV Splitter (HKLM-x32\...\{AAC389499AEF40428987B3D30CFC76C9}) (Version: 1.0.1 - DivX, Inc.)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 7 Ultra Edition (HKLM-x32\...\{A20A58C4-6784-4B4B-86CC-94E2E3671031}) (Version: 7.02.8637 - Nero AG)
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
OpenOffice.org 3.2 (HKLM-x32\...\{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}) (Version: 3.2.9502 - OpenOffice.org)
PlayChess  (HKLM-x32\...\PlayChess) (Version:  - ChessBase GmbH)
Playchess (HKLM-x32\...\{70D9854A-CEF5-4BCF-B37A-0AA1AB0A83CF}) (Version: 1.00.000 - ChessBase)
Playchess (x32 Version: 1.00.000 - ChessBase) Hidden
QuickTime (HKLM-x32\...\{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}) (Version: 7.60.92.0 - Apple Inc.)
RealPlayer (HKLM-x32\...\RealPlayer 12.0) (Version:  - RealNetworks)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5567 - Realtek Semiconductor Corp.)
RealUpgrade 1.0 (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden
Skins (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.0 - Safer Networking Limited)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0 - DivX, Inc) Hidden
VLC media player 1.0.3 (HKLM-x32\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Winamp (HKLM-x32\...\Winamp) (Version: 5.541  - Nullsoft, Inc)
WinRAR (HKLM-x32\...\WinRAR archiver) (Version:  - )
WinUHA 2.0 RC1 (2005.02.27) (HKLM-x32\...\WinUHA_is1) (Version:  - Klaimsoft)

==================== Restore Points  =========================

15-05-2014 09:59:37 Windows Update
22-05-2014 18:28:11 Geplanter Prüfpunkt
28-05-2014 18:48:06 Geplanter Prüfpunkt
06-06-2014 10:55:58 Geplanter Prüfpunkt
12-06-2014 06:54:56 Windows Update
16-06-2014 19:03:58 Geplanter Prüfpunkt
16-06-2014 21:57:07 Removed Skype web features
16-06-2014 21:58:27 Removed Skype™ 4.1

==================== Hosts content: ==========================

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {14DFF9EC-B337-4215-83B9-3D9F3D7C65E9} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3131320665-4187305121-1053278066-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2010-02-24] (RealNetworks, Inc.)
Task: {3BFC0E92-E273-43CD-BE14-D472323B3749} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {556ED8B7-D2D0-453F-97C1-D84C33838F20} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {56BEA905-4E59-4317-808E-44B17B0FDFC9} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Fabian => C:\Program Files\Windows Calendar\WinCal.exe [2008-01-19] (Microsoft Corporation)
Task: {66E11425-1D54-4324-BF69-29840D864FF2} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {6CD6CB8A-533C-4872-ABF5-843335DA4F7E} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {C3349D27-433A-4619-9CA1-BCC63638B80B} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3131320665-4187305121-1053278066-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2010-02-24] (RealNetworks, Inc.)
Task: {CDD7C1D6-3E62-4FA8-9DBE-951B7CC33176} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
Task: {D1E22374-CCB4-4B76-B500-95C1AAF00A6E} - System32\Tasks\{09EB9089-4156-41F4-8F5B-082AA230EBCB} => C:\Program Files (x86)\Skype\Phone\Skype.exe
Task: {E266C79A-8BF1-4FBB-BE2E-706671DD0013} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-13] (Adobe Systems Incorporated)
Task: {F37610AF-F823-4108-81D4-5B2E7546F5F8} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {FF53BC52-F368-4962-9C27-0DB2DFB9032C} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2008-06-03 05:35 - 2008-06-03 05:35 - 00116736 _____ () C:\Windows\system32\atitmm64.dll
2008-10-01 23:38 - 2008-06-20 01:41 - 00062464 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2008-10-01 19:56 - 2008-10-01 19:56 - 00014848 _____ () C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
2009-03-03 16:27 - 2005-02-16 01:44 - 00412672 _____ () C:\Program Files (x86)\WinUHA\shellwinuha.dll
2008-10-01 23:38 - 2008-09-16 21:18 - 00132608 _____ () C:\Program Files (x86)\WinRAR\rarext.dll
2014-06-11 20:07 - 2014-06-11 20:07 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-08-13 19:39 - 2013-08-13 19:39 - 16166280 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============

HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\Software\Classes\.exe:  =>  <===== ATTENTION!

==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\startupfolder: C:^Users^Fabian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk => C:\Windows\pss\OpenOffice.org 2.4.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
MSCONFIG\startupreg: WinampAgent => "C:\Program Files (x86)\Winamp\winampa.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/17/2014 07:30:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0xccc, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:30:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0xd94, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:30:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x9a0, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:30:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x7d8, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:30:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0xcdc, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x968, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0xf24, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:14 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x1170, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:09 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x3fc, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x1020, Anwendungsstartzeit RarExtLoader.exe0.


System errors:
=============
Error: (04/21/2014 10:48:14 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Avira Browser-Schutz1 (0x1)

Error: (04/11/2014 10:36:59 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (02/20/2014 11:14:37 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Avira Browser-Schutz4 (0x4)

Error: (02/19/2014 05:17:19 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Avira Browser-Schutz4 (0x4)

Error: (02/18/2014 10:59:13 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Sicherheitsupdate für Microsoft .NET Framework 4 unter Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 für x64-basierte Systeme (KB2901110){A7C5E0F9-AD97-4C2F-8C79-DD4CE28F3278}204

Error: (02/18/2014 10:45:02 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Sicherheitsupdate für Microsoft .NET Framework 4 unter Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 für x64-basierte Systeme (KB2898855){35267B66-2629-4CF3-9DAC-ED77D9E8CFFE}203

Error: (02/18/2014 10:39:21 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Avira Browser-Schutz4 (0x4)

Error: (01/28/2014 11:05:44 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)
Description: 0x8000002a46\SystemRoot\System32\Config\RegBack\COMPONENTS

Error: (10/31/2013 10:20:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Avira Browser-Schutz3

Error: (10/31/2013 10:20:19 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Avira Browser-Schutz201Neustart des Diensts


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2009-12-05 20:48:45.765
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-12-05 20:48:45.734
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-12-05 20:48:45.702
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-12-05 20:48:45.624
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-12-05 20:48:45.593
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-11-28 15:20:00.809
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-11-28 15:20:00.780
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-11-28 15:20:00.754
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-11-28 15:20:00.709
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-10-08 00:19:34.232
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 57%
Total physical RAM: 4094.26 MB
Available physical RAM: 1735.82 MB
Total Pagefile: 8429.78 MB
Available Pagefile: 6136.6 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:244.14 GB) (Free:113.4 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Vienna) (CDROM) (Total:0.09 GB) (Free:0 GB) CDFS
Drive e: (Volume) (Fixed) (Total:221.62 GB) (Free:221.51 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: D2E277B4)
Partition 1: (Active) - (Size=244 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=222 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-06-2014
Ran by Fabian at 2014-06-17 07:41:15
Running from C:\Users\Fabian\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

3DMark06 (HKLM-x32\...\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}) (Version: 1.1.0 - Futuremark)
7-Zip 4.57 (HKLM-x32\...\7-Zip) (Version:  - )
AAC Decoder (HKLM-x32\...\{AEF9DC35ADDF4825B049ACBFD1C6EB37}) (Version: 7.1.0 - DivX, Inc.)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.202 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
Apple Software Update (HKLM-x32\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
ATI AVIVO64 Codecs (Version: 9.15.0.20713 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{F8F082F5-C6B0-58F8-8EEA-7A52974D183A}) (Version: 3.0.678.0 - ATI Technologies, Inc.)
AutoUpdate (HKLM-x32\...\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4487 - APN, LLC)
Bonjour (HKLM-x32\...\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}) (Version: 1.0.105 - Apple Inc.)
Catalyst Control Center Core Implementation (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center HydraVision Full (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Catalyst Control Center Localization German (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
CCC Help English (x32 Version: 2008.0602.2242.38732 - ATI) Hidden
CCC Help German (x32 Version: 2008.0602.2242.38732 - ATI) Hidden
ccc-core-static (x32 Version: 2008.0602.2243.38732 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2008.0602.2243.38732 - ATI) Hidden
ChessBase Reader (HKLM-x32\...\{D6330700-4083-48DD-A03C-E209674E7836}) (Version: 2 - )
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6021.5000 - Microsoft Corporation)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6021.5000 - Microsoft Corporation)
DAEMON Tools Toolbar (HKLM-x32\...\DAEMON Tools Toolbar) (Version: 1.0.8.0552 - DT Soft Ltd) <==== ATTENTION
DivX Codec (HKLM-x32\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.9.1 - DivX, Inc.)
DivX Converter (HKLM-x32\...\{13F3917B56CD4C25848BDC69916971BB}) (Version: 7.1.0 - DivX, Inc.)
DivX Converter (HKLM-x32\...\{B13A7C41581B411290FBC0395694E2A9}) (Version: 7.1.0 - DivX, Inc.)
DivX Player (HKLM-x32\...\{8ADFC4160D694100B5B8A22DE9DCABD9}) (Version: 7.2.0 - DivX, Inc.)
DivX Plus DirectShow Filters (HKLM-x32\...\DivX Plus DirectShow Filters) (Version:  - DivX, Inc.)
DivX Plus Web Player (HKLM-x32\...\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 2.0.0 - DivX,Inc.)
DivX Version Checker (HKLM-x32\...\{3FC7CBBC4C1E11DCA1A752EA55D89593}) (Version: 7.1.0.9 - DivX, Inc.)
Fritz 12 (HKLM-x32\...\{4F4182DA-3D58-41E3-913D-480F8DA5C863}) (Version: 12.0.0 - ChessBase)
Fritz 12 (x32 Version: 12.0.0 - ChessBase) Hidden
GIMP 2.6.6 (HKLM-x32\...\WinGimp-2.0_is1) (Version:  - )
H.264 Decoder (HKLM-x32\...\{A96E97134CA649888820BCDE5E300BBD}) (Version: 1.1.0 - DivX, Inc.)
HydraVision (x32 Version: 4.2.84.0 - ATI Technologies Inc.) Hidden
In Nomine 1.0 (HKLM\...\In Nomine_is1) (Version:  - Paradox Interactive)
iTunes (HKLM-x32\...\{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}) (Version: 8.0.2.20 - Apple Inc.)
Japanese Fonts Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5760-0000-900000000003}) (Version: 9.0.0 - Adobe Systems Incorporated)
Java 7 Update 10 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217010FF}) (Version: 7.0.100 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 20 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216020F0}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Java(TM) 6 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216010FF}) (Version: 6.0.210 - Sun Microsystems, Inc.)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MKV Splitter (HKLM-x32\...\{AAC389499AEF40428987B3D30CFC76C9}) (Version: 1.0.1 - DivX, Inc.)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 7 Ultra Edition (HKLM-x32\...\{A20A58C4-6784-4B4B-86CC-94E2E3671031}) (Version: 7.02.8637 - Nero AG)
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
OpenOffice.org 3.2 (HKLM-x32\...\{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}) (Version: 3.2.9502 - OpenOffice.org)
PlayChess  (HKLM-x32\...\PlayChess) (Version:  - ChessBase GmbH)
Playchess (HKLM-x32\...\{70D9854A-CEF5-4BCF-B37A-0AA1AB0A83CF}) (Version: 1.00.000 - ChessBase)
Playchess (x32 Version: 1.00.000 - ChessBase) Hidden
QuickTime (HKLM-x32\...\{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}) (Version: 7.60.92.0 - Apple Inc.)
RealPlayer (HKLM-x32\...\RealPlayer 12.0) (Version:  - RealNetworks)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5567 - Realtek Semiconductor Corp.)
RealUpgrade 1.0 (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden
Skins (x32 Version: 2008.0602.2243.38732 - ATI) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.0 - Safer Networking Limited)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0 - DivX, Inc) Hidden
VLC media player 1.0.3 (HKLM-x32\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Winamp (HKLM-x32\...\Winamp) (Version: 5.541  - Nullsoft, Inc)
WinRAR (HKLM-x32\...\WinRAR archiver) (Version:  - )
WinUHA 2.0 RC1 (2005.02.27) (HKLM-x32\...\WinUHA_is1) (Version:  - Klaimsoft)

==================== Restore Points  =========================

15-05-2014 09:59:37 Windows Update
22-05-2014 18:28:11 Geplanter Prüfpunkt
28-05-2014 18:48:06 Geplanter Prüfpunkt
06-06-2014 10:55:58 Geplanter Prüfpunkt
12-06-2014 06:54:56 Windows Update
16-06-2014 19:03:58 Geplanter Prüfpunkt
16-06-2014 21:57:07 Removed Skype web features
16-06-2014 21:58:27 Removed Skype™ 4.1

==================== Hosts content: ==========================

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {14DFF9EC-B337-4215-83B9-3D9F3D7C65E9} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3131320665-4187305121-1053278066-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2010-02-24] (RealNetworks, Inc.)
Task: {3BFC0E92-E273-43CD-BE14-D472323B3749} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {556ED8B7-D2D0-453F-97C1-D84C33838F20} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {56BEA905-4E59-4317-808E-44B17B0FDFC9} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Fabian => C:\Program Files\Windows Calendar\WinCal.exe [2008-01-19] (Microsoft Corporation)
Task: {66E11425-1D54-4324-BF69-29840D864FF2} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {6CD6CB8A-533C-4872-ABF5-843335DA4F7E} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {C3349D27-433A-4619-9CA1-BCC63638B80B} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3131320665-4187305121-1053278066-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2010-02-24] (RealNetworks, Inc.)
Task: {CDD7C1D6-3E62-4FA8-9DBE-951B7CC33176} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
Task: {D1E22374-CCB4-4B76-B500-95C1AAF00A6E} - System32\Tasks\{09EB9089-4156-41F4-8F5B-082AA230EBCB} => C:\Program Files (x86)\Skype\Phone\Skype.exe
Task: {E266C79A-8BF1-4FBB-BE2E-706671DD0013} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-13] (Adobe Systems Incorporated)
Task: {F37610AF-F823-4108-81D4-5B2E7546F5F8} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {FF53BC52-F368-4962-9C27-0DB2DFB9032C} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2008-06-03 05:35 - 2008-06-03 05:35 - 00116736 _____ () C:\Windows\system32\atitmm64.dll
2008-10-01 23:38 - 2008-06-20 01:41 - 00062464 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2008-10-01 19:56 - 2008-10-01 19:56 - 00014848 _____ () C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
2009-03-03 16:27 - 2005-02-16 01:44 - 00412672 _____ () C:\Program Files (x86)\WinUHA\shellwinuha.dll
2008-10-01 23:38 - 2008-09-16 21:18 - 00132608 _____ () C:\Program Files (x86)\WinRAR\rarext.dll
2014-06-11 20:07 - 2014-06-11 20:07 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-08-13 19:39 - 2013-08-13 19:39 - 16166280 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============

HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\Software\Classes\.exe:  =>  <===== ATTENTION!

==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\startupfolder: C:^Users^Fabian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk => C:\Windows\pss\OpenOffice.org 2.4.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
MSCONFIG\startupreg: WinampAgent => "C:\Program Files (x86)\Winamp\winampa.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/17/2014 07:30:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0xccc, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:30:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0xd94, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:30:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x9a0, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:30:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x7d8, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:30:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0xcdc, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x968, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0xf24, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:14 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x1170, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:09 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x3fc, Anwendungsstartzeit RarExtLoader.exe0.

Error: (06/17/2014 07:25:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung RarExtLoader.exe, Version 0.0.0.0, Zeitstempel 0x00000000, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x77471ae6,
Prozess-ID 0x1020, Anwendungsstartzeit RarExtLoader.exe0.


System errors:
=============
Error: (04/21/2014 10:48:14 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Avira Browser-Schutz1 (0x1)

Error: (04/11/2014 10:36:59 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (02/20/2014 11:14:37 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Avira Browser-Schutz4 (0x4)

Error: (02/19/2014 05:17:19 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Avira Browser-Schutz4 (0x4)

Error: (02/18/2014 10:59:13 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Sicherheitsupdate für Microsoft .NET Framework 4 unter Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 für x64-basierte Systeme (KB2901110){A7C5E0F9-AD97-4C2F-8C79-DD4CE28F3278}204

Error: (02/18/2014 10:45:02 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Sicherheitsupdate für Microsoft .NET Framework 4 unter Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 für x64-basierte Systeme (KB2898855){35267B66-2629-4CF3-9DAC-ED77D9E8CFFE}203

Error: (02/18/2014 10:39:21 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Avira Browser-Schutz4 (0x4)

Error: (01/28/2014 11:05:44 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)
Description: 0x8000002a46\SystemRoot\System32\Config\RegBack\COMPONENTS

Error: (10/31/2013 10:20:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Avira Browser-Schutz3

Error: (10/31/2013 10:20:19 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Avira Browser-Schutz201Neustart des Diensts


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2009-12-05 20:48:45.765
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-12-05 20:48:45.734
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-12-05 20:48:45.702
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-12-05 20:48:45.624
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-12-05 20:48:45.593
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-11-28 15:20:00.809
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-11-28 15:20:00.780
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-11-28 15:20:00.754
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-11-28 15:20:00.709
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2009-10-08 00:19:34.232
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 57%
Total physical RAM: 4094.26 MB
Available physical RAM: 1735.82 MB
Total Pagefile: 8429.78 MB
Available Pagefile: 6136.6 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:244.14 GB) (Free:113.4 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Vienna) (CDROM) (Total:0.09 GB) (Free:0 GB) CDFS
Drive e: (Volume) (Fixed) (Total:221.62 GB) (Free:221.51 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: D2E277B4)
Partition 1: (Active) - (Size=244 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=222 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Hoffe ihr könnt mir helfen.

schrauber · 17.06.2014, 07:41

hi,

FRST.txt fehlt noch.

Dunt · 17.06.2014, 07:48

Sorry, hier FRST Editor:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-06-2014
Ran by Fabian (administrator) on FABIAN-PC on 17-06-2014 08:44:56
Running from C:\Users\Fabian\Desktop
Platform: Windows Vista (TM) Business Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Windows\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [5684736 2008-02-13] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758160 2014-02-13] (APN)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\Run: [qwacap32.exe] => C:\Users\Fabian\AppData\Roaming\Microsoft\qwacap32.exe [262144 2008-01-19] (Surprint)
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_94_Plugin.exe [814984 2013-08-13] (Adobe Systems Incorporated)
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\MountPoints2: {95841d0b-77b3-11de-86cc-0021851a86b7} - F:\setup.exe
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\MountPoints2: {e3d7f480-8fdc-11dd-afc9-806e6f6e6963} - D:\setup.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.daemon-search.com/startpage
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - DefaultScope {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9} URL = hxxp://www.daemon-search.com/search/web?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9} URL = hxxp://www.daemon-search.com/search/web?q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Tcpip\..\Interfaces\{6E7C7EF7-6D79-48A9-9890-6D1BF4383BFE}: [NameServer]192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default
FF DefaultSearchEngine: Startpage HTTPS - Deutsch
FF SelectedSearchEngine: Startpage HTTPS - Deutsch
FF Homepage: hxxp://www.spiegel.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=1.0.3.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=1.0.0.0 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprjplug.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF SearchPlugin: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\searchplugins\daemon-search.xml
FF SearchPlugin: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-16]
FF Extension: Ghostery - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\firefox@ghostery.com.xpi [2013-08-18]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: Flagfox - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-03-10]
FF Extension: Image Zoom - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi [2013-04-17]
FF Extension: NoScript - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-01-02]
FF Extension: Adblock Plus - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-02]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
S4 iPod Service; C:\Program Files (x86)\iPod\bin\iPodService.exe [536872 2009-01-06] (Apple Inc.)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [271920 2007-05-16] (Nero AG)

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-07-23] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-03] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-07-23] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-04-02] () [File not signed]
U3 apqr4jk2; C:\Windows\System32\Drivers\apqr4jk2.sys [0 ] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-17 07:41 - 2014-06-17 07:42 - 00027733 _____ () C:\Users\Fabian\Desktop\Addition.txt
2014-06-17 07:31 - 2014-06-17 08:44 - 00015079 _____ () C:\Users\Fabian\Desktop\FRST.txt
2014-06-16 23:51 - 2014-06-17 08:44 - 00000000 ____D () C:\FRST
2014-06-16 23:50 - 2014-06-16 23:50 - 02081280 _____ (Farbar) C:\Users\Fabian\Desktop\FRST64.exe
2014-06-16 23:30 - 2014-06-16 23:35 - 94714880 _____ (AVAST Software) C:\Users\Fabian\Desktop\avast_free_antivirus_setup_21514.exe
2014-06-11 20:06 - 2014-06-11 20:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-11 19:14 - 2014-05-06 09:27 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 19:14 - 2014-05-06 09:26 - 01430528 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 19:14 - 2014-05-06 09:26 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 05736448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 01129984 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00763904 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 07051776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00377856 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00224768 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 19:14 - 2014-05-06 09:22 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-06-11 19:14 - 2014-05-06 07:51 - 00485376 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-06-11 19:14 - 2014-05-06 07:13 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 19:14 - 2014-05-06 06:46 - 03630592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 01177600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00834048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00671744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 06119424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00380928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00271872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00193024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00180736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll
2014-06-11 19:14 - 2014-05-06 05:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-06-11 19:14 - 2014-05-06 05:07 - 01383424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 19:14 - 2014-04-26 20:21 - 00622592 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 19:14 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-11 19:14 - 2014-04-05 11:10 - 01422784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 19:14 - 2014-03-10 08:26 - 01869824 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 19:14 - 2014-03-10 08:26 - 01794560 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 19:14 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-11 19:14 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-06-17 08:45 - 2014-06-17 07:31 - 00015079 _____ () C:\Users\Fabian\Desktop\FRST.txt
2014-06-17 08:45 - 2008-10-01 19:39 - 00000000 ____D () C:\Users\Fabian\AppData\Local\Temp
2014-06-17 08:44 - 2014-06-16 23:51 - 00000000 ____D () C:\FRST
2014-06-17 08:38 - 2012-04-01 12:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-17 07:42 - 2014-06-17 07:41 - 00027733 _____ () C:\Users\Fabian\Desktop\Addition.txt
2014-06-17 07:14 - 2006-11-02 17:25 - 01441193 _____ () C:\Windows\WindowsUpdate.log
2014-06-17 07:14 - 2006-11-02 17:20 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-17 07:14 - 2006-11-02 17:20 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-17 00:05 - 2008-10-01 23:35 - 00000000 ____D () C:\Users\Fabian\Desktop\Zeugs
2014-06-17 00:03 - 2008-10-02 23:33 - 00000000 ____D () C:\Program Files (x86)\Warcraft III
2014-06-17 00:02 - 2009-02-18 17:18 - 00000000 ____D () C:\Program Files (x86)\Miranda IM
2014-06-17 00:01 - 2008-10-01 19:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-17 00:00 - 2009-09-19 12:24 - 00000000 ____D () C:\ProgramData\Skype
2014-06-16 23:56 - 2012-04-23 17:07 - 00000000 ____D () C:\Program Files (x86)\Citrix
2014-06-16 23:50 - 2014-06-16 23:50 - 02081280 _____ (Farbar) C:\Users\Fabian\Desktop\FRST64.exe
2014-06-16 23:35 - 2014-06-16 23:30 - 94714880 _____ (AVAST Software) C:\Users\Fabian\Desktop\avast_free_antivirus_setup_21514.exe
2014-06-16 20:06 - 2006-11-02 21:23 - 00689180 _____ () C:\Windows\system32\perfh007.dat
2014-06-16 20:06 - 2006-11-02 21:23 - 00150570 _____ () C:\Windows\system32\perfc007.dat
2014-06-16 20:06 - 2006-11-02 14:46 - 01596714 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-16 20:00 - 2006-11-02 17:38 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-16 10:50 - 2006-11-02 17:38 - 00032510 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-12 21:38 - 2012-04-27 09:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-12 08:59 - 2013-08-16 19:05 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 08:58 - 2006-11-02 14:35 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-06-11 20:07 - 2014-06-11 20:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-04 11:44 - 2013-08-29 20:45 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-04 11:44 - 2013-08-29 20:45 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-28 21:03 - 2009-09-08 20:27 - 00000000 ____D () C:\Users\Fabian\Documents\Textdateien

Some content of TEMP:
====================
C:\Users\Fabian\AppData\Local\Temp\avgnt.exe
C:\Users\Fabian\AppData\Local\Temp\ose00000.exe
C:\Users\Fabian\AppData\Local\Temp\_is3C73.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-17 08:08

==================== End Of Log ============================

--- --- ---

schrauber · 17.06.2014, 10:56

Adware & Co. deinstallieren

Lade Dir bitte von hier Revo Uninstaller herunter.
Installiere und starte das Programm.
Suche im Uninstallerfeld nach den Programmen, die unter:

diesen Zusatz haben:
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Dunt · 17.06.2014, 11:16

Vielen Dank für die schnelle Antwort.

Ich habe mit Revo Uninstaller das Programm, welches mit ATTENTION markiert war, deinstalliert.
Es befinden sich nun unter "installed programms" keine weiteren ATTENTION-markierten Programme mehr.

Allerdings gibt es unter
==================== EXE Association (whitelisted) =============
noch eine .exe-Datei, welche mit ATTENTION markiert ist. Diese ist nicht im Revo Uninstaller zu finden. Soll ich Combofix installieren und diese Datei mit Combofix suchen und deinstallieren?

schrauber · 18.06.2014, 09:03

Einfach Combofix wie oben beschrieben laufen lassen.

Dunt · 18.06.2014, 10:42

Hallo,

ich hab Combofix nun heruntergeladen, nur leider kann ich Antivir nicht mehr öffnen und daher auch nicht mehr beenden.

Edit: hab über Umwege geschafft, antivir zu beenden. Combofix läuft.

Code:

ATTFilter

ComboFix 14-06-16.01 - FABIAN-PC$ 18.06.2014  10:49:15.1.2 - x64
Microsoft® Windows Vista™ Business   6.0.6002.2.1252.49.1031.18.4094.1928 [GMT 2:00]
ausgeführt von:: c:\windows\SysWOW64\config\systemprofile\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Fabian\AppData\Roaming\Microsoft\qwacap32.exe
c:\users\Fabian\AppData\Roaming\Microsoft\Windows\Recent\Tobias +D+M.ea
E:\install.exe
.
c:\windows\System32\perfmon.exe . . . ist infiziert!!
.
c:\windows\SysWOW64\perfmon.exe . . . ist infiziert!!
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-18 bis 2014-06-18  ))))))))))))))))))))))))))))))
.
.
2014-06-18 09:31 . 2014-06-18 09:31	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-06-17 10:00 . 2014-06-17 10:00	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-06-16 21:51 . 2014-06-17 15:26	--------	d-----w-	C:\FRST
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-12 06:58 . 2006-11-02 12:35	95414520	----a-w-	c:\windows\system32\mrt.exe
2014-06-04 09:44 . 2013-08-29 18:45	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-06-04 09:44 . 2013-08-29 18:45	112080	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-05-06 07:23 . 2014-06-11 17:14	146944	----a-w-	c:\windows\apppatch\AppPatch64\iebrshim.dll
2014-05-06 04:45 . 2014-06-11 17:14	53760	----a-w-	c:\windows\apppatch\iebrshim.dll
2014-03-25 16:30 . 2014-05-14 17:26	12900864	----a-w-	c:\windows\system32\shell32.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-02-13 05:22	12240	----a-w-	c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2014-02-13 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-06-04 737872]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2014-02-13 1758160]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - ASWHWID
*NewlyCreated* - ASWMONFLT
*NewlyCreated* - ASWRDR
*NewlyCreated* - ASWSNX
*NewlyCreated* - ASWTDI
*NewlyCreated* - ASWVMM
*Deregistered* - aswHwid
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
Themes
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 17:39]
.
2014-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-06-17 17:22]
.
2014-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-06-17 17:22]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-02-13 05:22	13776	----a-w-	c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll" [2014-02-13 13776]
.
[HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RAVCpl64.exe" [2008-02-13 5684736]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.daemon-search.com/startpage
mLocal Page = %SystemRoot%\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{6E7C7EF7-6D79-48A9-9890-6D1BF4383BFE}: NameServer = 192.168.0.1
FF - ProfilePath - c:\users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\
FF - prefs.js: browser.search.selectedEngine - Startpage HTTPS - Deutsch
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKCU-Run-qwacap32.exe - c:\users\Fabian\AppData\Roaming\Microsoft\qwacap32.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3131320665-4187305121-1053278066-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*’%Q%j*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3131320665-4187305121-1053278066-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*’%Q%j*\OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3131320665-4187305121-1053278066-1000\Software\SecuROM\License information*]
"datasecu"=hex:15,3c,04,bd,a0,f0,65,5f,e3,9d,d8,5d,86,5a,04,54,26,fa,49,a7,29,
   5b,1c,c6,08,51,61,6f,63,cd,f0,35,87,8e,b0,6a,82,ac,37,24,51,41,6a,bd,a7,1d,\
"rkeysecu"=hex:ac,f3,b6,12,c4,50,f2,ab,55,c3,69,18,d1,45,3e,c7
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2014-06-18  11:36:12
ComboFix-quarantined-files.txt  2014-06-18 09:36
.
Vor Suchlauf: 9 Verzeichnis(se), 123.763.085.312 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 124.982.292.480 Bytes frei
.
- - End Of File - - A7C7B914BEBAE1E1EA016BCECC7C80E0
5C616939100B85E558DA92B899A0FC36

schrauber · 19.06.2014, 11:48

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Dunt · 23.06.2014, 05:32

Malwarebytes:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 22.06.2014
Suchlauf-Zeit: 20:03:57
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.22.02
Rootkit Datenbank: v2014.06.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x64
Dateisystem: NTFS
Benutzer: Fabian

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 285801
Verstrichene Zeit: 11 Min, 57 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

AdwCleaner:

Code:

ATTFilter

# AdwCleaner v3.212 - Bericht erstellt am 22/06/2014 um 20:29:05
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows (TM) Vista Business Service Pack 2 (64 bits)
# Benutzername : Fabian - FABIAN-PC
# Gestartet von : C:\Users\Fabian\Desktop\adwcleaner_3.212.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\DTToolbar@toolbarnet.com
Datei Gelöscht : C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\searchplugins\daemon-search.xml

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB9}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\daemon tools toolbar

***** [ Browser ] *****

-\\ Internet Explorer v7.0.6002.18005

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [2447 octets] - [22/06/2014 20:27:38]
AdwCleaner[S0].txt - [2086 octets] - [22/06/2014 20:29:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2146 octets] ##########

Junkware Removal Tool:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows (TM) Vista Business x64
Ran by Fabian on 22.06.2014 at 20:41:53,50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [File] C:\Users\Fabian\AppData\Roaming\mozilla\firefox\profiles\4iaicnu2.default\extensions\toolbar_avira-v7@apn.ask.com.xpi
Emptied folder: C:\Users\Fabian\AppData\Roaming\mozilla\firefox\profiles\4iaicnu2.default\minidumps [64 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.06.2014 at 20:46:08,74
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Frisches FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-06-2014 01
Ran by Fabian (administrator) on FABIAN-PC on 22-06-2014 21:00:58
Running from C:\Users\Fabian\Desktop
Platform: Windows Vista (TM) Business Service Pack 2 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Realtek Semiconductor) C:\Windows\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\conime.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [5684736 2008-02-13] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-04] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_94_Plugin.exe [814984 2013-08-13] (Adobe Systems Incorporated)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Tcpip\..\Interfaces\{6E7C7EF7-6D79-48A9-9890-6D1BF4383BFE}: [NameServer]192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default
FF DefaultSearchEngine: Startpage HTTPS - Deutsch
FF SelectedSearchEngine: Startpage HTTPS - Deutsch
FF Homepage: hxxp://www.spiegel.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=1.0.3.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=1.0.0.0 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprjplug.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF SearchPlugin: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-22]
FF Extension: Ghostery - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\firefox@ghostery.com.xpi [2013-08-18]
FF Extension: Flagfox - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-03-10]
FF Extension: Image Zoom - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi [2013-04-17]
FF Extension: NoScript - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-01-02]
FF Extension: Adblock Plus - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-02]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-23]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
S4 iPod Service; C:\Program Files (x86)\iPod\bin\iPodService.exe [536872 2009-01-06] (Apple Inc.)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [271920 2007-05-16] (Nero AG)

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-07-23] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-03] (Avira Operations GmbH & Co. KG)
S1 Beep; No ImagePath
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-07-23] ()
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-22] (Malwarebytes Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-04-02] () [File not signed]
U3 a4mrwy4k; C:\Windows\System32\Drivers\a4mrwy4k.sys [0 ] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-22 20:46 - 2014-06-22 20:46 - 00001228 _____ () C:\Users\Fabian\Desktop\JRT.txt
2014-06-22 20:37 - 2014-06-22 20:37 - 01016261 _____ (Thisisu) C:\Users\Fabian\Desktop\JRT.exe
2014-06-22 20:37 - 2014-06-22 20:37 - 00000000 ____D () C:\Windows\ERUNT
2014-06-22 20:36 - 2014-06-22 20:36 - 00002234 _____ () C:\Users\Fabian\Desktop\AdwCleaner[S0].txt
2014-06-22 20:27 - 2014-06-22 20:29 - 00000000 ____D () C:\AdwCleaner
2014-06-22 20:25 - 2014-06-22 20:25 - 00001164 _____ () C:\mbam.txt
2014-06-22 20:02 - 2014-06-22 20:57 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 20:02 - 2014-06-22 20:02 - 00000941 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-22 20:02 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-22 20:02 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-22 20:02 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-22 20:00 - 2014-06-22 20:00 - 01333465 _____ () C:\Users\Fabian\Desktop\adwcleaner_3.212.exe
2014-06-22 19:59 - 2014-06-22 20:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Fabian\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-18 11:36 - 2014-06-18 11:36 - 00012894 _____ () C:\ComboFix.txt
2014-06-18 10:47 - 2014-06-18 11:36 - 00000000 ____D () C:\ComboFix
2014-06-18 10:47 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-18 10:47 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-18 10:47 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-18 10:32 - 2014-06-18 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-06-18 10:20 - 2014-06-18 11:36 - 00000000 ____D () C:\Qoobox
2014-06-18 10:20 - 2014-06-18 11:33 - 00000000 ____D () C:\Windows\erdnt
2014-06-17 19:24 - 2014-06-17 19:24 - 00000000 ____D () C:\Users\Fabian\AppData\Roaming\AVAST Software
2014-06-17 19:22 - 2014-06-22 20:33 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-17 19:22 - 2014-06-22 20:32 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-17 19:22 - 2014-06-18 10:28 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-17 19:22 - 2014-06-18 10:28 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-17 19:22 - 2014-06-17 19:22 - 00000000 ____D () C:\Users\Fabian\AppData\Local\Google
2014-06-17 19:22 - 2014-06-17 19:22 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-17 19:21 - 2014-06-17 19:21 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-17 19:19 - 2014-06-17 19:19 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-17 19:18 - 2014-06-17 19:19 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-17 17:23 - 2014-06-17 17:26 - 00027906 _____ () C:\Users\Fabian\Desktop\Addition.txt
2014-06-17 17:22 - 2014-06-22 21:00 - 00013294 _____ () C:\Users\Fabian\Desktop\FRST.txt
2014-06-17 12:00 - 2014-06-22 19:56 - 00017661 _____ () C:\Users\Fabian\Desktop\revosetup95.exe
2014-06-17 12:00 - 2014-06-17 12:00 - 00001099 _____ () C:\Users\Fabian\Desktop\Revo Uninstaller.lnk
2014-06-17 12:00 - 2014-06-17 12:00 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-17 08:45 - 2014-06-17 08:45 - 00060101 _____ () C:\Users\Fabian\Desktop\Shortcut.txt
2014-06-16 23:51 - 2014-06-22 21:00 - 00000000 ____D () C:\FRST
2014-06-16 23:50 - 2014-06-22 19:56 - 02083328 _____ (Farbar) C:\Users\Fabian\Desktop\FRST64.exe
2014-06-16 23:30 - 2014-06-16 23:35 - 94714880 _____ (AVAST Software) C:\Users\Fabian\Desktop\avast_free_antivirus_setup_21514.exe
2014-06-11 20:06 - 2014-06-11 20:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-11 19:14 - 2014-05-06 09:27 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 19:14 - 2014-05-06 09:26 - 01430528 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 19:14 - 2014-05-06 09:26 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 05736448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 01129984 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00763904 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 07051776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00377856 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00224768 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 19:14 - 2014-05-06 09:22 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-06-11 19:14 - 2014-05-06 07:51 - 00485376 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-06-11 19:14 - 2014-05-06 07:13 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 19:14 - 2014-05-06 06:46 - 03630592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 01177600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00834048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00671744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 06119424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00380928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00271872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00193024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00180736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll
2014-06-11 19:14 - 2014-05-06 05:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-06-11 19:14 - 2014-05-06 05:07 - 01383424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 19:14 - 2014-04-26 20:21 - 00622592 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 19:14 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-11 19:14 - 2014-04-05 11:10 - 01422784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 19:14 - 2014-03-10 08:26 - 01869824 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 19:14 - 2014-03-10 08:26 - 01794560 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 19:14 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-11 19:14 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-06-22 21:01 - 2014-06-17 17:22 - 00013294 _____ () C:\Users\Fabian\Desktop\FRST.txt
2014-06-22 21:00 - 2014-06-16 23:51 - 00000000 ____D () C:\FRST
2014-06-22 20:57 - 2014-06-22 20:02 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 20:46 - 2014-06-22 20:46 - 00001228 _____ () C:\Users\Fabian\Desktop\JRT.txt
2014-06-22 20:38 - 2012-04-01 12:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-22 20:37 - 2014-06-22 20:37 - 01016261 _____ (Thisisu) C:\Users\Fabian\Desktop\JRT.exe
2014-06-22 20:37 - 2014-06-22 20:37 - 00000000 ____D () C:\Windows\ERUNT
2014-06-22 20:37 - 2006-11-02 21:23 - 00689180 _____ () C:\Windows\system32\perfh007.dat
2014-06-22 20:37 - 2006-11-02 21:23 - 00150570 _____ () C:\Windows\system32\perfc007.dat
2014-06-22 20:37 - 2006-11-02 14:46 - 01596714 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-22 20:36 - 2014-06-22 20:36 - 00002234 _____ () C:\Users\Fabian\Desktop\AdwCleaner[S0].txt
2014-06-22 20:36 - 2006-11-02 17:25 - 01530395 _____ () C:\Windows\WindowsUpdate.log
2014-06-22 20:33 - 2014-06-17 19:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-22 20:32 - 2014-06-17 19:22 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-22 20:32 - 2006-11-02 17:38 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-22 20:32 - 2006-11-02 17:20 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-22 20:32 - 2006-11-02 17:20 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-22 20:31 - 2008-10-01 19:18 - 00285270 _____ () C:\Windows\PFRO.log
2014-06-22 20:29 - 2014-06-22 20:27 - 00000000 ____D () C:\AdwCleaner
2014-06-22 20:29 - 2006-11-02 17:38 - 00032510 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-22 20:25 - 2014-06-22 20:25 - 00001164 _____ () C:\mbam.txt
2014-06-22 20:02 - 2014-06-22 20:02 - 00000941 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-22 20:00 - 2014-06-22 20:00 - 01333465 _____ () C:\Users\Fabian\Desktop\adwcleaner_3.212.exe
2014-06-22 20:00 - 2014-06-22 19:59 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Fabian\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-22 19:56 - 2014-06-17 12:00 - 00017661 _____ () C:\Users\Fabian\Desktop\revosetup95.exe
2014-06-22 19:56 - 2014-06-16 23:50 - 02083328 _____ (Farbar) C:\Users\Fabian\Desktop\FRST64.exe
2014-06-18 11:36 - 2014-06-18 11:36 - 00012894 _____ () C:\ComboFix.txt
2014-06-18 11:36 - 2014-06-18 10:47 - 00000000 ____D () C:\ComboFix
2014-06-18 11:36 - 2014-06-18 10:20 - 00000000 ____D () C:\Qoobox
2014-06-18 11:36 - 2006-11-02 15:33 - 00000000 __RHD () C:\Users\Default
2014-06-18 11:33 - 2014-06-18 10:20 - 00000000 ____D () C:\Windows\erdnt
2014-06-18 11:32 - 2006-11-02 14:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-18 10:32 - 2014-06-18 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-06-18 10:32 - 2013-08-29 20:45 - 00001901 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-06-18 10:32 - 2013-08-29 20:44 - 00000000 ____D () C:\ProgramData\Avira
2014-06-18 10:28 - 2014-06-17 19:22 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-18 10:28 - 2014-06-17 19:22 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-17 19:24 - 2014-06-17 19:24 - 00000000 ____D () C:\Users\Fabian\AppData\Roaming\AVAST Software
2014-06-17 19:22 - 2014-06-17 19:22 - 00000000 ____D () C:\Users\Fabian\AppData\Local\Google
2014-06-17 19:22 - 2014-06-17 19:22 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-17 19:21 - 2014-06-17 19:21 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-17 19:20 - 2006-11-02 17:05 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-06-17 19:19 - 2014-06-17 19:19 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-17 19:19 - 2014-06-17 19:18 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-17 17:26 - 2014-06-17 17:23 - 00027906 _____ () C:\Users\Fabian\Desktop\Addition.txt
2014-06-17 17:25 - 2008-11-30 12:19 - 00029696 _____ () C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-06-17 17:21 - 2008-10-01 23:35 - 00000000 ____D () C:\Users\Fabian\Desktop\Zeugs
2014-06-17 12:00 - 2014-06-17 12:00 - 00001099 _____ () C:\Users\Fabian\Desktop\Revo Uninstaller.lnk
2014-06-17 12:00 - 2014-06-17 12:00 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-17 08:45 - 2014-06-17 08:45 - 00060101 _____ () C:\Users\Fabian\Desktop\Shortcut.txt
2014-06-17 00:03 - 2008-10-02 23:33 - 00000000 ____D () C:\Program Files (x86)\Warcraft III
2014-06-17 00:02 - 2009-02-18 17:18 - 00000000 ____D () C:\Program Files (x86)\Miranda IM
2014-06-17 00:01 - 2008-10-01 19:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-17 00:00 - 2009-09-19 12:24 - 00000000 ____D () C:\ProgramData\Skype
2014-06-16 23:56 - 2012-04-23 17:07 - 00000000 ____D () C:\Program Files (x86)\Citrix
2014-06-16 23:35 - 2014-06-16 23:30 - 94714880 _____ (AVAST Software) C:\Users\Fabian\Desktop\avast_free_antivirus_setup_21514.exe
2014-06-12 21:38 - 2012-04-27 09:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-12 08:59 - 2013-08-16 19:05 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 08:58 - 2006-11-02 14:35 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-06-11 20:07 - 2014-06-11 20:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-04 11:44 - 2013-08-29 20:45 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-04 11:44 - 2013-08-29 20:45 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-28 21:03 - 2009-09-08 20:27 - 00000000 ____D () C:\Users\Fabian\Documents\Textdateien

Some content of TEMP:
====================
C:\Users\Fabian\AppData\Local\Temp\avgnt.exe
C:\Users\Fabian\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-22 20:38

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Ich habe nochmal einen Scan mit Antivir durchgeführt, und es wurde noch ein Trojaner gefunden:

Code:

ATTFilter

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Qoobox\Quarantine\C\Users\Fabian\AppData\Roaming\Microsoft\qwacap32.exe.vir
  [FUND]      Ist das Trojanische Pferd TR/SpluseLoader.A.5
Beginne mit der Suche in 'E:\' <Volume>

Beginne mit der Desinfektion:
C:\Qoobox\Quarantine\C\Users\Fabian\AppData\Roaming\Microsoft\qwacap32.exe.vir
  [FUND]      Ist das Trojanische Pferd TR/SpluseLoader.A.5
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50be0979.qua' verschoben!

Er wurde jetzt in die Quarantäne verschoben.

schrauber · 23.06.2014, 18:46

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Dunt · 24.06.2014, 10:58

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=4e4d5850aaa8d545ba69de885eb665b6
# engine=18846
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-23 09:34:44
# local_time=2014-06-23 11:34:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 99458 148062058 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 0 241083309 0 0
# scanned=244861
# found=33
# cleaned=0
# scan_time=4776
sh=0AB7E14045C76206A8733C6E4D36220A58C85A77 ft=1 fh=9f671b8e7a289dd3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe"
sh=2A88FC6509FDC3B22587F6E97AC12F70E4F75DC8 ft=1 fh=86e0df17c19558fd vn="Variante von Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\APNSetup.exe"
sh=408E55A7D2D56C02EF844CA63C1EA8D440D1F8B2 ft=1 fh=cf5f3ba9cab9d1c3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\searchhook.dll"
sh=EC5913DE16698FF281FE1F1108602BD300AFDA91 ft=1 fh=400322602d09beb6 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ServiceLocator.exe"
sh=4E3A9EF57C71B5829AC8CD185CBED27AF6610C13 ft=1 fh=83a0e01ca2b69786 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\SO.dll"
sh=698FB11D2C5D96C744D8602AD22309F10509063A ft=1 fh=c3312308a781a9fa vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\toolbar.dll"
sh=0111559B94F5572B6777EBE3E85CB9F9C94BC85B ft=1 fh=76e883fd9357c7a4 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Toolbar.exe"
sh=BB237CE0031AFF6ABD4E3626D7C6AE3D6ABEDB5A ft=1 fh=2522929e49563be6 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ToolbarPS.dll"
sh=9C835C702D070F54C59E36FED31696261FEBFDA3 ft=1 fh=29643e02259e76bc vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\toolbar_x64.dll"
sh=B27AA1F8303815E20CE148744957CB3726BCDE96 ft=1 fh=e7bb97c341e31fcc vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\UpdateManager.exe"
sh=6CDE6B1DD298CA47510EB79334AE149F60FEFFCE ft=1 fh=0241d1e8e3e9ed03 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll"
sh=84987AF48F5107F84A12BB7418C0A7A2106906B0 ft=1 fh=6e62188c597b6ea7 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll"
sh=F2CFD9E6717ED73F51E976B3957C81DD518C5603 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.10.0_AVIRA-V7.msi"
sh=01EF1A2420765129D2F26E0530725B5F71D8BB96 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.2.2_AVIRA-V7.msi"
sh=F4B0FF4B42F223CF8338684906BCFFAD9AA2710E ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.6.0_AVIRA-V7.msi"
sh=0AB7E14045C76206A8733C6E4D36220A58C85A77 ft=1 fh=9f671b8e7a289dd3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\apnmcp.exe"
sh=408E55A7D2D56C02EF844CA63C1EA8D440D1F8B2 ft=1 fh=cf5f3ba9cab9d1c3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\searchhook.dll"
sh=EC5913DE16698FF281FE1F1108602BD300AFDA91 ft=1 fh=400322602d09beb6 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\ServiceLocator.exe"
sh=4E3A9EF57C71B5829AC8CD185CBED27AF6610C13 ft=1 fh=83a0e01ca2b69786 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\SO.dll"
sh=698FB11D2C5D96C744D8602AD22309F10509063A ft=1 fh=c3312308a781a9fa vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\toolbar.dll"
sh=0111559B94F5572B6777EBE3E85CB9F9C94BC85B ft=1 fh=76e883fd9357c7a4 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\Toolbar.exe"
sh=BB237CE0031AFF6ABD4E3626D7C6AE3D6ABEDB5A ft=1 fh=2522929e49563be6 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\ToolbarPS.dll"
sh=9C835C702D070F54C59E36FED31696261FEBFDA3 ft=1 fh=29643e02259e76bc vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\toolbar_x64.dll"
sh=B27AA1F8303815E20CE148744957CB3726BCDE96 ft=1 fh=e7bb97c341e31fcc vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\UpdateManager.exe"
sh=6CDE6B1DD298CA47510EB79334AE149F60FEFFCE ft=1 fh=0241d1e8e3e9ed03 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\Passport.dll"
sh=84987AF48F5107F84A12BB7418C0A7A2106906B0 ft=1 fh=6e62188c597b6ea7 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\Passport_x64.dll"
sh=75A9BFE798ADFBFDFA8E0155A242E69ACD396E53 ft=1 fh=7e8b040c1a60dd55 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\VNT\vntldr.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=EA91A7B4AB2DE640BBDAE944E5F91E6C479DCDDF ft=1 fh=9996c0ea4bfd5a76 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Users\Fabian\Desktop\Zeugs\avira_free_antivirus_898de.exe"
sh=08376D0C898E47B740140D49853DAE3822B6E5F0 ft=1 fh=4c7017f406ee36b6 vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Fabian\Desktop\Zeugs\speedupmypc.exe"
sh=93DC3DA194499EAFDFCD2CA197433F9A087D85DA ft=1 fh=e7be675c23b99cab vn="Variante von Win32/AdInstaller evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Fabian\Downloads\zonealarm8en.exe"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HW35X6CY\ApnIC[1].0"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HW35X6CY\ApnIC[1].0"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.83  
 Windows Vista Service Pack 2 x64 (UAC is enabled)  
 Internet Explorer 7 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Spybot - Search & Destroy 
 Java(TM) 6 Update 21  
 Java(TM) 6 Update 20  
 Java 7 Update 10  
 Java version out of Date! 
  Adobe Flash Player 	11.8.800.94 Flash Player out of Date!  
 Adobe Reader 9 Adobe Reader out of Date! 
 Mozilla Firefox (30.0) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by Fabian (administrator) on FABIAN-PC on 24-06-2014 12:03:26
Running from C:\Users\Fabian\Desktop
Platform: Windows Vista (TM) Business Service Pack 2 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Realtek Semiconductor) C:\Windows\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\conime.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\winsxs\x86_microsoft-windows-notepad_31bf3856ad364e35_6.0.6001.18000_none_6f1a8d7b6fffbb73\notepad.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [5684736 2008-02-13] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-3131320665-4187305121-1053278066-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_94_Plugin.exe [814984 2013-08-13] (Adobe Systems Incorporated)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Tcpip\..\Interfaces\{6E7C7EF7-6D79-48A9-9890-6D1BF4383BFE}: [NameServer]192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default
FF DefaultSearchEngine: Startpage HTTPS - Deutsch
FF SelectedSearchEngine: Startpage HTTPS - Deutsch
FF Homepage: hxxp://www.spiegel.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.10.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=1.0.3.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=1.0.0.0 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.732 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprjplug.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF SearchPlugin: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\staged [2014-06-23]
FF Extension: YouTube Unblocker - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-22]
FF Extension: Ghostery - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\firefox@ghostery.com.xpi [2013-08-18]
FF Extension: Flagfox - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-03-10]
FF Extension: Image Zoom - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi [2013-04-17]
FF Extension: NoScript - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-01-02]
FF Extension: Adblock Plus - C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\4iaicnu2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-02]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-23]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
S4 iPod Service; C:\Program Files (x86)\iPod\bin\iPodService.exe [536872 2009-01-06] (Apple Inc.)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [271920 2007-05-16] (Nero AG)

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-07-23] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-03] (Avira Operations GmbH & Co. KG)
S1 Beep; No ImagePath
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-07-23] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-04-02] () [File not signed]
U3 apsctxgo; C:\Windows\System32\Drivers\apsctxgo.sys [0 ] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-24 12:03 - 2014-06-24 12:03 - 00000000 ____D () C:\Users\Fabian\Desktop\FRST-OlderVersion
2014-06-23 22:10 - 2014-06-23 22:10 - 00854367 _____ () C:\Users\Fabian\Desktop\SecurityCheck.exe
2014-06-23 20:21 - 2014-06-23 20:21 - 02347384 _____ (ESET) C:\Users\Fabian\Desktop\esetsmartinstaller_deu.exe
2014-06-22 20:46 - 2014-06-22 20:46 - 00001228 _____ () C:\Users\Fabian\Desktop\JRT.txt
2014-06-22 20:37 - 2014-06-22 20:37 - 01016261 _____ (Thisisu) C:\Users\Fabian\Desktop\JRT.exe
2014-06-22 20:37 - 2014-06-22 20:37 - 00000000 ____D () C:\Windows\ERUNT
2014-06-22 20:36 - 2014-06-22 20:36 - 00002234 _____ () C:\Users\Fabian\Desktop\AdwCleaner[S0].txt
2014-06-22 20:27 - 2014-06-22 20:29 - 00000000 ____D () C:\AdwCleaner
2014-06-22 20:25 - 2014-06-22 20:25 - 00001164 _____ () C:\mbam.txt
2014-06-22 20:02 - 2014-06-22 20:57 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 20:02 - 2014-06-22 20:02 - 00000941 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-22 20:02 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-22 20:02 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-22 20:02 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-22 20:00 - 2014-06-22 20:00 - 01333465 _____ () C:\Users\Fabian\Desktop\adwcleaner_3.212.exe
2014-06-22 19:59 - 2014-06-22 20:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Fabian\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-18 11:36 - 2014-06-18 11:36 - 00012894 _____ () C:\ComboFix.txt
2014-06-18 10:47 - 2014-06-18 11:36 - 00000000 ____D () C:\ComboFix
2014-06-18 10:47 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-18 10:47 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-18 10:47 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-18 10:47 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-18 10:32 - 2014-06-18 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-06-18 10:20 - 2014-06-18 11:36 - 00000000 ____D () C:\Qoobox
2014-06-18 10:20 - 2014-06-18 11:33 - 00000000 ____D () C:\Windows\erdnt
2014-06-17 19:24 - 2014-06-17 19:24 - 00000000 ____D () C:\Users\Fabian\AppData\Roaming\AVAST Software
2014-06-17 19:22 - 2014-06-24 12:02 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-17 19:22 - 2014-06-24 11:54 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-17 19:22 - 2014-06-18 10:28 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-17 19:22 - 2014-06-18 10:28 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-17 19:22 - 2014-06-17 19:22 - 00000000 ____D () C:\Users\Fabian\AppData\Local\Google
2014-06-17 19:22 - 2014-06-17 19:22 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-17 19:21 - 2014-06-17 19:21 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-17 19:19 - 2014-06-17 19:19 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-17 19:18 - 2014-06-17 19:19 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-17 17:23 - 2014-06-17 17:26 - 00027906 _____ () C:\Users\Fabian\Desktop\Addition.txt
2014-06-17 17:22 - 2014-06-24 12:03 - 00013253 _____ () C:\Users\Fabian\Desktop\FRST.txt
2014-06-17 12:00 - 2014-06-22 19:56 - 00017661 _____ () C:\Users\Fabian\Desktop\revosetup95.exe
2014-06-17 12:00 - 2014-06-17 12:00 - 00001099 _____ () C:\Users\Fabian\Desktop\Revo Uninstaller.lnk
2014-06-17 12:00 - 2014-06-17 12:00 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-17 08:45 - 2014-06-17 08:45 - 00060101 _____ () C:\Users\Fabian\Desktop\Shortcut.txt
2014-06-16 23:51 - 2014-06-24 12:03 - 00000000 ____D () C:\FRST
2014-06-16 23:50 - 2014-06-24 12:03 - 02082816 _____ (Farbar) C:\Users\Fabian\Desktop\FRST64.exe
2014-06-16 23:30 - 2014-06-16 23:35 - 94714880 _____ (AVAST Software) C:\Users\Fabian\Desktop\avast_free_antivirus_setup_21514.exe
2014-06-11 20:06 - 2014-06-11 20:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-11 19:14 - 2014-05-06 09:27 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 19:14 - 2014-05-06 09:26 - 01430528 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 19:14 - 2014-05-06 09:26 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 05736448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 01129984 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00763904 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 19:14 - 2014-05-06 09:24 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 07051776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00377856 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-06-11 19:14 - 2014-05-06 09:23 - 00224768 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 19:14 - 2014-05-06 09:22 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-06-11 19:14 - 2014-05-06 07:51 - 00485376 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-06-11 19:14 - 2014-05-06 07:13 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 19:14 - 2014-05-06 06:46 - 03630592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 01177600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00834048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00671744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 19:14 - 2014-05-06 06:46 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 06119424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00380928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00271872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00193024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00180736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 19:14 - 2014-05-06 06:45 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll
2014-06-11 19:14 - 2014-05-06 05:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-06-11 19:14 - 2014-05-06 05:07 - 01383424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 19:14 - 2014-04-26 20:21 - 00622592 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 19:14 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-11 19:14 - 2014-04-05 11:10 - 01422784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 19:14 - 2014-03-10 08:26 - 01869824 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 19:14 - 2014-03-10 08:26 - 01794560 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 19:14 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-11 19:14 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-06-24 12:03 - 2014-06-24 12:03 - 00000000 ____D () C:\Users\Fabian\Desktop\FRST-OlderVersion
2014-06-24 12:03 - 2014-06-17 17:22 - 00013253 _____ () C:\Users\Fabian\Desktop\FRST.txt
2014-06-24 12:03 - 2014-06-16 23:51 - 00000000 ____D () C:\FRST
2014-06-24 12:03 - 2014-06-16 23:50 - 02082816 _____ (Farbar) C:\Users\Fabian\Desktop\FRST64.exe
2014-06-24 12:02 - 2014-06-17 19:22 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-24 11:54 - 2014-06-17 19:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-24 11:54 - 2006-11-02 17:25 - 01571918 _____ () C:\Windows\WindowsUpdate.log
2014-06-24 11:53 - 2013-08-29 20:45 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-24 11:53 - 2012-04-01 12:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-23 23:58 - 2006-11-02 17:20 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-23 23:58 - 2006-11-02 17:20 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-23 22:10 - 2014-06-23 22:10 - 00854367 _____ () C:\Users\Fabian\Desktop\SecurityCheck.exe
2014-06-23 20:21 - 2014-06-23 20:21 - 02347384 _____ (ESET) C:\Users\Fabian\Desktop\esetsmartinstaller_deu.exe
2014-06-23 20:20 - 2006-11-02 21:23 - 00689180 _____ () C:\Windows\system32\perfh007.dat
2014-06-23 20:20 - 2006-11-02 21:23 - 00150570 _____ () C:\Windows\system32\perfc007.dat
2014-06-23 20:20 - 2006-11-02 14:46 - 01596714 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-23 19:58 - 2006-11-02 17:38 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-23 06:33 - 2006-11-02 17:38 - 00032510 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-22 20:57 - 2014-06-22 20:02 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 20:46 - 2014-06-22 20:46 - 00001228 _____ () C:\Users\Fabian\Desktop\JRT.txt
2014-06-22 20:37 - 2014-06-22 20:37 - 01016261 _____ (Thisisu) C:\Users\Fabian\Desktop\JRT.exe
2014-06-22 20:37 - 2014-06-22 20:37 - 00000000 ____D () C:\Windows\ERUNT
2014-06-22 20:36 - 2014-06-22 20:36 - 00002234 _____ () C:\Users\Fabian\Desktop\AdwCleaner[S0].txt
2014-06-22 20:31 - 2008-10-01 19:18 - 00285270 _____ () C:\Windows\PFRO.log
2014-06-22 20:29 - 2014-06-22 20:27 - 00000000 ____D () C:\AdwCleaner
2014-06-22 20:25 - 2014-06-22 20:25 - 00001164 _____ () C:\mbam.txt
2014-06-22 20:02 - 2014-06-22 20:02 - 00000941 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-22 20:00 - 2014-06-22 20:00 - 01333465 _____ () C:\Users\Fabian\Desktop\adwcleaner_3.212.exe
2014-06-22 20:00 - 2014-06-22 19:59 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Fabian\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-22 19:56 - 2014-06-17 12:00 - 00017661 _____ () C:\Users\Fabian\Desktop\revosetup95.exe
2014-06-18 11:36 - 2014-06-18 11:36 - 00012894 _____ () C:\ComboFix.txt
2014-06-18 11:36 - 2014-06-18 10:47 - 00000000 ____D () C:\ComboFix
2014-06-18 11:36 - 2014-06-18 10:20 - 00000000 ____D () C:\Qoobox
2014-06-18 11:36 - 2006-11-02 15:33 - 00000000 __RHD () C:\Users\Default
2014-06-18 11:33 - 2014-06-18 10:20 - 00000000 ____D () C:\Windows\erdnt
2014-06-18 11:32 - 2006-11-02 14:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-18 10:32 - 2014-06-18 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-06-18 10:32 - 2013-08-29 20:45 - 00001901 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-06-18 10:32 - 2013-08-29 20:44 - 00000000 ____D () C:\ProgramData\Avira
2014-06-18 10:28 - 2014-06-17 19:22 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-18 10:28 - 2014-06-17 19:22 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-17 19:24 - 2014-06-17 19:24 - 00000000 ____D () C:\Users\Fabian\AppData\Roaming\AVAST Software
2014-06-17 19:22 - 2014-06-17 19:22 - 00000000 ____D () C:\Users\Fabian\AppData\Local\Google
2014-06-17 19:22 - 2014-06-17 19:22 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-17 19:21 - 2014-06-17 19:21 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-17 19:20 - 2006-11-02 17:05 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-06-17 19:19 - 2014-06-17 19:19 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-17 19:19 - 2014-06-17 19:18 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-17 17:26 - 2014-06-17 17:23 - 00027906 _____ () C:\Users\Fabian\Desktop\Addition.txt
2014-06-17 17:25 - 2008-11-30 12:19 - 00029696 _____ () C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-06-17 17:21 - 2008-10-01 23:35 - 00000000 ____D () C:\Users\Fabian\Desktop\Zeugs
2014-06-17 12:00 - 2014-06-17 12:00 - 00001099 _____ () C:\Users\Fabian\Desktop\Revo Uninstaller.lnk
2014-06-17 12:00 - 2014-06-17 12:00 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-17 08:45 - 2014-06-17 08:45 - 00060101 _____ () C:\Users\Fabian\Desktop\Shortcut.txt
2014-06-17 00:03 - 2008-10-02 23:33 - 00000000 ____D () C:\Program Files (x86)\Warcraft III
2014-06-17 00:02 - 2009-02-18 17:18 - 00000000 ____D () C:\Program Files (x86)\Miranda IM
2014-06-17 00:01 - 2008-10-01 19:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-17 00:00 - 2009-09-19 12:24 - 00000000 ____D () C:\ProgramData\Skype
2014-06-16 23:56 - 2012-04-23 17:07 - 00000000 ____D () C:\Program Files (x86)\Citrix
2014-06-16 23:35 - 2014-06-16 23:30 - 94714880 _____ (AVAST Software) C:\Users\Fabian\Desktop\avast_free_antivirus_setup_21514.exe
2014-06-12 21:38 - 2012-04-27 09:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-12 08:59 - 2013-08-16 19:05 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 08:58 - 2006-11-02 14:35 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-06-11 20:07 - 2014-06-11 20:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-04 11:44 - 2013-08-29 20:45 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-28 21:03 - 2009-09-08 20:27 - 00000000 ____D () C:\Users\Fabian\Documents\Textdateien

Some content of TEMP:
====================
C:\Users\Fabian\AppData\Local\Temp\avgnt.exe
C:\Users\Fabian\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-23 20:05

==================== End Of Log ============================

--- --- ---

schrauber · 24.06.2014, 17:42

Java, Flash, Adobe und Windows updaten.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Dunt · 25.06.2014, 17:32

Vielen Dank für die Hilfe!
Einige kleinere Probleme habe ich leider noch.

1. Combofix kann ich nicht deinstallieren, weil es da nur einen leeren Ordner mit dem Namen Combofix gibt. Weder mit Methode 1 noch 2 lässt sich was anderes finden. Ich kann mich aber auch nicht entsinnen, das selbst deinstalliert zu haben. Wenn das nichts ausmacht, okay, wollte es aber doch erwähnen. Dementsprechend habe ich Delfix noch nicht installiert.

2. Bei mir taucht rechts unten "Windows-Sicherheitshinweise" auf. Wenn ich draufklicke, kommt "Schutz vor schädlicher Software: aus". Es meldet, dass Antivir aus ist. Das habe ich für Combofix wie empfohlen ausgeschaltet, anschließend aber aktiviert. Antivir selbst gibt auch an, zu laufen. Ich kann es vom Sicherheitshinweis aus aktivieren, aber dennoch meldet es weiterhin aus.

Sonst scheint aber alles wieder wie gewohnt zu funktionieren.

schrauber · 26.06.2014, 15:11

einfach delfix laufen lassen, Avira neu installieren.

Dunt · 28.06.2014, 21:38

Vielen Dank für die schnelle Hilfe!

Jetzt funktioniert alles wie gewohnt.

17.06.2014, 07:41	#2
schrauber /// the machine /// TB-Ausbilder	Telekom-Trojaner geöffnet hi, FRST.txt fehlt noch. __________________ __________________

18.06.2014, 09:03	#6
schrauber /// the machine /// TB-Ausbilder	Telekom-Trojaner geöffnet Einfach Combofix wie oben beschrieben laufen lassen. __________________ --> Telekom-Trojaner geöffnet

26.06.2014, 15:11	#14
schrauber /// the machine /// TB-Ausbilder	Telekom-Trojaner geöffnet einfach delfix laufen lassen, Avira neu installieren. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Telekom-Trojaner geöffnet

Plagegeister aller Art und deren Bekämpfung: Telekom-Trojaner geöffnet