Win7/32bit - USB Stick und SD Karte beinhalten Verknüpfungen

desmond · 22.06.2014, 22:12

Hallo,
bin leider gestern draufgekommen, dass 2 USB Sticks und 2 SD Karten nur mehr Verknüpfungen der Dateien anzeigen. 1 USB wurde vernichtet (nur 256MB-Steinzeitteil) Benutze die anderen Datenträger derzeit an meinem Netbook (Asus EEE).
An meinem Standrechner musste ich dasselbe Problem feststellen - wurde heute formatiert (mit nullen überschrieben) und die Daten auf eine Netzwerkfestplatte (MYBOOKLIVE) und zweite interne Festplatte gesichert. Um sicherzugehen, dass die Standrechnerkonfiguration save ist, werde ich einen eigenen thread mit den Logfiles öffnen.

Habe nun am Netbook einen infizierten USB Stick und zwei SD Karten dran.
Das Netbook werde ich im Anschluss neu formatieren - mir gehts derzeit primär um die beiden SD Karten.

Für Eure Hilfe bin ich euch sehr dankbar!

mfg
desmond

defogger_disable.txt

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:24 on 22/06/2014 (*****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-06-2014 01
Ran by ***** (administrator) on ASUSEEE1008HA on 22-06-2014 22:29:24
Running from C:\Users\*****\Desktop
Platform: Microsoft Windows 7 Starter  (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Windows\System32\AsusService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(IBM) C:\Program Files\IBM\Lotus\Notes\nsd.exe
(IBM Corp) C:\Program Files\IBM\Lotus\Notes\ntmulti.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Western Digital) C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe
(Western Digital ) C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Western Digital ) C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [HotkeyService] => C:\Program Files\EeePC\HotkeyService\HotkeyService.exe [750008 2009-09-12] (ASUSTeK Computer Inc.)
HKLM\...\Run: [HotKeyMon] => C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe [100328 2009-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [SuperHybridEngine] => C:\Program Files\EeePC\SHE\SuperHybridEngine.exe [407552 2009-09-01] (ASUSTeK Computer Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7707168 2009-08-17] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe [5237256 2012-12-20] (Western Digital Technologies, Inc.)
HKLM\...\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-346033274-3003123960-3589610832-1000\...\Run: [mmrrqkqpas] => wscript.exe //B "C:\Users\*****\AppData\Local\Temp\mmrrqkqpas.vbs" <===== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mmrrqkqpas.vbs ()
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com
BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Aibelive\Voice Command\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\q04getu6.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-22] (Avira Operations GmbH & Co. KG)
R2 AsusService; C:\Windows\System32\AsusService.exe [219136 2009-08-19] () [File not signed]
R2 Lotus Notes Diagnostics; C:\Program Files\IBM\Lotus\Notes\nsd.exe [3417480 2010-08-11] (IBM)
R2 Multi-user Cleanup Service; C:\Program Files\IBM\Lotus\Notes\ntmulti.exe [58760 2010-08-11] (IBM Corp)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1155088 2012-12-20] (Western Digital )
R2 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [248840 2012-12-20] (Western Digital)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2014-06-22] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\windows\System32\DRIVERS\kbfiltr.sys [13880 2009-07-20] ( )
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
U3 fwdorfob; \??\C:\Users\*****\AppData\Local\Temp\fwdorfob.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-22 22:25 - 2014-06-22 22:29 - 00010076 _____ () C:\Users\*****\Desktop\FRST.txt
2014-06-22 22:24 - 2014-06-22 22:25 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-06-22 22:18 - 2014-06-22 22:18 - 00000682 _____ () C:\Users\*****\Desktop\text.txt
2014-06-22 21:29 - 2014-06-22 22:29 - 00000000 ____D () C:\FRST
2014-06-22 21:28 - 2014-06-22 21:28 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-06-22 21:26 - 2014-06-22 21:26 - 01070592 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2014-06-22 21:26 - 2014-06-22 21:26 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe
2014-06-22 21:25 - 2014-06-22 21:25 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2014-06-22 20:04 - 2014-06-22 20:25 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-22 20:02 - 2014-06-22 20:25 - 00000000 ____D () C:\Users\*****\Desktop\mbar
2014-06-22 20:01 - 2014-06-22 20:01 - 14349744 _____ (Malwarebytes Corp.) C:\Users\*****\Downloads\mbar-1.07.0.1012.exe
2014-06-22 19:24 - 2014-06-22 20:04 - 00113880 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 19:24 - 2014-06-22 20:02 - 00075480 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-22 19:24 - 2014-06-22 19:24 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-22 19:24 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-22 19:24 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-22 19:21 - 2014-06-22 19:21 - 00002131 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-22 19:21 - 2014-06-22 19:21 - 00002119 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-22 19:21 - 2014-06-22 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-22 19:20 - 2014-06-22 19:55 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2014-06-22 19:20 - 2014-06-22 19:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 19:20 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\windows\system32\sdnclean.exe
2014-06-22 19:19 - 2014-06-22 21:27 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DropboxMaster
2014-06-22 19:16 - 2014-06-22 19:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\*****\Downloads\spybot-2.3.exe
2014-06-22 19:14 - 2014-06-22 19:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-21 18:40 - 2014-06-21 18:40 - 00000000 ____D () C:\Users\*****\AppData\Local\CutePDF Writer
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\Program Files\GPLGS
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\Program Files\Acro Software
2014-06-21 14:40 - 2012-10-04 19:50 - 00088688 _____ () C:\windows\system32\cpwmon2k.dll
2014-06-21 14:39 - 2014-06-21 14:39 - 01955184 _____ (Acro Software Inc. ) C:\Users\*****\Downloads\CuteWriter.exe

==================== One Month Modified Files and Folders =======

2014-06-22 22:29 - 2014-06-22 22:25 - 00010076 _____ () C:\Users\*****\Desktop\FRST.txt
2014-06-22 22:29 - 2014-06-22 21:29 - 00000000 ____D () C:\FRST
2014-06-22 22:25 - 2014-06-22 22:24 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-06-22 22:24 - 2009-07-25 09:50 - 01611160 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-22 22:19 - 2013-02-16 18:21 - 00323239 _____ () C:\windows\WindowsUpdate.log
2014-06-22 22:18 - 2014-06-22 22:18 - 00000682 _____ () C:\Users\*****\Desktop\text.txt
2014-06-22 22:07 - 2013-02-22 16:44 - 00000000 ___RD () C:\Users\*****\Dropbox
2014-06-22 22:07 - 2013-02-22 16:40 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-06-22 21:31 - 2009-07-14 06:34 - 00009696 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-22 21:31 - 2009-07-14 06:34 - 00009696 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-22 21:28 - 2014-06-22 21:28 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-06-22 21:28 - 2013-02-16 18:19 - 00000000 ____D () C:\Users\*****
2014-06-22 21:27 - 2014-06-22 19:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DropboxMaster
2014-06-22 21:26 - 2014-06-22 21:26 - 01070592 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2014-06-22 21:26 - 2014-06-22 21:26 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe
2014-06-22 21:25 - 2014-06-22 21:25 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2014-06-22 21:21 - 2009-07-14 06:39 - 00062684 _____ () C:\windows\setupact.log
2014-06-22 21:20 - 2013-02-22 17:26 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-06-22 21:20 - 2013-02-22 17:26 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-06-22 21:10 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-22 20:25 - 2014-06-22 20:04 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-22 20:25 - 2014-06-22 20:02 - 00000000 ____D () C:\Users\*****\Desktop\mbar
2014-06-22 20:04 - 2014-06-22 19:24 - 00113880 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 20:02 - 2014-06-22 19:24 - 00075480 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-22 20:01 - 2014-06-22 20:01 - 14349744 _____ (Malwarebytes Corp.) C:\Users\*****\Downloads\mbar-1.07.0.1012.exe
2014-06-22 19:55 - 2014-06-22 19:20 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2014-06-22 19:51 - 2013-03-01 16:21 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-06-22 19:51 - 2013-03-01 16:21 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-22 19:38 - 2013-05-11 08:14 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2014-06-22 19:38 - 2013-02-20 23:13 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-06-22 19:38 - 2013-02-20 23:13 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-06-22 19:38 - 2013-02-20 23:13 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2014-06-22 19:24 - 2014-06-22 19:24 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-22 19:21 - 2014-06-22 19:21 - 00002131 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-22 19:21 - 2014-06-22 19:21 - 00002119 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-22 19:21 - 2014-06-22 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-22 19:21 - 2014-06-22 19:20 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 19:18 - 2013-02-22 16:41 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-06-22 19:16 - 2014-06-22 19:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\*****\Downloads\spybot-2.3.exe
2014-06-22 19:15 - 2014-06-22 19:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-21 18:40 - 2014-06-21 18:40 - 00000000 ____D () C:\Users\*****\AppData\Local\CutePDF Writer
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\Program Files\GPLGS
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\Program Files\Acro Software
2014-06-21 14:39 - 2014-06-21 14:39 - 01955184 _____ (Acro Software Inc. ) C:\Users\*****\Downloads\CuteWriter.exe

Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\AskSLib.dll
C:\Users\*****\AppData\Local\Temp\atl80.dll
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\converter.exe
C:\Users\*****\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptbhpgx.dll
C:\Users\*****\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\*****\AppData\Local\Temp\install_reader11_de_mssd_aih.exe
C:\Users\*****\AppData\Local\Temp\mfc80.dll
C:\Users\*****\AppData\Local\Temp\mfc80u.dll
C:\Users\*****\AppData\Local\Temp\mfcm80.dll
C:\Users\*****\AppData\Local\Temp\mfcm80u.dll
C:\Users\*****\AppData\Local\Temp\msvcm80.dll
C:\Users\*****\AppData\Local\Temp\msvcp80.dll
C:\Users\*****\AppData\Local\Temp\msvcr80.dll
C:\Users\*****\AppData\Local\Temp\TmDbg32.dll


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-21 16:10

==================== End Of Log ============================

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:21-06-2014 01
Ran by ***** at 2014-06-22 22:30:29
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
ASUS VIBE (HKLM\...\ASUS VIBE) (Version: 1.0.166 - Ecareme, Inc.)
ASUSUpdate for Eee PC (HKLM\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version:  - )
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
Chicken Invaders 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Choice Guard (Version: 1.2.87.0 - Microsoft Corporation) Hidden
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version:  3.0 - CutePDF.com)
Dr.Eee (HKCU\...\InstallShield_{946135EF-3A4C-494F-AE05-1312913DF880}) (Version: 4.0.0.1 - Ihr Firmenname)
Dr.Eee (Version: 4.0.0.1 - Ihr Firmenname) Hidden
Dream Day Wedding Married in Manhattan (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115233673}) (Version:  - Oberon Media)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
E-Cam (HKLM\...\{185AFA7A-F63E-450B-94AA-011CAC18090E}) (Version: 2.0.1.1 - )
EeeSplendid (HKLM\...\{6333FC29-BFE5-4024-AC78-958A1A7555D1}) (Version: 5.1.2.0004 - ASUS)
FontResizer (HKLM\...\{C04E7C11-A3DA-480B-9018-F292E04CA26A}) (Version: 1.01.0005 - ASUS)
GamePark Console (HKLM\...\{A736ED15-FE0B-462F-9EF2-E021F622D232}_is1) (Version: 5.2.1.1 - Oberon Media, Inc.)
Hotkey Service (HKLM\...\{71C0E38E-09F2-4386-9977-404D4F6640CD}) (Version: 1.11 - AsusTek Computer)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1867 - Intel Corporation)
Junk Mail filter update (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
LocaleMe (HKLM\...\{2E741D13-BD2A-45EB-8342-7127233E5DAC}) (Version: 1.0.0813 - ASUS)
Lotus Notes 8.5.2 (Basic) de (HKLM\...\{19432717-EE30-4DD0-87F8-73FCADB088F7}) (Version: 8.52.10247 - IBM)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2007 - Dutch/Nederlands (HKLM\...\OMUI.nl-nl) (Version: 12.0.4518.1017 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - French/Français (HKLM\...\OMUI.fr-fr) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM\...\OMUI.de-de) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - Italian/Italiano (HKLM\...\OMUI.it-it) (Version: 12.0.4518.1018 - Microsoft Corporation)
Microsoft Office Live Add-in 1.3 (HKLM\...\{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}) (Version: 2.0.2313.0 - Microsoft Corporation)
Microsoft Office O MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office O MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office O MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office O MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Proof (Arabic) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Dutch) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Office X MUI (Dutch) 2007 (Version: 12.0.4518.1017 - Microsoft Corporation) Hidden
Microsoft Office X MUI (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office X MUI (Italian) 2007 (Version: 12.0.4518.1018 - Microsoft Corporation) Hidden
Microsoft Search Enhancement Pack (Version: 1.2.123.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 21.0 (x86 de) (HKLM\...\Mozilla Firefox 21.0 (x86 de)) (Version: 21.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 21.0 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
OpenOffice.org 3.4.1 (HKLM\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Piggly (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116864777}) (Version:  - Oberon Media)
Ralink RT2860 Wireless LAN Card (HKLM\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.1 - Ralink)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5918 - Realtek Semiconductor Corp.)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3810 - Skype Technologies S.A.)
Skype™ 4.1 (HKLM\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version: 4.1.141 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
Super Hybrid Engine (HKLM\...\{88F08F98-12BC-4613-81A2-8F9B88CFC73E}) (Version: 2.07 - AsusTek Computer)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.6.1 - Synaptics Incorporated)
WD SmartWare (HKLM\...\{A695180C-C8E4-48E8-BC11-02BCAD4D9B99}) (Version: 1.6.5.2 - Western Digital Technologies, Inc.)
WIDCOMM Bluetooth Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.0.9600 - Broadcom Corporation)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8064.0206 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{ED636101-1959-4360-8BF7-209436E7DEE4}) (Version: 14.0.8064.206 - Microsoft Corporation)
Windows Live Toolbar (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points  =========================

16-03-2013 08:33:30 Installed WD Software Upgrader
23-03-2013 10:26:41 Geplanter Prüfpunkt
26-04-2013 15:18:54 Geplanter Prüfpunkt
11-05-2013 11:10:25 Geplanter Prüfpunkt
20-05-2013 09:54:20 Geplanter Prüfpunkt
14-12-2013 14:18:39 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {92E2536F-32C8-40C0-925F-214D02BB85A4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {93C715C5-E428-4816-AE38-AD77EDC3EA12} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {BDD60F3A-A898-43C1-B11F-74C04A669A6C} - System32\Tasks\{3DBD6538-49EB-44B5-8C17-2BEBE7B1F4D0} => C:\Users\*****\Desktop\Lotus Notes\Lotus_notes852_basic_Win_de.exe
Task: {F5C99EF4-91DC-4BED-A1D7-C61C4FA76053} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files\Spybot - Search &amp; Destroy 2\SDUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-06-21 14:40 - 2012-10-04 19:50 - 00088688 _____ () C:\windows\System32\cpwmon2k.dll
2009-09-14 22:52 - 2009-08-19 02:35 - 00219136 _____ () C:\Windows\System32\AsusService.exe
2014-06-22 19:20 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-06-22 19:20 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2014-06-22 19:20 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-06-22 19:20 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
2014-06-22 19:20 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2009-07-02 03:03 - 2009-07-02 03:03 - 00132384 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: E:\
Description: Flash Reader    
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Single  
Service: WUDFRd
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: F:\
Description: Flash Disk      
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: USB     
Service: WUDFRd
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: G:\
Description: Storage Device  
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Generic 
Service: WUDFRd
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (06/22/2014 10:08:22 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SDWelcome.exe, Version 2.3.39.130 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1564

Startzeit: 01cf8e5535e159fd

Endzeit: 31

Anwendungspfad: C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe

Berichts-ID: f3f968d7-fa48-11e3-b270-0025d3a01f23

Error: (06/21/2014 04:12:35 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (12/14/2013 04:22:12 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (12/14/2013 04:17:19 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/14/2013 01:25:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 21.0.0.4879, Zeitstempel: 0x518ec3cc
Name des fehlerhaften Moduls: xul.dll, Version: 21.0.0.4879, Zeitstempel: 0x518ec306
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001c9789
ID des fehlerhaften Prozesses: 0xce8
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3

Error: (06/07/2013 08:52:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 21.0.0.4879, Zeitstempel: 0x518ec3cc
Name des fehlerhaften Moduls: xul.dll, Version: 21.0.0.4879, Zeitstempel: 0x518ec306
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001c9789
ID des fehlerhaften Prozesses: 0xca0
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3

Error: (05/31/2013 09:04:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 21.0.0.4879, Zeitstempel: 0x518ec3cc
Name des fehlerhaften Moduls: xul.dll, Version: 21.0.0.4879, Zeitstempel: 0x518ec306
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001c9789
ID des fehlerhaften Prozesses: 0x1238
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3

Error: (05/20/2013 11:57:19 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (05/20/2013 11:51:51 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (05/11/2013 01:13:10 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.


System errors:
=============
Error: (07/25/2013 09:04:45 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.

Error: (07/21/2013 07:32:14 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst WDBackup erreicht.

Error: (06/07/2013 04:31:00 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (06/07/2013 04:31:00 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (06/07/2013 04:31:00 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (06/07/2013 02:39:27 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}

Error: (06/07/2013 02:39:23 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst WDBackup erreicht.

Error: (05/31/2013 07:27:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WD Backup" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (05/31/2013 07:27:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst WD Backup erreicht.

Error: (05/31/2013 04:53:14 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Superfetch" wurde mit folgendem Fehler beendet: 
%%13


Microsoft Office Sessions:
=========================
Error: (06/22/2014 10:08:22 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: SDWelcome.exe2.3.39.130156401cf8e5535e159fd31C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exef3f968d7-fa48-11e3-b270-0025d3a01f23

Error: (06/21/2014 04:12:35 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (12/14/2013 04:22:12 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dllc:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll2

Error: (12/14/2013 04:17:19 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/14/2013 01:25:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: firefox.exe21.0.0.4879518ec3ccxul.dll21.0.0.4879518ec306c0000005001c9789ce801ce68e3d4aee9d9C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll172a8a27-d4e5-11e2-8209-0025d3a01f23

Error: (06/07/2013 08:52:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: firefox.exe21.0.0.4879518ec3ccxul.dll21.0.0.4879518ec306c0000005001c9789ca001ce638b82f7bc46C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll6882272c-cfa3-11e2-a59f-0025d3a01f23

Error: (05/31/2013 09:04:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: firefox.exe21.0.0.4879518ec3ccxul.dll21.0.0.4879518ec306c0000005001c9789123801ce5e28e2608c92C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dlle0a95eac-ca24-11e2-8224-0025d3a01f23

Error: (05/20/2013 11:57:19 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dllc:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll2

Error: (05/20/2013 11:51:51 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (05/11/2013 01:13:10 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dllc:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll2


==================== Memory info =========================== 

Percentage of memory in use: 62%
Total physical RAM: 1015.24 MB
Available physical RAM: 384.77 MB
Total Pagefile: 2039.24 MB
Available Pagefile: 987.47 MB
Total Virtual: 2047.88 MB
Available Virtual: 1910.78 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:100 GB) (Free:75.07 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:122.87 GB) (Free:122.74 GB) NTFS
Drive e: (D5100_16) (Removable) (Total:14.83 GB) (Free:14.83 GB) FAT32
Drive f: (USB_FW) (Removable) (Total:1.84 GB) (Free:1.84 GB) FAT
Drive g: (D5100_32) (Removable) (Total:29.71 GB) (Free:29.71 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: A6FA7A92)
Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=123 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=1B)
Partition 4: (Not Active) - (Size=16 MB) - (Type=EF)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 2 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 3 (Size: 30 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

Gmer.txt

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-22 22:55:36
Windows 6.1.7600  \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST925031 rev.0002 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\fwdorfob.sys


---- System - GMER 2.1 ----

SSDT            8A1F113E                                                                                         ZwCreateSection
SSDT            8A1F1148                                                                                         ZwRequestWaitReplyPort
SSDT            8A1F1143                                                                                         ZwSetContextThread
SSDT            8A1F114D                                                                                         ZwSetSecurityObject
SSDT            8A1F1152                                                                                         ZwSystemDebugControl
SSDT            8A1F10DF                                                                                         ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                  81C7C579 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                           81CA0F52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!RtlSidHashLookup + 340                                                              81CA8840 4 Bytes  [3E, 11, 1F, 8A]
.text           ntkrnlpa.exe!RtlSidHashLookup + 69C                                                              81CA8B9C 4 Bytes  [48, 11, 1F, 8A]
.text           ntkrnlpa.exe!RtlSidHashLookup + 6E0                                                              81CA8BE0 4 Bytes  [43, 11, 1F, 8A]
.text           ntkrnlpa.exe!RtlSidHashLookup + 75C                                                              81CA8C5C 4 Bytes  [4D, 11, 1F, 8A]
.text           ntkrnlpa.exe!RtlSidHashLookup + 7B0                                                              81CA8CB0 4 Bytes  [52, 11, 1F, 8A]
.text           ...                                                                                              

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys

Device          \Driver\BTHUSB \Device\00000077                                                                  bthport.sys
Device          \Driver\BTHUSB \Device\00000079                                                                  bthport.sys

AttachedDevice  \FileSystem\fastfat \Fat                                                                         fltmgr.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                         fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002243f8f4ce                      
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3a01f23                      
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3a01f23@000761ecbeb3         0xD7 0x54 0x1D 0x57 ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002243f8f4ce (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3a01f23 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3a01f23@000761ecbeb3             0xD7 0x54 0x1D 0x57 ...

---- EOF - GMER 2.1 ----

schrauber · 23.06.2014, 06:14

hi,

Stick anklemmen, nicht mehr abklemmen.

Panda USB Vaccine - Download - Filepony
Das laufen lassen zum Absichern des Sticks.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

desmond · 23.06.2014, 16:30

hi, danke für die schnelle hilfe!

anbei die combofix (leider hab ich das logfile erst beim zweiten durchlauf speichern können)

Code:

ATTFilter

ComboFix 14-06-21.02 - ***** 23.06.2014  16:16:35.2.2 - x86
Microsoft Windows 7 Starter   6.1.7600.0.1252.43.1031.18.1015.510 [GMT 2:00]
ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-23 bis 2014-06-23  ))))))))))))))))))))))))))))))
.
.
2014-06-23 15:04 . 2014-06-23 15:04	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-06-23 06:32 . 2014-06-23 06:32	--------	d-----w-	c:\programdata\Panda Security
2014-06-23 06:32 . 2014-06-23 06:32	--------	d-----w-	c:\program files\Panda USB Vaccine
2014-06-22 20:22 . 2013-11-03 14:06	96879	--sha-w-	c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mmrrqkqpas.vbs
2014-06-22 19:29 . 2014-06-22 20:31	--------	d-----w-	C:\FRST
2014-06-22 18:04 . 2014-06-22 18:25	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-06-22 17:24 . 2014-06-22 18:04	113880	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-22 17:24 . 2014-06-22 18:02	75480	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-06-22 17:24 . 2014-06-22 17:24	--------	d-----w-	c:\program files\ Malwarebytes Anti-Malware 
2014-06-22 17:24 . 2014-06-22 17:24	--------	d-----w-	c:\programdata\Malwarebytes
2014-06-22 17:24 . 2014-05-12 05:26	51928	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-06-22 17:24 . 2014-05-12 05:25	23256	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-06-22 17:20 . 2013-09-20 08:49	18968	----a-w-	c:\windows\system32\sdnclean.exe
2014-06-22 17:20 . 2014-06-23 06:42	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2014-06-22 17:20 . 2014-06-22 17:55	--------	d-----w-	c:\program files\Spybot - Search & Destroy 2
2014-06-22 17:19 . 2014-06-22 17:19	--------	d-----w-	c:\users\*****\AppData\Local\Programs
2014-06-22 17:19 . 2014-06-22 19:27	--------	d-----w-	c:\users\*****\AppData\Roaming\DropboxMaster
2014-06-21 16:40 . 2014-06-21 16:40	--------	d-----w-	c:\users\*****\AppData\Local\CutePDF Writer
2014-06-21 12:40 . 2014-06-21 12:40	--------	d-----w-	c:\program files\GPLGS
2014-06-21 12:40 . 2012-10-04 17:50	88688	----a-w-	c:\windows\system32\cpwmon2k.dll
2014-06-21 12:40 . 2014-06-21 12:40	--------	d-----w-	c:\program files\Acro Software
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-22 17:51 . 2013-03-01 14:21	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-22 17:51 . 2013-03-01 14:21	699056	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-06-22 17:38 . 2013-05-11 06:14	69240	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-06-22 17:38 . 2013-02-20 21:13	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2014-06-22 17:38 . 2013-02-20 21:13	136216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-06-22 17:38 . 2013-02-20 21:13	93528	----a-w-	c:\windows\system32\drivers\avgntflt.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-20 1545512]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-07-20 83240]
"HotkeyService"="AsusSender.exe" [2009-09-11 33768]
"HotKeyMon"="AsusSender.exe" [2009-09-11 33768]
"SuperHybridEngine"="AsusSender.exe" [2009-09-11 33768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-14 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-14 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-14 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-17 7707168]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-06-22 737872]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"WD Quick View"="c:\program files\Western Digital\WD Quick View\WDDMStatus.exe" [2012-12-20 5237256]
"SDTray"="c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2014-04-25 4101584]
.
c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
mmrrqkqpas.vbs [2013-11-3 96879]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-2 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean.exe
.
R2 AsusService;Asus Launcher Service;c:\windows\System32\AsusService.exe [2009-08-19 219136]
R2 WDBackup;WD Backup;c:\program files\Western Digital\WD SmartWare\WDBackupEngine.exe [2012-12-20 1155088]
R3 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-04-25 1738200]
R3 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-04-25 2081752]
R3 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-04-25 171928]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-06-22 37352]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-06-22 430160]
S2 Lotus Notes Diagnostics;Lotus Notes-Diagnose;c:\program files\IBM\Lotus\Notes\nsd.exe [2010-08-11 3417480]
S2 WDDriveService;WD Drive Manager;c:\program files\Western Digital\WD Drive Manager\WDDriveService.exe [2012-12-20 248840]
S2 WDRulesService;WD Rules;c:\program files\Western Digital\WD SmartWare\WDRulesEngine.exe [2012-12-20 1178128]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-27 51712]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\q04getu6.default\
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(4964)
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
.
Zeit der Fertigstellung: 2014-06-23  17:07:25
ComboFix-quarantined-files.txt  2014-06-23 15:07
ComboFix2.txt  2014-06-23 07:37
.
Vor Suchlauf: 11 Verzeichnis(se), 82.785.042.432 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 82.748.694.528 Bytes frei
.
- - End Of File - - 9EC323AF177CC289910F666DA7B4F7BB
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 23.06.2014, 19:55

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

desmond · 23.06.2014, 22:52

hallo schrauber,

malwarebytes

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 23.06.2014
Suchlauf-Zeit: 21:21:59
Logdatei: malwarebytes.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.23.12
Rootkit Datenbank: v2014.06.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7
CPU: x86
Dateisystem: NTFS
Benutzer: *****

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 258362
Verstrichene Zeit: 23 Min, 11 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

adwcleaner:

Code:

ATTFilter

# AdwCleaner v3.213 - Bericht erstellt am 23/06/2014 um 23:02:00
# Aktualisiert 23/06/2014 von Xplode
# Betriebssystem : Windows 7 Starter  (32 bits)
# Benutzername : ***** - ASUSEEE1008HA
# Gestartet von : C:\Users\*****\Desktop\adwcleaner_3.213.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.Localizer
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.Localizer.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{937936AF-28CA-4973-B8AE-F250406149A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v8.0.7600.16385


-\\ Mozilla Firefox v21.0 (de)

[ Datei : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\q04getu6.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [2383 octets] - [23/06/2014 22:39:13]
AdwCleaner[S0].txt - [2308 octets] - [23/06/2014 23:02:00]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2368 octets] ##########

Junkware removal tool:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Starter x86
Ran by ***** on 23.06.2014 at 23:07:46,43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\*****\AppData\Roaming\mozilla\firefox\profiles\q04getu6.default\minidumps [21 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.06.2014 at 23:13:05,14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

frisches FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:22-06-2014
Ran by ***** (administrator) on ASUSEEE1008HA on 23-06-2014 23:43:07
Running from C:\Users\*****\Desktop
Platform: Microsoft Windows 7 Starter  (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Windows\System32\AsusService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(IBM) C:\Program Files\IBM\Lotus\Notes\nsd.exe
(IBM Corp) C:\Program Files\IBM\Lotus\Notes\ntmulti.exe
(Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Western Digital) C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe
(Western Digital ) C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
(Western Digital ) C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
(ASUSTeK Computer Inc.) C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [HotkeyService] => C:\Program Files\EeePC\HotkeyService\HotkeyService.exe [750008 2009-09-12] (ASUSTeK Computer Inc.)
HKLM\...\Run: [HotKeyMon] => C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe [100328 2009-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [SuperHybridEngine] => C:\Program Files\EeePC\SHE\SuperHybridEngine.exe [407552 2009-09-01] (ASUSTeK Computer Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7707168 2009-08-17] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe [5237256 2012-12-20] (Western Digital Technologies, Inc.)
HKLM\...\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mmrrqkqpas.vbs ()
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Aibelive\Voice Command\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\q04getu6.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-22] (Avira Operations GmbH & Co. KG)
R2 AsusService; C:\Windows\System32\AsusService.exe [219136 2009-08-19] () [File not signed]
R2 Lotus Notes Diagnostics; C:\Program Files\IBM\Lotus\Notes\nsd.exe [3417480 2010-08-11] (IBM)
R2 Multi-user Cleanup Service; C:\Program Files\IBM\Lotus\Notes\ntmulti.exe [58760 2010-08-11] (IBM Corp)
S3 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
S3 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
S3 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1155088 2012-12-20] (Western Digital )
R2 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [248840 2012-12-20] (Western Digital)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2014-06-22] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\windows\System32\DRIVERS\kbfiltr.sys [13880 2009-07-20] ( )
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\*****\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-23 23:13 - 2014-06-23 23:13 - 00000754 _____ () C:\Users\*****\Desktop\JRT.txt
2014-06-23 23:07 - 2014-06-23 23:07 - 00000000 ____D () C:\windows\ERUNT
2014-06-23 23:06 - 2014-06-23 23:06 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2014-06-23 23:05 - 2014-06-23 23:05 - 00000000 ____D () C:\Users\*****\Desktop\FRST-OlderVersion
2014-06-23 23:04 - 2014-06-23 23:04 - 00002448 _____ () C:\Users\*****\Desktop\AdwCleaner[S0].txt
2014-06-23 22:38 - 2014-06-23 23:02 - 00000000 ____D () C:\AdwCleaner
2014-06-23 22:37 - 2014-06-23 22:37 - 01342659 _____ () C:\Users\*****\Desktop\adwcleaner_3.213.exe
2014-06-23 22:37 - 2014-06-23 22:37 - 00001153 _____ () C:\Users\*****\Desktop\malwarebytes.txt
2014-06-23 22:34 - 2014-06-23 22:34 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-23 17:11 - 2014-06-23 17:11 - 00008921 _____ () C:\Users\*****\Desktop\combofix.txt
2014-06-23 17:07 - 2014-06-23 17:07 - 00008921 _____ () C:\ComboFix.txt
2014-06-23 08:42 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-23 08:42 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-23 08:42 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-23 08:42 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-23 08:42 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-23 08:42 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-23 08:42 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-23 08:42 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-23 08:35 - 2014-06-23 17:07 - 00000000 ____D () C:\Qoobox
2014-06-23 08:34 - 2014-06-23 09:36 - 00000000 ____D () C:\windows\erdnt
2014-06-23 08:33 - 2014-06-23 08:33 - 05209566 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2014-06-23 08:32 - 2014-06-23 08:32 - 00000000 ____D () C:\ProgramData\Panda Security
2014-06-23 08:32 - 2014-06-23 08:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-06-23 08:32 - 2014-06-23 08:32 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-06-23 08:31 - 2014-06-23 08:31 - 00848856 _____ (Panda Security ) C:\Users\*****\Desktop\USBVaccineSetup.exe
2014-06-22 22:55 - 2014-06-22 23:03 - 00003990 _____ () C:\Users\*****\Desktop\Gmer.txt
2014-06-22 22:30 - 2014-06-22 23:03 - 00029313 _____ () C:\Users\*****\Desktop\Addition.txt
2014-06-22 22:25 - 2014-06-23 23:43 - 00009833 _____ () C:\Users\*****\Desktop\FRST.txt
2014-06-22 22:24 - 2014-06-22 23:00 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-06-22 22:18 - 2014-06-22 22:18 - 00000682 _____ () C:\Users\*****\Desktop\text.txt
2014-06-22 21:29 - 2014-06-23 23:43 - 00000000 ____D () C:\FRST
2014-06-22 21:28 - 2014-06-22 21:28 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-06-22 21:26 - 2014-06-23 23:05 - 01073152 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2014-06-22 21:26 - 2014-06-22 21:26 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe
2014-06-22 21:25 - 2014-06-22 21:25 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2014-06-22 20:04 - 2014-06-22 20:25 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-22 20:02 - 2014-06-22 20:25 - 00000000 ____D () C:\Users\*****\Desktop\mbar
2014-06-22 20:01 - 2014-06-22 20:01 - 14349744 _____ (Malwarebytes Corp.) C:\Users\*****\Downloads\mbar-1.07.0.1012.exe
2014-06-22 19:24 - 2014-06-23 21:21 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 19:24 - 2014-06-22 20:02 - 00075480 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-22 19:24 - 2014-06-22 19:24 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-22 19:24 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-22 19:24 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-22 19:21 - 2014-06-22 19:21 - 00002131 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-22 19:21 - 2014-06-22 19:21 - 00002119 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-22 19:21 - 2014-06-22 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-22 19:20 - 2014-06-23 08:42 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 19:20 - 2014-06-22 19:55 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2014-06-22 19:20 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\windows\system32\sdnclean.exe
2014-06-22 19:19 - 2014-06-22 21:27 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DropboxMaster
2014-06-22 19:16 - 2014-06-22 19:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\*****\Downloads\spybot-2.3.exe
2014-06-22 19:14 - 2014-06-22 19:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-21 18:40 - 2014-06-21 18:40 - 00000000 ____D () C:\Users\*****\AppData\Local\CutePDF Writer
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\Program Files\GPLGS
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\Program Files\Acro Software
2014-06-21 14:40 - 2012-10-04 19:50 - 00088688 _____ () C:\windows\system32\cpwmon2k.dll
2014-06-21 14:39 - 2014-06-21 14:39 - 01955184 _____ (Acro Software Inc. ) C:\Users\*****\Downloads\CuteWriter.exe

==================== One Month Modified Files and Folders =======

2014-06-23 23:43 - 2014-06-22 22:25 - 00009833 _____ () C:\Users\*****\Desktop\FRST.txt
2014-06-23 23:43 - 2014-06-22 21:29 - 00000000 ____D () C:\FRST
2014-06-23 23:13 - 2014-06-23 23:13 - 00000754 _____ () C:\Users\*****\Desktop\JRT.txt
2014-06-23 23:11 - 2009-07-14 06:34 - 00009696 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-23 23:11 - 2009-07-14 06:34 - 00009696 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-23 23:08 - 2009-07-25 09:50 - 01611160 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-23 23:07 - 2014-06-23 23:07 - 00000000 ____D () C:\windows\ERUNT
2014-06-23 23:06 - 2014-06-23 23:06 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2014-06-23 23:05 - 2014-06-23 23:05 - 00000000 ____D () C:\Users\*****\Desktop\FRST-OlderVersion
2014-06-23 23:05 - 2014-06-22 21:26 - 01073152 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2014-06-23 23:05 - 2013-02-20 23:02 - 00000000 ____D () C:\Users\*****\AppData\Local\Mozilla
2014-06-23 23:05 - 2013-02-20 23:01 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-23 23:04 - 2014-06-23 23:04 - 00002448 _____ () C:\Users\*****\Desktop\AdwCleaner[S0].txt
2014-06-23 23:03 - 2009-09-14 21:07 - 00121192 _____ () C:\windows\PFRO.log
2014-06-23 23:03 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-23 23:03 - 2009-07-14 06:39 - 00062852 _____ () C:\windows\setupact.log
2014-06-23 23:02 - 2014-06-23 22:38 - 00000000 ____D () C:\AdwCleaner
2014-06-23 23:02 - 2013-02-16 18:21 - 00334352 _____ () C:\windows\WindowsUpdate.log
2014-06-23 22:37 - 2014-06-23 22:37 - 01342659 _____ () C:\Users\*****\Desktop\adwcleaner_3.213.exe
2014-06-23 22:37 - 2014-06-23 22:37 - 00001153 _____ () C:\Users\*****\Desktop\malwarebytes.txt
2014-06-23 22:34 - 2014-06-23 22:34 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-23 21:21 - 2014-06-22 19:24 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-23 17:11 - 2014-06-23 17:11 - 00008921 _____ () C:\Users\*****\Desktop\combofix.txt
2014-06-23 17:07 - 2014-06-23 17:07 - 00008921 _____ () C:\ComboFix.txt
2014-06-23 17:07 - 2014-06-23 08:35 - 00000000 ____D () C:\Qoobox
2014-06-23 17:04 - 2009-07-14 04:04 - 00000215 _____ () C:\windows\system.ini
2014-06-23 09:38 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-06-23 09:38 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-23 09:36 - 2014-06-23 08:34 - 00000000 ____D () C:\windows\erdnt
2014-06-23 08:42 - 2014-06-22 19:20 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-23 08:33 - 2014-06-23 08:33 - 05209566 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2014-06-23 08:32 - 2014-06-23 08:32 - 00000000 ____D () C:\ProgramData\Panda Security
2014-06-23 08:32 - 2014-06-23 08:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-06-23 08:32 - 2014-06-23 08:32 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-06-23 08:31 - 2014-06-23 08:31 - 00848856 _____ (Panda Security ) C:\Users\*****\Desktop\USBVaccineSetup.exe
2014-06-22 23:03 - 2014-06-22 22:55 - 00003990 _____ () C:\Users\*****\Desktop\Gmer.txt
2014-06-22 23:03 - 2014-06-22 22:30 - 00029313 _____ () C:\Users\*****\Desktop\Addition.txt
2014-06-22 23:00 - 2014-06-22 22:24 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-06-22 22:18 - 2014-06-22 22:18 - 00000682 _____ () C:\Users\*****\Desktop\text.txt
2014-06-22 22:07 - 2013-02-22 16:44 - 00000000 ___RD () C:\Users\*****\Dropbox
2014-06-22 22:07 - 2013-02-22 16:40 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-06-22 21:28 - 2014-06-22 21:28 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-06-22 21:28 - 2013-02-16 18:19 - 00000000 ____D () C:\Users\*****
2014-06-22 21:27 - 2014-06-22 19:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DropboxMaster
2014-06-22 21:26 - 2014-06-22 21:26 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe
2014-06-22 21:25 - 2014-06-22 21:25 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2014-06-22 21:20 - 2013-02-22 17:26 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-06-22 21:20 - 2013-02-22 17:26 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-06-22 20:25 - 2014-06-22 20:04 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-22 20:25 - 2014-06-22 20:02 - 00000000 ____D () C:\Users\*****\Desktop\mbar
2014-06-22 20:02 - 2014-06-22 19:24 - 00075480 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-22 20:01 - 2014-06-22 20:01 - 14349744 _____ (Malwarebytes Corp.) C:\Users\*****\Downloads\mbar-1.07.0.1012.exe
2014-06-22 19:55 - 2014-06-22 19:20 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2014-06-22 19:51 - 2013-03-01 16:21 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-06-22 19:51 - 2013-03-01 16:21 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-22 19:38 - 2013-05-11 08:14 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2014-06-22 19:38 - 2013-02-20 23:13 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-06-22 19:38 - 2013-02-20 23:13 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-06-22 19:38 - 2013-02-20 23:13 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2014-06-22 19:24 - 2014-06-22 19:24 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 19:24 - 2014-06-22 19:24 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-22 19:21 - 2014-06-22 19:21 - 00002131 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-22 19:21 - 2014-06-22 19:21 - 00002119 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-22 19:21 - 2014-06-22 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-22 19:18 - 2013-02-22 16:41 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-06-22 19:16 - 2014-06-22 19:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\*****\Downloads\spybot-2.3.exe
2014-06-22 19:15 - 2014-06-22 19:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-21 18:40 - 2014-06-21 18:40 - 00000000 ____D () C:\Users\*****\AppData\Local\CutePDF Writer
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CutePDF
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\Program Files\GPLGS
2014-06-21 14:40 - 2014-06-21 14:40 - 00000000 ____D () C:\Program Files\Acro Software
2014-06-21 14:39 - 2014-06-21 14:39 - 01955184 _____ (Acro Software Inc. ) C:\Users\*****\Downloads\CuteWriter.exe

Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-21 16:10

==================== End Of Log ============================

--- --- ---

--- --- ---

vielen Dank!

schrauber · 24.06.2014, 17:22

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Win7/32bit - USB Stick und SD Karte beinhalten Verknüpfungen

Log-Analyse und Auswertung: Win7/32bit - USB Stick und SD Karte beinhalten Verknüpfungen